Skip to content
New · AI governance: inventory your AI systems, check the controls, certify ISO 42001.New · AI governance for ISO 42001.See it
Frameworks

Every framework you're asked for, on one evidence base

Every framework runs on the same connected systems and the same tamper-evident evidence. Subscribe to the standards your buyers and regulators expect, from SOC 2 and ISO 27001 to GDPR, HIPAA, and more, with no cap and more added on request.

Book a demo
Certified and attested, audits included
Attestation report

SOC 2

B2B SaaS and technology companies that handle customer data. It's the report enterprise buyers in North America ask for most during vendor due diligence.

How Viglyn runs it
Certification

ISO 27001

Companies selling globally, where ISO 27001 certification is the common security baseline buyers recognize.

How Viglyn runs it
Certification

ISO 42001

Companies that ship AI features or run AI inside their operations and are asked by enterprise buyers, regulators or partners how that AI is governed.

How Viglyn runs it
Certification

ISO 27701

Companies that already hold or are pursuing ISO 27001 and whose customers in Europe, the UK or Asia-Pacific ask for proof that privacy, not only security, is managed.

How Viglyn runs it
Certification

ISO 22301

Companies whose customers depend on them staying up: SaaS with contractual availability commitments, suppliers to regulated industries, and anyone asked for continuity evidence under DORA or a customer's third-party risk program.

How Viglyn runs it
Certification

ISO 27017

SaaS and cloud service providers whose customers ask how the cloud is secured, and cloud customers in regulated sectors who need to evidence their side of the shared responsibility.

How Viglyn runs it
Attestation report

PCI DSS

Merchants, payment service providers and any SaaS company whose product touches card data or whose customers' acquirers ask for an Attestation of Compliance.

How Viglyn runs it
Attestation report

SOC 1

Payroll, billing, payments, fund administration, claims and financial SaaS providers whose customers' auditors ask how the service could affect their financial statements.

How Viglyn runs it
Certification

ISO 27018

SaaS and cloud providers that process personal data for their customers and are asked, by European and Asia-Pacific buyers in particular, how that data is protected and governed in the cloud.

How Viglyn runs it
Certification

CSA STAR

Cloud and SaaS providers whose enterprise buyers check the STAR registry, and providers that want their ISO 27001 or SOC 2 work to say something specifically about the cloud.

How Viglyn runs it
Certification

Cyber Essentials

Companies selling to the UK public sector or to UK enterprises that ask for it, and any small or mid-size business that wants a recognized baseline with a fast route to a certificate.

How Viglyn runs it
Regulations and frameworks, assessed on the same evidence
Regulation

HIPAA

Health-tech and SaaS companies that create, receive, store or transmit PHI for US healthcare customers, and any vendor those customers ask to sign a business associate agreement.

How Viglyn runs it
Regulation

GDPR

Companies with customers, users or employees in the EU or the UK, and any SaaS vendor whose customers ask for a data processing agreement before they sign.

How Viglyn runs it
Regulation

DORA

EU financial entities of every size, and the SaaS and ICT providers that serve them and are asked for DORA-aligned contracts, registers and evidence.

How Viglyn runs it
Framework

NIST CSF

Companies selling into US enterprises, critical infrastructure and the public sector, and any security team that wants one structure to report posture to its board.

How Viglyn runs it
Framework

NIST AI RMF

Companies that build or deploy AI systems for US customers or the public sector, and anyone whose buyers, insurers or regulators ask how AI risk is governed, especially alongside an ISO 42001 program.

How Viglyn runs it
Framework

NIST 800-53

Companies selling to US federal and state agencies, their contractors and suppliers, and anyone pursuing FedRAMP or a customer's 800-53-based security requirements.

How Viglyn runs it
Framework

CIS Controls v8

Companies that want a practical security baseline before or alongside a certification, and anyone whose insurer, customer or regulator references the CIS Controls.

How Viglyn runs it
Which one do you need

The standards buyers weigh against each other

The short answer first, then the differences row by row, for the pairs that come up in every security review.

In the product

Readiness you can point at, criterion by criterion

Every criterion in the framework, coloured by how much evidence stands behind it, with automated checks and artifact evidence counted separately.

Cross-mapping

Do the work once, use it everywhere

One set of evidence maps across frameworks. Work you do for SOC 2 counts toward ISO 27001, and the other way around.

  • One compliance score per framework, from shared evidence
  • No cap on how many frameworks you can use
  • Adding a framework reuses everything that already maps
Framework coverage

One evidence base, every standard you're asked for

Teams map the same evidence across the frameworks their buyers and regulators expect, including these, and not limited to them.

Pursuing something not listed here? There's no cap on frameworks, and we add more on request. Talk to us.

Need a regional privacy or security framework your buyers ask for? It runs on the same evidence base. Talk to us about coverage.

See Viglyn on your stack

A 30-minute walkthrough on your stack. Walk away knowing exactly how fast you could be audit-ready. No commitment.