The frameworks you answer to, resolved into one control set.
Kmetog maps controls from the security, industry and data protection frameworks regulated SMBs are most often asked for. Overlaps are merged, so adding a second framework adds the difference, not a second workload.
Requirements become tests you can run.
Each framework clause is linked to one or more controls, and each control to a test or attestation task. When a clause changes in a new framework version, the mapping is updated and you see what moved.
- Shared controls. Common requirements are tested once and credited everywhere they apply.
- Version aware. Framework revisions are reflected with a clear view of new or changed clauses.
- Custom frameworks. Enterprise workspaces can load customer questionnaires or internal standards.
Frameworks mapped today, and what is next.
| Framework | Scope covered | Status |
|---|---|---|
| Cross-industry security | ||
| SOC 2 (Trust Services Criteria) | Security, availability, confidentiality | Available |
| ISO/IEC 27001:2022 | Annex A controls and ISMS clauses | Available |
| NIST Cybersecurity Framework 2.0 | Govern, identify, protect, detect, respond, recover | Being added |
| Fintech and financial services | ||
| PCI DSS v4.0 | Cardholder data environment requirements | Available |
| RBI IT Governance and Cyber Security directions | Regulated entities in India | Being added |
| Healthcare and pharma | ||
| HIPAA Security Rule | Administrative, physical and technical safeguards | Available |
| 21 CFR Part 11 | Electronic records and electronic signatures | Available |
| EU GMP Annex 11 | Computerised systems in GMP environments | Available |
| Data protection | ||
| GDPR | Security of processing and accountability controls | Available |
| Digital Personal Data Protection Act 2023 (India) | Data fiduciary obligations | Being added |
Mapping a framework means Kmetog tests and evidences the technical and operational controls it contains. Some clauses, such as scoping decisions or management commitments, rely on your team and your auditor. We will tell you plainly which parts of a framework are automated for your environment before you sign up.
What teams usually ask
Our framework is not listed. Can you support it?
Tell us which one. Custom and regional frameworks can be mapped on the Enterprise plan, and demand from customers shapes which frameworks we add next.
Does using Kmetog mean we are certified?
No. Certification or attestation comes from an accredited auditor or assessor. Kmetog does the operational work and produces the evidence that assessment relies on.
Automated Control Testing
Checks run against your systems every cycle
ExploreAudit Evidence Generation
Timestamped proof attached to every control
ExploreRemediation Tracking
Failed controls followed through to closure
ExplorePolicy & Procedure Management
Policies kept current and tied to controls
ExploreCheck coverage for your exact frameworks.
Share what you are audited against and we will walk through what Kmetog automates and what stays with your team.