Track: Running the program · Lesson 9 of 10
Adding ISO 27001 or a second framework after SOC 2
Short answer
Many companies add a second framework after SOC 2, often ISO 27001, HIPAA or GDPR. Platforms that map one control to many frameworks let you reuse SOC 2 work. Stated framework counts on the six vendors' pages range from ten listed by Thoropass to 200+ digitized by Sprinto.
By the SOC 2 Vendor Compare ledger desk · Published 2025-08-26 · Reviewed 2026-09-29 · Editorial assessment
What is cross-mapping?
Cross-mapping links one internal control to the matching requirements in several frameworks. An access review control, for example, can satisfy a SOC 2 criterion and an ISO 27001 control at the same time. The evidence is collected once and counts for both. Scytale states control cross-mapping across its 80+ frameworks; Sprinto describes a common control framework where you set up controls once and reuse them.
Source: Scytale all frameworks · read 2026-09-29
Source: Sprinto pricing · read 2026-09-29
Why is ISO 27001 the usual second framework?
ISO/IEC 27001 is the international standard for information security management systems. The current edition, ISO/IEC 27001:2022, is Edition 3, published in October 2022 by ISO/IEC JTC 1/SC 27. Unlike SOC 2, it leads to a certificate from a certification body, and many buyers outside the US expect it. A lot of SOC 2 security work carries over, but ISO 27001 adds management-system requirements such as a defined scope, risk treatment and internal audit.
Source: ISO/IEC 27001:2022 · read 2026-09-29
What do the six vendors state?
Sprinto: 200+ frameworks digitized, 25+ automated out of the box. Scytale: 80+ security, privacy and AI frameworks with cross-mapping. Vanta: 35+ frameworks. Drata: 30+ pre-built frameworks plus custom, with Foundation limited to one pre-mapped framework. Secureframe: a list across security, federal, privacy and AI frameworks without a total count. Thoropass: ten frameworks listed on its homepage. Counts are the vendors' own and are defined differently, so check the specific frameworks you need.
Source: Sprinto frameworks · read 2026-09-29
Source: Scytale all frameworks · read 2026-09-29
Source: Vanta homepage · read 2026-09-29
Source: Drata frameworks · read 2026-09-29
Source: Secureframe frameworks · read 2026-09-29
Source: Thoropass homepage · read 2026-09-29
What should you check before adding a framework?
Ask whether the new framework is pre-mapped on your plan or an add-on, whether evidence is shared across frameworks, and whether your auditor or certification body can work from the same platform. Plan limits matter here: several entry plans include one framework.
What if you need a framework the vendor does not list?
Ask whether the vendor supports custom frameworks. Vanta and Drata list custom frameworks, Scytale's Scale plan lists custom frameworks, and Drata's GRC Advanced plan covers any framework. A custom framework usually means someone maps controls by hand, so ask who does the mapping and how evidence is reused.
Does adding a framework change the audit?
Yes. A second framework usually brings a second assessor, such as an ISO 27001 certification body alongside your SOC 2 CPA firm, each with its own schedule. Platforms that share evidence across frameworks let both work from the same records. Ask whether your vendor's auditor network covers the new framework, or whether you will contract that assessor yourself.