Run many frameworks on one control set.

SOC 2 Type I & II

SOC 2 is the trust-services report most SaaS buyers ask for first. Varman maps your controls to the security, availability, and confidentiality criteria and keeps evidence current between audits.

ISO/IEC 27001

ISO 27001 is the international standard for an information security management system. Run it alongside SOC 2 on the same control set instead of duplicating effort.

General Data Protection Regulation

GDPR governs how you handle the personal data of people in the EU. Varman maps data-protection obligations to concrete controls and evidence, from records of processing to breach response.

HIPAA Security Rule

HIPAA sets safeguards for protected health information. Administrative, physical, and technical safeguards are tracked as controls with live evidence.

ISO/IEC 42001

ISO 42001 is the first management-system standard for artificial intelligence. Pair it with the AI System Register and EU AI Act risk tiers for a complete AI governance record.

NIST SP 800-171

NIST SP 800-171 protects controlled unclassified information. A prebuilt control set you can adopt and start evidencing immediately.

NIST Cybersecurity Framework 2.0

The NIST Cybersecurity Framework organizes security outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Varman ships version 2.0 as a prebuilt framework.

PCI DSS Level 1

PCI DSS is the payment card industry standard for protecting cardholder data. Varman includes a Level 1 framework, the tier assessed on site with a Report on Compliance.

NIS 2 Directive

NIS 2 is the EU directive (2022/2555) on cybersecurity risk management and incident reporting for essential and important entities.

CMMC 2.0 Level 2

CMMC 2.0 Level 2 is the US Department of Defense certification level for contractors handling controlled unclassified information. Its 110 practices align to NIST SP 800-171 Rev 2.

ISO 9001

ISO 9001 is the international standard for quality management systems. Run it next to your security frameworks instead of in a separate tool.

California Consumer Privacy Act

The CCPA gives California residents rights over their personal information and sets obligations for the businesses that handle it.

PIPEDA

PIPEDA is the federal privacy law of Canada for private-sector organizations. It is built around ten fair information principles.