Custom frameworks
Your own control set
Internal standards, customer contractual requirements, or a regulation we don't ship yet, modelled the same way.
What Custom is
Not every requirement you have to meet comes with a published standard. Internal security policies, contractual obligations from a large customer, and sector regulations all need the same treatment: a set of requirements, controls that satisfy them, and evidence that the controls operate.
A custom framework is modelled exactly like a shipped one. It sits on the same control set, so a control you already maintain for SOC 2 can satisfy a customer-specific requirement without being duplicated or evidenced twice.
Who needs Custom
A customer contract has security requirements that do not map to any framework you hold. You have an internal standard you want evidenced properly. Or you need a regulation we have not shipped yet.
How TrustLynce helps with Custom
Define requirements
Model the requirements as they are written, in the structure the source document uses.
Map to existing controls
Point requirements at controls you already run. Evidence collected once satisfies every framework that asks for it.
Fill the gaps
Where nothing existing satisfies a requirement, add a control and collect its evidence like any other.
Report on it
A custom framework reports the same way a shipped one does, so a customer-specific obligation is as visible as SOC 2.
Custom questions
Internal standards, contractual security requirements, and sector regulations. Anything expressible as requirements with evidence behind them.
No. Custom frameworks sit on the same controls, so a control already evidenced for another framework satisfies the custom requirement too.
You can, and we help. The modelling work is mapping requirements to controls, which is the same work as adopting any framework.
That depends on the requirement and who is asking. A customer verifying a contractual obligation is common; there is no certification for a framework you defined.
The controls and evidence carry over. Modelling it yourself now is not work you throw away.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.