Framework Guides

Each compliance framework has specific requirements, terminology, and approaches. These guides help you understand what each framework requires and how to achieve compliance.

Supported Frameworks

SOC 2

What Is SOC 2?

SOC 2 (Service Organization Control Type 2) is an auditing framework that verifies service providers securely manage data. It's based on five Trust Service Criteria.

Trust Service Criteria

Key Requirements

• Security policies and procedures
• Access control mechanisms
• Change management processes
• Incident response procedures
• Risk management program

Preparing for SOC 2 Audit

1. Enable SOC 2 framework in PartnerAlly
2. Upload all relevant policies
3. Review and remediate gaps
4. Collect evidence throughout the period
5. Engage an auditor

ISO 27001

What Is ISO 27001?

ISO 27001 is an international standard for information security management systems (ISMS). It provides a framework for managing security risks.

Structure

Annex A Themes

• Organizational Controls (37 controls)
• People Controls (8 controls)
• Physical Controls (14 controls)
• Technological Controls (34 controls)

Key Requirements

• Information security policy
• Risk assessment process
• Statement of Applicability (SoA)
• Internal audit program
• Management review process

Achieving ISO 27001 Certification

1. Define ISMS scope
2. Conduct risk assessment
3. Implement controls
4. Conduct internal audit
5. Undergo certification audit

HIPAA

What Is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) protects health information privacy and security. It applies to covered entities and business associates.

Key Rules

Safeguards

Administrative Safeguards:

• Security management process
• Assigned security responsibility
• Workforce security
• Information access management
• Security awareness training
• Contingency plan
• Evaluation

Physical Safeguards:

• Facility access controls
• Workstation use and security
• Device and media controls

Technical Safeguards:

• Access control
• Audit controls
• Integrity
• Transmission security

HIPAA Compliance in PartnerAlly

1. Enable HIPAA framework
2. Upload BAA templates and policies
3. Document safeguards implementation
4. Conduct required risk assessment
5. Track ongoing compliance

GDPR

What Is GDPR?

GDPR (General Data Protection Regulation) is the EU's data protection law. It applies to organizations processing EU residents' data.

Key Principles

Data Subject Rights

• Right to access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object

GDPR Compliance Steps

1. Map data processing activities
2. Establish lawful bases
3. Implement security measures
4. Document processing
5. Enable data subject rights

PCI DSS

What Is PCI DSS?

PCI DSS (Payment Card Industry Data Security Standard) protects cardholder data. It applies to any organization handling payment cards.

Requirements

Compliance Levels

Based on transaction volume:

• Level 1: Over 6 million transactions (annual assessment)
• Level 2: 1-6 million transactions
• Level 3: 20,000-1 million e-commerce
• Level 4: Under 20,000 e-commerce

Key Controls

• Encrypt cardholder data
• Restrict access on need-to-know basis
• Regular vulnerability scans
• Penetration testing
• Security awareness training

AML/BSA

What Is AML/BSA?

Anti-Money Laundering (AML) and Bank Secrecy Act (BSA) regulations combat financial crimes. Required for financial institutions and money services businesses.

Key Requirements

Crypto-Specific AML

For cryptocurrency businesses:

• Travel Rule compliance
• Wallet screening
• Blockchain analytics
• Exchange monitoring

Choosing Your Frameworks

Factors to Consider

Common Combinations

Next Steps

• Best Practices - Implementation guidance
• Video Tutorials - Visual guides
• Framework Settings - Enable frameworks