Map once. Reuse across every audit.

Security, availability, confidentiality, processing integrity and privacy criteria for service organizations.

Information security management system requirements, including risk treatment and Annex A controls.

Lawful basis, data subject rights, processor agreements and cross-border transfer safeguards.

Administrative, physical and technical safeguards for protected health information.

Requirements for protecting cardholder data across networks, applications and operations.