Supported frameworks

Compliance frameworks supported by GRCLens

Cybersecurity, privacy, payment and health frameworks on one shared control model — assess once, satisfy several obligations, and deploy in your own environment.

One control model

Assess once, evidence everywhere

Frameworks overlap far more than most compliance programmes assume. GRCLens maps them onto a single control model, so evidence gathered for one obligation is reused wherever the same control applies — instead of being collected two or three times by different teams.

NZ PSR

New Zealand Government (PSR — hosted by NZSIS) · New Zealand

Assess and evidence the Protective Security Requirements across GOVSEC, PERSEC, INFOSEC and PHYSEC — ready for annual PSR assurance reporting.

NZ MCSS

National Cyber Security Centre (NCSC, part of GCSB) · New Zealand

Meet the Minimum Cyber Security Standards — evidence each standard on business-critical and externally facing systems, at the required maturity.

NZ HISO 10029

Te Whatu Ora — Health New Zealand · New Zealand

Protect health information to New Zealand's national standard — assess HISO 10029:2022 across plan, identify, protect, detect and respond.

AU PSPF

Australian Government — Department of Home Affairs · Australia

Assess protective security maturity across the PSPF domains — governance, risk, information, technology, personnel and physical security.

IRAP (AU ISM)

Australian Signals Directorate (ASD) · Australia

Manage Australian ISM assessments end to end — engagements, control-by-control evaluation, automated evidence collection and findings.

AESCSF / SOCI

AEMO (AESCSF) · Cyber and Infrastructure Security Centre (SOCI) · Australia

Evidence AESCSF maturity and SOCI Act risk-management obligations for Australian critical infrastructure — one assessment, board-ready reporting.

AU VPDSF

Office of the Victorian Information Commissioner (OVIC) · Australia (Victoria)

Assess and evidence the Victorian Protective Data Security Standards, from governance through ICT security, ready for OVIC attestation.

PCI DSS

PCI Security Standards Council · International

Scope your cardholder data environment, work through SAQ or ROC, and evidence every PCI DSS v4.0.1 requirement.

ISA/IEC 62443

ISA / IEC · International

Evidence industrial cybersecurity against ISA/IEC 62443 — from the security programme to the seven foundational requirements for control systems.

HIPAA

U.S. Department of Health & Human Services · United States

Run the required risk analysis, evidence administrative, physical and technical safeguards, and manage business associate obligations.

GDPR

European Union · European Union

Demonstrate accountability under the GDPR — lawful basis, data subject rights, records of processing and breach readiness, evidenced in one place.

NIST SP 800-53

U.S. National Institute of Standards and Technology (NIST) · United States / International

Assess and evidence NIST SP 800-53 Rev. 5 controls — the catalogue behind FISMA, FedRAMP and the Risk Management Framework.

SOC 2

AICPA · International

Map the Trust Services Criteria, maintain your system description, and evidence control operation across the observation period.

ISO/IEC 27001

ISO / IEC · International

Annex A controls, Statement of Applicability, risk treatment and evidence — managed in one place, ready for your certification body.