How every page is built
How it is built
Every evidence requirement, every evidence record and every cross-framework link on this site is generated from one held record: the clauses of the frameworks we hold, exported at build time, each stated in our words and cited to its control or clause.
Where the requirements come from
We hold ISO 27001:2022 (a licensed complete copy) and SOC 2 (an issuer free complete copy). At build time we export each framework clause by clause: its requirement text, the evidence records the text describes, the common gaps, and the reviewed cross-framework links that survived refutation. That export is the single record the pages, the free request-list generator and the binder all read.
What is our wording and what is the framework's
Each requirement is our own plain-language statement of the clause, not the standard verbatim. We cite the clause for every line so you can check it. We do not reproduce the standards.
What a link means
A link is a topical overlap between an ISO 27001:2022 control and a SOC 2 criterion, carried with a confidence (high, medium or low) and a one-line reason. Mappings that failed refutation were removed; 168 remain. A link does not establish that meeting one requirement satisfies the other, and it is not certification.
How it is kept current
A refresh re-exports the frameworks and rebuilds the pages (scripts/refresh_seed.py). Where the framework changes, the record changes and the pages follow.
What it does not do
It does not perform an audit, does not certify, does not give legal advice and does not decide whether a framework applies to you.