Compliance and certification across 11 frameworks
ISO 27001, SOC 2, TISAX, NIS2, DORA, BSI C5, GDPR, HIPAA, PCI DSS, Cyber Essentials and ISO 27017/27018 — with clear requirements, estimated timelines and cost ranges. One partner to guide you from initial assessment to compliance or certification.
Passeca's compliance practice covers eleven frameworks and the EU regulations that sit behind them. We run a five-step engagement — gap analysis, roadmap, implementation, internal audit, certification-body introduction — on the Hyperproof GRC platform, so evidence is collected once and reused across every framework you pursue.
How certification works with Passeca
The same five steps for every framework — what changes is the control set, the auditor, and the timeline. You always know which phase you are in and what happens next.
- 01
Gap analysis
We measure your current control environment against the target framework and rank every gap by risk. You leave this phase knowing exactly what is missing and what it will take to close it.
- 02
Roadmap
We turn the gap analysis into a sequenced, costed plan — what to fix first, who owns it, and when it lands. The roadmap is the single document your management team and your auditor both work from.
- 03
Implementation
We build the missing controls with you — policies, technical configuration, evidence collection — operating inside the Hyperproof GRC platform so nothing is documented twice.
- 04
Internal audit
Before any external auditor arrives, we run a full internal audit against the same criteria and fix what we find. Most failed certifications fail here first; we make sure that happens in private.
- 05
Certification
We introduce you to an accredited certification or assessment body, sit through the audit with you, and manage the response to any findings until the certificate is issued.
Which compliance requirements apply to your business?
Explore the requirements your customers, regulators or board expect you to meet. Understand who each standard or regulation applies to, what it involves, how long the process may take and the estimated costs.
Do the work once. Prove it everywhere — on Hyperproof.
Hyperproof collects evidence automatically from AWS, Azure, Jira and Slack, and maps a single control to 160+ frameworks — so the work you do for ISO 27001 also closes SOC 2, BSI C5 and TISAX evidence. It is how we make multi-framework certification affordable.
Not sure which framework you need?
Start with the most common business scenarios and explore the standards and regulations that may be relevant to you.
An enterprise customer sent a security questionnaire
- SOC 2 (most common in SaaS/tech)
- ISO 27001 (enterprise & EU)
You are an EU essential or important entity
- NIS2 (mandatory)
- often paired with ISO 27001
You handle protected health information
- HIPAA
- GDPR if EU residents are involved
Compliance and certification, answered
Which compliance frameworks does Passeca cover?
Does Passeca issue the certificate, or prepare us for it?
How long does compliance certification take?
What does compliance certification cost?
Can Passeca do more than one framework at once?
What is Hyperproof and why does Passeca use it?
What is the difference between a regulation and a framework?
How do I know which framework I need?
Book a free compliance consultation
Tell us your trigger — a customer demand, a regulation, a tender — and we will map the shortest path to the right certificate, with a timeline and cost band.