Service
Custom & Industry Frameworks
For the standards the usual templates do not cover.
Not every obligation maps to a well-known standard. You may face a sector regulation, a regional requirement, a customer's bespoke security schedule or an internal standard your business has set. These rarely come with a ready-made template.
We work through the requirements, map them to controls that suit your business and, where needed, build a custom framework from the ground up, so you can meet the obligation and show how you meet it.
What we cover
Requirement interpretation
We read the regulation, contract schedule or internal standard in full and turn its obligations into plain, testable statements.
Control design
We design controls that satisfy each obligation and suit the way your business actually operates.
Control reuse mapping
We cross-reference obligations against controls you already run so you build only what is genuinely new.
Policy and procedure authoring
We write the policies and procedures each obligation calls for in language tied to the specific standard.
Evidence definition
We set out what evidence each control must produce and who is expected to own it.
Demonstration guidance
We prepare how your team will show the regulator, customer or body that each obligation is met.
Structures we draw on
What's included
- Analysis of sector, regional or contractual requirements
- A tailored control framework mapped to your business
- Reuse of existing controls where they already satisfy a requirement
- Policies and procedures written for the specific standard
- Evidence requirements defined per obligation
- Guidance on demonstrating compliance to the relevant party
What you walk away with
- A control framework that fits an obligation with no standard template
- Existing controls reused rather than duplicated
- A clear way to demonstrate compliance to whoever is asking
How it runs
Interpret
We work through the requirement, whether a regulation, a contract schedule or an internal standard, and turn it into concrete controls.
Map
We check what your existing controls already satisfy, so you build on what you have rather than duplicate it.
Build
We create the controls, policies and evidence requirements the standard needs, tailored to how you operate.
Demonstrate
We set out how to show compliance to the regulator, customer or body that is asking.
How we approach it
There is more than one way to meet an obligation that has no ready-made template.
| A tailored framework mapped to your controls | A generic template stretched to fit | |
|---|---|---|
| Starting point | The actual wording of your obligation | A standard someone else wrote for a different purpose |
| Existing controls | Reused where they already satisfy a requirement | Duplicated or ignored |
| Fit to the business | Controls shaped to how you operate | Processes bent to match the template |
| Evidence | Defined per obligation | Assumed from the template's defaults |
| Demonstration | A clear line from control to obligation | A gap the regulator or customer has to bridge |
What this supports
A custom framework is built to its own obligation, and we map it against the recognised standards you may already hold or pursue so the work is reused rather than repeated.
- ISO 27001
- We reuse Annex A controls you already operate and map the custom obligation across them.
- NIST CSF
- We align bespoke controls to the Identify, Protect, Detect, Respond and Recover functions where it helps structure the framework.
- HIPAA
- We interpret the administrative, physical and technical safeguards into controls suited to your systems.
- GDPR
- We translate data protection obligations into controls and the evidence needed to show them.
- DPDP
- We map India's Digital Personal Data Protection obligations to controls that fit your processing.
FAQ
- What counts as a custom framework?
- Anything without a widely used template: a sector regulation, a regional data requirement, a customer's bespoke security schedule or an internal standard your business has defined.
- Can you map a custom framework to ones we already hold?
- Yes. Where you already meet SOC 2 or ISO 27001 controls, we map those across so you reuse the work and only build what is genuinely new.
- Do you advise if we are unsure which standard applies?
- Yes. Part of the work is interpreting the obligation honestly and telling you what it does and does not require before any controls are built.
Related services
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read