US frameworks, from NIST to
HIPAA, in one place
NIST CSF, SP 800-53, SP 800-171, HIPAA, HITRUST, CCPA, the FTC Safeguards Rule, SEC rules and more are in the library, with shared work counted across them.
USA · one control, credited everywhere
Document and test the incident response plan
In progress · Owner: Head of Security
Credited to
- NIST CSF 2.0
- NIST SP 800-53
- HIPAA Security Rule
- SOC 2
Illustration of how work is credited. Not client data.
- US frameworks
- The federal baselines and the sector rules
- NIST family
- CSF, 800-53, 800-171, SSDF, AI RMF
- Sector rules
- HIPAA, HITRUST, FTC, SEC
- Cross-framework
- Shared work
The situation
What US organisations are asked for
A mix of federal baselines and sector rules.
NIST frameworks
CSF, 800-53, 800-171 and others.
HIPAA and HITRUST
Healthcare.
CCPA
Consumer privacy.
FTC and SEC rules
Financial services.
AI risk
NIST AI RMF.
Audit
Assessors and customers.
The difference
One programme under several rules
Avoid starting over for each.
The usual way
- Separate efforts per regime
- Evidence duplicated
- No view across regimes
In Netra
- One record with shared controls
- Evidence counted across frameworks
- Status per framework in one view
From baseline to sector rules
Build on a common spine.
- 1
Start with NIST
A common baseline.
- 2
Add sector rules
HIPAA, FTC, SEC or others.
- 3
Run the work
Owners and evidence.
- 4
Audit
Assessors invited in.
- 5
Report
To leadership.
Quiet audits. Loud confidence.
Assessors receive evidence already attached to controls, whichever framework they test against.
See the Audit CentreOutcomes
What changes
One programme, many rules.
Shared work
Credit across frameworks.
Clear status
Per framework.
Reports
From live work.
Frameworks
US frameworks in the library
Each opens a page on what it covers.
In the platform
The modules behind this page
Every module works on the same record, so a task done once is counted wherever it applies.
Compliance Centre
Status for every framework, derived from the work.
Task Engine
Every requirement as an owned task with evidence.
Audit Centre
Internal, external, certification and regulatory audits end to end.
Risk Manager
A register where residual risk falls as work is done.
Third-Party Risk
Vendors discovered, assessed and reported to the board.
Dashboard and Reports
A live posture score and one-click board reports.
The detail: reporting, engagement and what to prepare
Questions we are asked
Does it include NIST CSF 2.0?
Yes, and NIST CSF 1.1, SP 800-53, SP 800-171, SSDF and AI RMF 1.0.
Is HIPAA covered?
The HIPAA Security Rule and HITRUST CSF are both in the library.
Can we add frameworks later?
Yes. Completed work carries across where controls overlap.
See Netra for United States
A demo built around your frameworks and your kind of organisation, not a generic tour.