Frameworks
Frameworks are the foundation of your compliance program. Claw GRC ships with 11 pre-loaded frameworks covering security, privacy, AI governance, and industry-specific regulations.
Supported Frameworks
| Framework | Version | Controls | Standard Body | Key Industries |
|---|---|---|---|---|
| SOC 2 Type II | 2017 | 64 | AICPA | SaaS, Technology |
| ISO 27001 | 2022 | 93 | ISO/IEC | All industries |
| NIST 800-53 | Rev 5 | 323 | NIST | Government, Defense |
| NIST CSF | 2.0 | 106 | NIST | All industries |
| HIPAA | 2013 | 72 | HHS | Healthcare |
| PCI DSS | 4.0 | 64 | PCI SSC | Financial, Retail |
| GDPR | 2016 | 99 | EU | EU operations |
| CCPA/CPRA | 2023 | 23 | California | Consumer data |
| EU AI Act | 2024 | 85 | EU | AI deployers |
| NIST AI RMF | 1.0 | 72 | NIST | AI deployers |
| FedRAMP | High | 325+ | GSA | Government SaaS |
Viewing Frameworks
Navigate to Frameworks in the sidebar to see all available frameworks. Each framework card shows:
- Framework name and version
- Number of controls
- Your organization's completion percentage
- Standard body
Click on a framework to drill into its controls, organized by category (e.g., SOC 2 Trust Services Criteria, ISO 27001 Annex A domains).
Control Mappings
The most powerful feature of Claw GRC's framework management is cross-framework control mapping. When you view a framework control, you can see:
- The unified control it maps to
- Other framework controls that map to the same unified control
- The confidence score of each mapping (0.0-1.0)
This means that when you provide evidence for a SOC 2 control, you automatically get compliance credit for the equivalent controls in every other framework.
Example: Access Control Mapping
The unified control for "Logical Access Security" maps to:
- SOC 2:
CC6.1(Logical and Physical Access Controls) - ISO 27001:
A.9.1.1(Access Control Policy) - NIST 800-53:
AC-2(Account Management) - HIPAA:
164.312(a)(1)(Access Control) - PCI DSS:
7.1(Restrict Access by Business Need)
Satisfying any one of these automatically counts toward all of them.
Compliance Score by Framework
Each framework has its own compliance score, calculated from the status of its controls:
framework_score = (satisfied_controls / total_controls) * 100
A control is "satisfied" when:
- All required evidence artifacts are uploaded and validated
- The evidence is within its freshness window
- No open critical or high-severity findings affect the control
API Endpoints
| Method | Endpoint | Description |
|---|---|---|
GET | /api/v1/frameworks | List all frameworks |
GET | /api/v1/frameworks/:id | Get framework details |
GET | /api/v1/frameworks/:id/controls | List controls for a framework |
See Frameworks API Reference for full documentation.
Tips and Best Practices
- Start with one framework -- If you are new to compliance, start with SOC 2. Its controls are broad enough that you will naturally build coverage for other frameworks.
- Leverage overlapping controls -- Before starting a new framework, check the mapping page to see how much you have already covered from your existing work.
- Focus on unified controls -- Manage your compliance at the unified control level rather than the framework level. This prevents duplicate work and ensures consistency.
- Track framework progress -- Use the dashboard to monitor progress across all active frameworks. Set milestones for achieving specific coverage targets (e.g., 80% SOC 2 coverage by Q3).