# Supported compliance frameworks: SOC 2, ISO 27001 · Meiyam

> Meiyam supports SOC 2 and ISO 27001:2022 today, from the same read-only connections and the same policies. HIPAA and FIPS 140-3 are planned.

Canonical: https://meiyam.com/frameworks

Frameworks

## Supported frameworks: SOC 2 and ISO 27001

One set of connections, checks and policies serves both frameworks. A framework is listed as supported only when the product scores it.

SOC 2 criteria

8 of 38

checked by automated rules

-   Automated rules 8
-   Documents 30

ISO 27001 Annex A controls

18 of 93

checked by automated rules

-   Automated rules 18
-   Documents 75

Crosswalk

### One check, two frameworks

One failing check is one finding, counted against both frameworks.

7 live integrations: AWS GitHub Microsoft Entra ID Atlassian Slack Okta Cloudflare

**AWS:** 25 rules feed 4 SOC 2 criteria (CC6.1, CC6.6, CC7.1 and CC7.2) and 9 Annex A controls (A.5.17, A.5.33, A.8.3, A.8.5, A.8.9, A.8.15, A.8.20, A.8.22 and A.8.24).

**GitHub:** 17 rules feed 5 SOC 2 criteria (CC6.1, CC6.3, CC6.6, CC7.1 and CC8.1) and 7 Annex A controls (A.8.2, A.8.3, A.8.4, A.8.5, A.8.8, A.8.28 and A.8.32).

**Microsoft Entra ID:** 10 rules feed 3 SOC 2 criteria (CC6.1, CC6.3 and CC6.6) and 4 Annex A controls (A.5.14, A.5.18, A.8.2 and A.8.5).

**Atlassian:** 3 rules feed 2 SOC 2 criteria (CC6.1 and CC6.3) and 2 Annex A controls (A.5.18 and A.8.3).

**Slack:** 9 rules feed 4 SOC 2 criteria (CC6.1, CC6.2, CC6.3 and CC6.6) and 5 Annex A controls (A.5.14, A.5.18, A.5.23, A.8.2 and A.8.5).

**Okta:** 9 rules feed 2 SOC 2 criteria (CC6.1 and CC6.3) and 5 Annex A controls (A.5.17, A.5.18, A.5.23, A.8.2 and A.8.5).

**Cloudflare:** 4 rules feed 2 SOC 2 criteria (CC6.6 and CC6.7) and 2 Annex A controls (A.8.21 and A.8.24).

-   8 SOC 2 criteria with automated rules
-   7 live integrations
-   18 Annex A controls with automated rules

### Supported and planned frameworks

-   [SOC 2 Supported Security, Availability and Confidentiality: 38 criteria. Automated rules check 8 of them on every scan; policies and records evidence the rest. See SOC 2 coverage](https://meiyam.com/frameworks/soc-2)
-   [ISO 27001 Supported Clauses 4 to 10 and all 93 Annex A controls. Automated rules check 18 Annex A controls on every scan; policies and records evidence the clauses and the rest. See ISO 27001 coverage](https://meiyam.com/frameworks/iso-27001)
-   HIPAA Planned The HIPAA Security Rule, scored from controls Meiyam already checks. Not available today.
    
-   FIPS 140-3 Planned FIPS 140-3 evidence in the product is planned. A standalone FIPS assessment CLI runs entirely in your own environment today.
    

### Hear first when the next framework is supported

Tell us which frameworks you need when you register.

[Register interest](https://meiyam.com/register)