Audit-ready compliance packages, built from one control library
Field guides, flashcards, editable policies, workbooks and full mock-audit kits for SOC 2 Type 2, HITRUST and ISO/IEC 27001 — tailored to SaaS, healthcare, financial services and government contractors.
Which framework do you need?
Answer three quick questions for a recommendation.
The packages
Each package is a complete, editable kit. Pick one, or save with the bundle.
SOC 2 Type 2
For US B2B and SaaS companies whose customers ask for a SOC 2 report.
- 13-page field guide + 54 flashcards
- 19 editable policies
- Control matrix: 76 controls → all 61 criteria
- Mock audit kit with sampling & workpapers
- System description & bridge letter templates
HITRUST e1 · i1 · r2
For vendors to hospitals, health plans and other healthcare buyers.
- 13-page field guide + 42 flashcards
- 18 policies + procedure template
- Maturity scorer for all 19 domains
- Mock assessment kit with CAP tracking
- Scope & inheritance worksheet
ISO/IEC 27001:2022
For companies selling internationally or wanting a certificate.
- 12-page field guide + 39 flashcards
- 12 ISMS core documents (clauses 4–10)
- Statement of Applicability: all 93 Annex A
- Internal audit & mock certification kit
- Risk register with treatment plan
Complete GRC Library — all three packages
Everything in the SOC 2, HITRUST and ISO 27001 packages. Because they share one control library, most controls, policies and evidence serve all three — so you build one program, not three.
- All guides, flashcards, policies, workbooks and mock-audit kits
- Cross-framework control mapping in every workbook
- Industry overlays for SaaS, healthcare, fintech and government contractors
Compare the packages
| SOC 2 Type 2 | HITRUST | ISO/IEC 27001 | |
|---|---|---|---|
| Prepares you for (issued by others, not included) | A SOC 2 Type 2 report, issued by a licensed CPA firm | A HITRUST validated report and certification, issued by HITRUST after an authorized assessor tests you | An ISO 27001 certificate, issued by a certification body |
| Field guide | 13 pages | 13 pages | 12 pages |
| Flashcards | 54 | 42 | 39 |
| Policies | 19 editable | 18 + procedure template | 18 + procedure template |
| Framework documents | System description, bridge letter | Scope & inheritance worksheet, CAP report | 12 ISMS core documents |
| Main workbook | Control matrix & evidence tracker | Maturity scorer & CAP tracker | Statement of Applicability & control matrix |
| Rehearsal | Mock audit kit | Mock assessment kit | Internal audit & mock certification kit |
| Industry overlays | SaaS · Healthcare · Fintech · GovCon | SaaS · Healthcare · Fintech · GovCon | SaaS · Healthcare · Fintech · GovCon |
| Price | $695 | $995 | $845 |
One control, three frameworks
A sample from the shared library. Write the control once, collect its evidence once, map it everywhere.
| ID | Control | SOC 2 | HITRUST domain · level | ISO 27001 |
|---|---|---|---|---|
| IAM-01 | Central identity and MFA | CC6.1, CC5.2 | 11 Access Control · e1 | A.5.16, A.8.5 |
| IAM-03 | Timely deprovisioning | CC6.2, CC6.3 | 11 Access Control · e1 | A.5.11, A.5.18, A.6.5 |
| IAM-04 | User access reviews | CC6.2, CC6.3 | 11 Access Control · i1 | A.5.18 |
| CHG-01 | Change approval and testing | CC8.1, CC5.2 | 06 Configuration Management · e1 | A.8.32 |
| VUL-02 | Risk-based remediation | CC7.1 | 07 Vulnerability Management · e1 | A.8.8 |
The GRC Starter Kit
A 6-page PDF to get you moving this month:
- Which framework fits your customers
- SOC 2 vs HITRUST vs ISO 27001 at a glance
- Ten controls mapped across all three
- A 30-day starter plan and the five most common first-audit findings
- 24 sample flashcards
Want a hand?
Packages and services work together. We can run the mock audit with you or take you from gap to ready.
Questions
Are these audits or certifications?
No. They're readiness packages. Only a licensed CPA firm can issue a SOC 2 report, only HITRUST can issue a HITRUST certification, and only a certification body can certify an ISO 27001 ISMS. Our packages prepare you and let you rehearse.
Which one should I buy first?
The one your customers ask for. Use the framework finder above, or ask us. If you need two or more, the bundle saves money and the shared control library means you reuse most of the work.
What does 'one control library' mean?
Every package uses the same control IDs and evidence. A control like 'leavers lose access within one business day' is written once and mapped to SOC 2, HITRUST and ISO 27001, so you don't build three programs.
What formats are the files?
Editable Word documents, Excel workbooks (with formulas that also work in Google Sheets and LibreOffice) and PDF guides and flashcards.
Do the packages include the standards themselves?
No. ISO standards and the HITRUST CSF are licensed by their owners. Our documents use our own wording and refer to clause, criterion or domain names and numbers.
Can you help us use them?
Yes. We offer readiness assessments, guided mock audits and advisory hours. Packages and services work together.
Strat Cyber Advisors is not a CPA firm, HITRUST external assessor or certification body, and is not affiliated with the AICPA, HITRUST or ISO. Packages support readiness; reports, certifications and certificates are issued only by those bodies. SOC 2 is a registered mark of the AICPA. HITRUST, HITRUST CSF and MyCSF are trademarks of HITRUST Services Corp. Facts current to October 2026.
Strat Cyber
Need cybersecurity support? Share your project details. We're here to safeguard your digital assets.
Join free to unlock in-depth readiness assessments, executive and vendor toolkits, advisories and the briefing archive.