Most people arrive here on their second obligation.
Nobody sets out to collect compliance frameworks. They arrive one at a time — a contract clause, an insurer, a customer questionnaire, a prime flowdown. The good news is that the second one is far less work than the first, because most of what they ask for is the same work described in different language.
The frameworks we run
Each one has its own page explaining what it actually requires, how Greypike turns it into assigned work, and what changes if it's your second rather than your first.
FTC Safeguards
CPA firms, tax, bookkeeping, payroll, advisorsA written information security program under GLBA. Reaches far more firms than most people assume — and arrives via an insurer or a client, not a regulator.
SOC 2
SaaS and technology companiesAn independent attestation by a CPA firm against the Trust Services Criteria. Usually starts with a stalled deal rather than an ambition.
HIPAA
Business Associates and healthcare vendorsAdministrative, physical and technical safeguards. If you've signed a Business Associate Agreement, the obligation is yours directly.
CMMC & NIST 800-171
Government contractors and the defense supply chain110 requirements across fourteen families, assessed under CMMC. The only one of these where the data itself may need somewhere new to live — which is what the Secure Enclave is for.
ISO 27001
Technology companies and manufacturersA certifiable information security management system. Before you commit, check whether your contract asks for alignment or for an actual certificate — they are not the same thing.
Not sure which one applies to you?
Most people don't arrive knowing the framework. They arrive knowing what happened. Pick the one closest to yours.
WHAT ACTUALLY HAPPENED?
Pick two. See what you only have to do once.
This is the whole argument for running frameworks in one place rather than as separate projects. Choose what you already have, and what just landed.
However many frameworks you owe, the process is the same
Greypike doesn't run five separate programs. It runs one, and maps the completed work onto whichever obligations it satisfies. Here's a single requirement, followed all the way through.
"Review logical access to systems and data on a periodic basis and remove access that is no longer required."
Accepted. Two contractor accounts removed and recorded, and the export is dated and signed off — which is the part assessors actually check.
You did the work once. Five frameworks asked for it in five different ways, and every one of them is now answered from the same evidence.
One framework included. Add more as they arrive.
Every subscription covers one framework and a dedicated compliance manager. The second costs less than the first, because most of the work is already done.
