The compliance frameworks Fintra maps your controls to
What mapped means
Mapped means Fintra carries controls from the framework and keeps evidence against them. Each control is mapped once to one of Fintra’s canonical controls, so the same evidence counts toward every framework that asks for it.
Some sets are complete (SOX, PCI DSS, client trust accounting, SOC 2 and GDPR); others are starter sets that carry part of a framework. Where a control has an automated test, the row says how many; the rest are kept as documented controls.
Finance: money and financial controls
The frameworks an auditor tests when money is involved: financial reporting, card data, client money and payroll on public work.
- SOC 1 (SSAE 18)Seven control objectives Fintra drafted for a service organization's system description, with the controls under each. A SOC 1 has no fixed criteria: your service auditor tests the objectives you state.A starter set: 29 controls
- Sarbanes-Oxley (SOX 404)Internal control over financial reporting, as public companies test it.20 controls, 13 tested automatically against your records
- PCI DSS 4.0Protecting card data wherever a business takes or stores it, at the level of each requirement an assessor tests.65 controls, 10 tested automatically against your records
- Client trust accounting (ABA Model Rule 1.15)Pooled trust accounts, a ledger for each client and three-way reconciliation, with the fee and conflicts rules around them.14 controls, 8 tested automatically against your records
- Certified payroll (Davis-Bacon)Prevailing wage and certified payroll reporting on public work.A starter set: 20 controls
- Surety bondingBond capacity, the bonds themselves and the financial statements a surety asks for before it bonds a contractor.Fintra's own control set: 20 controls
- Funds held for othersClient trust, retainage, restricted grants, escrow and deposits: money a business holds that is not its own.Fintra's own control set: 9 controls, 9 tested automatically against your records
- Billing entitlement and revenue recognitionWork done, billable, earned, invoiced and collected, each kept apart with its evidence.Fintra's own control set: 8 controls, 8 tested automatically against your records
Security, privacy and AI
The security and privacy frameworks a buyer's review asks about, and the authority given to people and AI agents.
- SOC 2 Type IISecurity, availability, processing integrity, confidentiality and privacy: every Trust Services Criterion.61 controls, 11 tested automatically against your records
- GDPRThe EU's rules on personal data, as the obligations the regulation places on a controller or processor.33 controls, 12 tested automatically against your records
- ISO/IEC 27001 Annex AInformation security controls for a management system.A starter set: 5 controls
- HIPAA Security RuleProtecting electronic health information.A starter set: 5 controls
- HITRUST CSFA security framework for healthcare organizations.A starter set: 15 controls
- FDA 21 CFR Part 11Electronic records and electronic signatures in regulated work.A starter set: 10 controls
- Delegated authority and effect budgetsAuthority limited by what an action can do, for people, services and AI agents alike.Fintra's own control set: 12 controls, 12 tested automatically against your records
Customer success
What a contact center is asked for in a procurement review, tied to the same controls as security and finance.
- Contact center controlsWhat a buyer's security review asks of a contact center: card data scope, data residency, single sign-on, continuity, recording consent, erasure and AI oversight. Each control is tied to a SOC 2, GDPR or PCI DSS requirement.Fintra's own control set: 41 controls, 16 tested automatically against your records
Industry frameworks
Trucking
- FMCSA motor carrier safetyThe objectives a motor carrier's auditor tests, with the bill of lading and proof of delivery at the center.A starter set: 15 controls, 10 tested automatically against your records
- DOT hazardous materialsClassification, marking, placarding, training and incident notice for hazardous materials.A starter set: 10 controls
Construction
- AIA contract administrationPay applications, change orders and the schedule of values under the AIA contract documents.A starter set: 23 controls
Healthcare
- CMS Conditions of ParticipationWhat Medicare and Medicaid require of a participating provider.A starter set: 8 controls
- CLIAQuality standards for clinical laboratory testing.A starter set: 7 controls
Energy and industrial
- API standardsA starter set: 10 controls
- BOEM offshore leasesA starter set: 7 controls
- BSEE offshore safetyA starter set: 12 controls
- EPA Clean Air ActA starter set: 10 controls
- EPA Clean Water ActA starter set: 8 controls
- EPA RCRAA starter set: 9 controls
- EPA SPCCA starter set: 7 controls
- PHMSA pipeline safetyA starter set: 12 controls
- OSHA process safety managementA starter set: 13 controls
- NIST SP 800-82A starter set: 15 controls
- ISO 45001A starter set: 14 controls
- ISO 14001A starter set: 13 controls
- Energy insurance readinessFintra's own control set: 12 controls
What is not listed here
Fintra’s library names more frameworks than the ones on this page, so Fintra can suggest the ones that apply to your industry. We state a control count only for the frameworks listed here. Fintra does not publish a total for the library until its newer control sets have been reviewed.
Some frameworks appear only as a starter crosswalk, which lists a framework’s requirements against Fintra’s controls, or as a control set still under review. Neither is described here as a framework whose controls Fintra carries. Ask us before you rely on one.
Fintra also publishes open frameworks of its own, such as the AI Finance Governance Framework. They answer a different question: see the frameworks Fintra publishes.
Bring the framework your auditor asks about.
We will show its controls in Fintra, the evidence behind each one, and what is still yours to do.