# Framework assessments

> How security consultants and vCISO teams assess clients against CMMC, CPCSC, ISO 27001, CIS Controls, NIST CSF, SOC 2 and TPN, and where Control+S fits.

Canonical: https://controls.run/frameworks

Practical guides for consultants and vCISO teams assessing clients against a security framework: what the framework asks for, what evidence to request, and how to reuse that evidence across frameworks.

- [CPCSC readiness assessments for consultants](https://controls.run/frameworks/cpcsc): CPCSC Levels 1, 2 and 3 explained: the 13 Level 1 controls, the evidence that supports them, and how consultants prepare defence suppliers for Level 2.
- [Évaluations de préparation au PCCC pour les consultants](https://controls.run/frameworks/pccc): Les niveaux 1, 2 et 3 du PCCC, les 13 contrôles du niveau 1, les éléments probants à demander et la préparation d’un fournisseur de la défense au niveau 2.
- [CMMC Level 2 and NIST SP 800-171 assessments for consultants](https://controls.run/frameworks/cmmc): How consultants and RPOs run a CMMC Level 2 readiness assessment against NIST SP 800-171, calculate the SPRS score and check eligibility for conditional status.
- [ISO 27001 gap assessments for consultants](https://controls.run/frameworks/iso-27001): How to run an ISO 27001:2022 gap assessment across clauses 4 to 10 and the 93 Annex A controls, what evidence to request and how to deliver a readiness report.
- [NIST CSF 2.0 maturity assessments](https://controls.run/frameworks/nist-csf): How to assess a client against NIST CSF 2.0's six functions, why CSF has no built-in maturity scale, and a 0 to 5 rubric that ties each score to evidence.
- [CIS Controls v8.1 assessments for consultants](https://controls.run/frameworks/cis-controls): How consultants assess clients against the 18 CIS Controls and 153 Safeguards in v8.1, choose an Implementation Group and turn results into a roadmap.
- [SOC 2 readiness assessments for consultants](https://controls.run/frameworks/soc-2): How to run a SOC 2 readiness assessment for a client, from choosing Trust Services Criteria to testing Type II evidence, and where the CPA firm's role begins.
- [How to run a security gap assessment for a client](https://controls.run/frameworks/security-gap-assessment): How consultants run a security gap assessment or gap analysis for ISO 27001, SOC 2, PCI DSS, CMMC or CPCSC, from scoping and evidence to the remediation plan.
- [How to run a cybersecurity maturity assessment for a client](https://controls.run/frameworks/cybersecurity-maturity-assessment): How consultants score cybersecurity maturity per control from client evidence, which scale to use with NIST CSF, ISO 27001 or CIS, and the mistakes to avoid.
- [TPN assessment readiness for media and entertainment vendors](https://controls.run/frameworks/tpn): How consultants prepare media and entertainment vendors for a Trusted Partner Network assessment, what each TPN Shield requires and how to scope it.
- [Reusing evidence across ISO 27001, NIST CSF, CIS Controls, SOC 2 and CPCSC](https://controls.run/frameworks/cross-framework-evidence): How one piece of client evidence supports controls in ISO 27001, NIST CSF 2.0, CIS Controls, SOC 2 and CPCSC, with a worked crosswalk and the limits of reuse.