Frameworks | Thornhart

top of page

Frameworks

We translate leading security and compliance frameworks into practical, audit-ready programs that drive real risk reduction and operational maturity.

Frameworks used to establish cybersecurity governance, policy structures, and program oversight.

ISO/IEC 27001 — Information Security Management Systems (ISMS)
ISO/IEC 27002 — Information Security Controls
NIST Cybersecurity Framework (CSF)
COSO Enterprise Risk Management (ERM) — Integrating with Strategy and Performance

Focus areas:
Security governance models, policy frameworks, program maturity, executive and board reporting.

Frameworks supporting structured identification, analysis, treatment, and acceptance of cyber and technology risk.

ISO 31000 — Risk Management — Guidelines
ISO/IEC 27005 — Information Security Risk Management
NIST Special Publication 800-30 — Guide for Conducting Risk Assessments

Focus areas:
Risk methodology design, risk registers, risk treatment planning, executive risk decisions.

Frameworks and regulations governing the protection of personal, sensitive, and regulated data.

ISO/IEC 27701 — Privacy Information Management Systems (PIMS)
GDPR — General Data Protection Regulation
CCPA / CPRA — California Consumer Privacy Act / California Privacy Rights Act
HIPAA — Health Insurance Portability and Accountability Act

Focus areas:
Privacy program design, data protection controls, DPIAs, regulatory readiness.

Frameworks and regulations used to demonstrate compliance and audit readiness.

FFIEC — Federal Financial Institutions Examination Council Cybersecurity Guidance
FFIEC — Federal Financial Institutions Examination Council IT Examination Handbooks
GLBA — Gramm-Leach-Bliley Act Safeguards Rule
PCI DSS — Payment Card Industry Data Security Standard
CMMC — Cybersecurity Maturity Model Certification
NIST Special Publication 800-171 — Protecting Controlled Unclassified Information (CUI)

Focus areas:
Readiness assessments, audit preparation, remediation management, evidence development.

Frameworks for governing artificial intelligence, automation, and emerging technologies.

Frameworks for governing artificial intelligence, automation, and emerging technologies.
ISO/IEC 42001 — Artificial Intelligence Management Systems (AIMS)
NIST AI Risk Management Framework — Governing and Managing AI Risk
EU Artificial Intelligence Act (EU AI Act)

Focus areas:
AI governance programs, use-case approval workflows, AI risk assessments, policy and control design.

bottom of page