Secureframe

Secureframe provides a security compliance automation platform that helps organizations achieve and maintain certification against security and privacy frameworks including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, NIST and CMMC 2.0. The platform automates evidence collection, runs automated tests against controls, and provides continuous monitoring, risk management, vendor management, vendor access review, personnel management and asset inventory in a single system.

AI-based capabilities are marketed under the Secureframe AI umbrella and include Comply AI for Remediation, Comply AI for Risk, and Questionnaire Automation, which are positioned to reduce manual effort in remediating failing controls, assessing risk and responding to security questionnaires. Trust-facing features such as readiness reports and a Trust Center are intended to let customers demonstrate their security posture during sales cycles. Product lines include Secureframe Comply for general compliance work and Secureframe Defense, a version aimed at defense contractors that focuses on protecting Controlled Unclassified Information (CUI) and meeting CMMC requirements for the Defense Industrial Base.

Business model

Software platform sold to organizations that need to obtain and maintain security and privacy compliance certifications, combined with support from in-house compliance experts and former auditors.

Traction

The company states that more than 6,000 customers use the platform. Published case studies describe customers achieving SOC 2 and ISO 27001 compliance, adding HIPAA compliance, and shortening sales cycles after certification.

Latest developments

The company is publishing guidance on the pause of CMMC Phase 2 and what the Department of War and prime contractors still require from suppliers.