SCICON SYSTEMS Talk to us
Framework mapping

No tool makes you compliant. These ones produce the evidence.

Auditors and procurement teams rarely ask what a piece of software does. They ask which control it satisfies, and where the record is when someone comes looking. Here is exactly where each product lands against the four frameworks UK SMEs are actually asked about — including the places it lands nowhere.

Read this first. Certification is awarded against your organisation, not your software. An auditor assesses your management system, your policies and the way your people actually work. What a tool can do is make a control operate consistently and leave a record — which is the part most small teams fail on.

Nothing below should be read as a claim that buying a product satisfies a control. It is a map of where each product produces evidence you would otherwise have to assemble by hand.

Where each product lands

Direct The product is the control’s evidence
Supporting Contributes, but does not satisfy it alone
None No honest mapping
ProductISO 27001SOC 2Cyber EssentialsCE Plus
PushItProSecret sharingDirectDirectSupportingSupporting
VolarianDocument sharingDirectDirectNoneNone
FlashItSyncFile transferSupportingSupportingNoneNone
Supply Chain ScorecardThird-party riskDirectDirectNoneNone
RiskRadarRisk visibilityDirectDirectNoneNone
CVE ScannerVulnerabilitiesDirectDirectDirectDirect
SignMeInProVisitor managementDirectDirectNoneNone
Control by control

The specific controls, named.

If you are building a Statement of Applicability or answering a SOC 2 readiness questionnaire, these are the reference numbers to put next to each product.

ISO 27001
2022 edition · Annex A
Strongest coverage

Six of the seven products map directly to a named Annex A control. Supplier relationships and technical vulnerability management are the two areas where a small team most often has a policy and no operating evidence — and both are covered.

A.5.7
Threat intelligence — CVE Scanner, RiskRadar
A.5.14
Information transfer — PushItPro, Volarian, FlashItSync
A.5.17
Authentication information — PushItPro, for the secure distribution of credentials
A.5.19 – A.5.22
Supplier relationships, through to monitoring and review of supplier services — Supply Chain Scorecard
A.7.2, A.7.4
Physical entry and physical security monitoring — SignMeInPro
A.8.3
Information access restriction — Volarian
A.8.8
Management of technical vulnerabilities — CVE Scanner
A.8.12
Data leakage prevention — Volarian, which is view-only by design
A.8.15
Logging — Volarian, SignMeInPro
A.8.24
Use of cryptography — PushItPro, Volarian
Clause 9.1
Monitoring, measurement, analysis and evaluation — RiskRadar
SOC 2
Trust Services Criteria
Strong coverage

SOC 2 is evidence-hungry in a way ISO is not: an auditor samples a period, so a control that runs continuously and logs itself is worth far more than one that is performed occasionally and written up afterwards.

CC3.2
Risk identification and analysis — RiskRadar, Supply Chain Scorecard
CC4.1
Ongoing monitoring of controls — RiskRadar
CC6.1
Logical access security — PushItPro, Volarian
CC6.4
Physical access to facilities — SignMeInPro
CC6.7
Transmission and movement of information — PushItPro, Volarian, FlashItSync
CC7.1
Detection of vulnerabilities and configuration change — CVE Scanner
CC9.2
Vendor and business partner risk management — Supply Chain Scorecard
C1.1, C1.2
Confidentiality criteria, where in scope — PushItPro, Volarian
Cyber Essentials
Five technical controls
One control of five

Cyber Essentials is deliberately narrow. It governs five things on the equipment you own and the accounts you issue. We build a product for one of them, and part of a second. The rest you will solve with your firewall, your device management and your endpoint protection — not with us.

1 · Firewalls
No Scicon product. Boundary and device firewalls sit outside the portfolio.
2 · Secure configuration
No Scicon product. This is device build standards and default-credential removal.
3 · Security update management
CVE Scanner — direct. It tells you which published vulnerabilities apply to what you actually run, which is the evidence this control asks for.
4 · User access control
PushItPro — supporting. It removes the habit of sending credentials over email and Teams, but the control itself is about account provisioning and administrative privilege.
5 · Malware protection
No Scicon product. Endpoint protection is somebody else’s job.
Cyber Essentials Plus
Same five controls, independently tested
One control of five

Cyber Essentials Plus tests the same five controls, but an assessor verifies them hands-on rather than accepting a self-assessment — including an authenticated vulnerability scan of a sample of your devices. Most failures at this stage are missing patches on machines nobody realised were in scope.

Patch verification
CVE Scanner — direct. Finding your own missing updates before the assessor does is the single highest-value piece of preparation for this assessment.
Everything else
Unchanged from Cyber Essentials above. Passing is a matter of your estate, not your suppliers.
The honest part

What we do not help with.

A mapping table that shows coverage everywhere is a sales document, not a mapping table. These are the places you will need something other than us.

Not covered

The management system itself

ISO 27001 is mostly clauses 4 to 10 — scope, leadership, risk methodology, internal audit, management review. No product in this portfolio writes or runs that. It is the largest part of a certification and it is work, not software.

Not covered

Endpoints, firewalls and devices

Three of the five Cyber Essentials controls are about equipment: firewalls, secure configuration and malware protection. We build none of it, and a scheme assessor will test all of it.

Not covered

Policies and staff awareness

Acceptable use, joiners and leavers, training records, disciplinary process. Every framework asks. None of it is a tooling problem.

Not covered

The audit

We are not an auditor, a certification body or a scheme assessor, and we do not sell readiness consultancy. If you need one, we will point you at people who do it properly.

Where to start

Pick the framework you are being asked about.

If a client questionnaire triggered this, it is almost always ISO 27001 or SOC 2, and Supply Chain Scorecard plus CVE Scanner will close the two gaps that get raised most. If an insurer or a public-sector buyer triggered it, it is Cyber Essentials, and CVE Scanner is the only part of it we can help you with. Tell us which letter landed on your desk and we will tell you honestly whether we are any use.

Talk to usSee the portfolio

Control references are to ISO/IEC 27001:2022 Annex A and the AICPA Trust Services Criteria. Cyber Essentials controls follow the NCSC scheme requirements. This mapping is our own assessment and is not endorsed by any certification body or scheme assessor.