Compliance scoping tool for small business
What compliance do you actually need? Answer 6 questions. Get a clear answer. Free.
What the compliance scoping questions explore
The scoping tool asks about industry, employee band, card payments, health information, enterprise or government sales, and sensitive customer data. It returns a rule-based shortlist of frameworks to investigate. The purpose is to organize an initial conversation about obligations and customer expectations, not to make a final legal applicability decision.
Name and email are collected when you submit. The answers and recommendations are stored with that submission. Employee band provides context but does not change the current framework-selection rules. The tool does not examine contracts, data flows, technical configurations, or evidence of implemented controls.
How the current recommendation rules work
A Yes to card payments adds PCI DSS. Health information answered Yes or Sometimes adds HIPAA. Enterprise or government sales answered Yes or Pursuing adds SOC 2. Government Contractor as the industry adds CMMC, and a Yes to sensitive customer data adds ISO 27001. Cyber Hygiene Baseline is included in every result.
These triggers are intentionally broad. Handling health-related information does not alone establish a HIPAA-covered relationship. Government contracting alone does not identify a CMMC requirement, and the questionnaire does not ask about CUI. Sensitive data alone does not make ISO certification mandatory. Confirm the real obligation rather than treating the shortlist as a verdict.
Interpret effort and timelines as placeholders for planning
Each framework’s effort and timeline labels are preset descriptions, not estimates calculated from your team size or evidence. They do not promise a completion date. Actual work depends on the system boundary, existing controls, assessment route, implementation capacity, and external reviewers.
Frameworks are not interchangeable. SOC 2 is an attestation report, ISO 27001 addresses an information security management system, and HIPAA and payment-security requirements depend on specific activities and relationships. Shared controls may help across frameworks, but each applicable scope and assessment expectation still needs review.
What to do with your shortlist
Collect the customer request, contract clause, payment-provider guidance, or official material behind each possible requirement. Map relevant information, systems, users, and providers, then identify an accountable owner. Distinguish required work from optional assurance sought by a buyer so your project starts with the right outcome.
Use the learning articles and glossary to prepare questions for a qualified adviser or assessor. A general questionnaire cannot certify compliance or replace advice about a specific business relationship. Its useful output is a starting list to validate, followed by a documented scope and evidence-based gap review.