> ## Documentation Index
> Fetch the complete documentation index at: https://docs.assuric.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Frameworks: Overview
> The compliance standards Assuric tracks for you, which ones you do per product, and what's different about some of them.
**Quick summary**
* Assuric tracks the frameworks your workspace needs, some done once for your organisation and some per product.
* Each product you map frameworks to gets its own copy of the tasks that repeat per product, so your workload grows with every product.
* You redo Cyber Essentials and [DSPT](/assuric-overview/glossary#abbreviations) every year, but your progress carries over to each new version.
## What a framework is
A framework is a compliance standard Assuric tracks for you. Each one is broken down into:
* **Requirements:** the standard's wording, word for word, which you can't edit.
* **Tasks:** the work that meets the requirements, which you can edit.
Each framework comes with recommended tasks mapped to its requirements. If they don't fit, [create your own tasks](/tasks/creating-custom-tasks) or map tasks you already have from another framework.
To open a framework, click **Frameworks** under **Compliance** in the sidebar, or open its area: **Clinical Safety**, **Privacy & Security**, **Quality** or **Clinical Governance**. If a framework you're expecting is missing, get in touch with our team!
## Organisation-wide and per-product work
Assuric enables each framework once for your workspace, and after that you do each task once for your organisation or once for each product.
| Group | Frameworks | What it means |
| - | - | - |
| **Done per product** | DCB0129, DTAC, Class I UK MD | You complete one for each product, such as a DTAC form or a clinical safety case report. |
| **Organisation-wide, with some tasks per product** | ISO 9001, ISO 13485, GDPR | You do these company-wide, but some tasks repeat for each product you map them to, and for ISO 13485 most do. |
| **Organisation-wide only** | Cyber Essentials, ISO 27001, DSPT, SOC 2, HIPAA, ISO 14971, CQC Registration, CQC | You do these once for your organisation. |
When you map frameworks to a product, you choose from the first two groups. That gives the product its own copy of every [per-product task](/tasks/product-specific-tasks), so the work grows with each product you add.
## Due dates and renewals
To set a due date or repeating schedule:
* **On a task:** [set a due date and recurrence](/tasks/task-management#set-a-due-date-and-recurrence).
* **For a whole framework:** click the calendar button on its page to open *Framework Schedule*, where you set the *Due Date* and *Recurrence* (for DSPT, *Annually*).
A Cyber Essentials certificate lasts 12 months, so to renew it answer *Renewal* rather than *First Time Application* in the questionnaire. DSPT publishes a new toolkit version each year, and you submit against it again.
## Framework-specific additions
| Framework | What to know |
| - | - |
| **CQC Registration** and **CQC** | You'll usually have both: Registration is the one-off process of becoming a registered provider, and CQC is what you're assessed against once you're registered. |
| **DSPT** | Your [category](/privacy-security/dspt) decides which requirements you get. |
| **DTAC** | You [build and submit the assessment](/privacy-security/dtac) in its **DTAC Forms** panel. |
| **Cyber Essentials** | The *Cyber Essentials Questionnaire* is at the end of its **Tasks** tab, and the *Cyber Essentials certification completed* task shows how to ask our team to certify you. |
When DSPT, DTAC or Cyber Essentials moves to a new version, your progress and gaps carry over.
For internal audits, see [Audit and review records](/quality/audit-and-review-records) and [Give an auditor access](/quality/auditor-access).
## The frameworks by area
Assuric covers 14 frameworks.
| Area | Framework | In one line |
| - | - | - |
| Clinical Safety | **DCB0129** | NHS Digital Clinical Safety for Manufacturers. |
| Clinical Safety | **Class I UK MD** | Class I (low risk) software as a medical device, under UK MDR and the MHRA. |
| Clinical Safety | **ISO 14971** | Risk management for medical devices. |
| Privacy & Security | **DTAC** | Digital Technology Assessment Criteria, the NHS assessment. |
| Privacy & Security | **DSPT** | Data Security and Protection Toolkit, the NHS's annual self-assessment. |
| Privacy & Security | **Cyber Essentials** | A certification you get through a self-assessment questionnaire. |
| Privacy & Security | **ISO 27001** | The information security standard. |
| Privacy & Security | **GDPR** | The data protection regulation. |
| Privacy & Security | **HIPAA** | The US health data privacy law, for Covered Entities and Business Associates. |
| Privacy & Security | **SOC 2** | An independent audit report on how you secure customer data. |
| Quality | **ISO 9001** | The general quality management standard. |
| Quality | **ISO 13485** | The quality management standard for medical devices. |
| Clinical Governance | **CQC Registration** | The one-off process of becoming a CQC-registered provider. |
| Clinical Governance | **CQC** | Care Quality Commission regulations for online healthcare providers. |
## Related articles
How Assuric shows your progress, and how tasks link to requirements.
Map frameworks to a specific product.
The work that meets your frameworks' requirements.
DCB0129, DCB0160 and the other frameworks behind clinical safety.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.