Frameworks are the control libraries your assessments map onto. Prusik Health ships 24 built-in libraries and you can add your own.
Built-in frameworks: HIPAA, SOC 2 and SOC 2 Privacy, ISO/IEC 27001:2022, ISO/IEC 27701:2019, ISO/IEC 42001:2023, NIST CSF 2.0, NIST Privacy Framework 1.0, NIST AI RMF 1.0, NIST SP 800-53 Rev. 5 and NIST SP 800-53 Rev. 5 Moderate, NIST SP 800-66 Rev. 2, HITRUST CSF v11, HHS 405(d) HICP, CIS Controls v8 and CIS Controls v8 IG1, PCI DSS v4.0, FedRAMP, CMMC 2.0, GDPR, CCPA/CPRA, ONC Information Blocking, 42 CFR Part 2, and consumer-privacy law (US state). Every one of the question bank's controls maps to several of these at once, so a single HIPAA assessment reports against your whole standards portfolio.
Authoring your own custom framework requires Premium or Advanced.
The 24 built-in libraries are part of every paid plan: Advanced can scope
any number of them into an assessment, Premium one of your choice (more as
an add-on). The free plan assesses HIPAA (with NIST SP 800-66 alongside it).
Two separate limits apply to frameworks, and they are different questions:
which you may put in scope (free: the HIPAA Security Rule only, not the Privacy or Breach Rules; Premium and Advanced: any),
and how many (free and Premium: one, with more available as an add-on on
Premium; Advanced: all).
Built-in frameworks come pre-populated with their controls and are read-only — you can scope them into an assessment but not edit them. Custom frameworks are yours to build: create one with a name, description, source, and version, then add controls to it (each has a reference like AC-1, a title, an optional category, and a required flag). Mark a framework active to make it available for scoping; deactivate one you're not using.
Frameworks don't do anything on their own — you put them to work by scoping them into an assessment. The core HIPAA questions are always present (on the free plan, the Security Rule ones); adding a framework maps your answers onto that framework's controls too, so one assessment can report against several standards. (See Assessments for scoping, and Cross-Framework Coverage for the AI that suggests where one answer satisfies controls in other frameworks.)
The Frameworks page — browsing the built-in libraries and managing your own (create, edit, add/remove controls, activate) — is for org admins on Premium or Advanced. Every member still sees the frameworks an assessment is scoped to, inside that assessment. A custom framework belongs to your organization and can be deleted by an admin.