Why plan the second framework now?
Most teams buy for one framework, usually SOC 2 or ISO 27001, and add a second when a customer or market asks for it. The second purchase is made under time pressure, with switching costs already sunk. Knowing now how each vendor handles framework two avoids a surprise add-on or a forced plan upgrade.
What do the entry plans say?
Scytale's Build Starter lists the Build Platform Plan with one framework and add-ons; its Scale plan adds custom frameworks. Vanta's Essentials lists one framework, with Plus, Professional and Enterprise above it. Drata's Compliance Automation Foundation lists up to 50 FTEs and one pre-mapped framework limited to SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR, with additional frameworks as add-ons and GRC Advanced allowing any framework. Sprinto's Foundation states 25+ frameworks automated out of the box and 200+ digitized. Comp AI quotes per deal with frameworks as a stated price factor. Delve publishes no plans.
Which frameworks usually come second?
It depends on who you sell to. Teams with health data often add HIPAA; teams in payments, PCI DSS; teams building AI products, ISO 42001 or the EU AI Act; teams selling to US government, FedRAMP or CMMC. Check that each vendor names the frameworks you are likely to need: our framework ladder lists which vendors name which frameworks on their pages.
What should the contract say?
Ask for the add-on price of each likely next framework in writing, whether controls and evidence carry over, whether the same expert or support channel covers the new framework, and whether a second auditor engagement is included or separate. Where a headcount cap applies, ask what happens when you cross it.
How does headcount interact with framework count?
Plan limits are usually set on two axes: frameworks and people. Drata publishes both on Foundation: up to 50 FTEs and one pre-mapped framework. A company that grows past 50 people and adds a framework in the same year may cross both limits at once. Vanta and Scytale publish framework scope on their entry plans but no headcount figure on the pages we reviewed, so ask. Comp AI names company size as a price factor. Our stack builder flags these limits when you choose a headcount band and more than one framework, which is a quick way to see where a quote will change.