Configure US frameworks

This page is how to select US framework IDs on a heyGRC org. It is not a CCPA program guide and it does not decide whether a statute applies to you.

Activation. CCPA review runs when CCPA is selected in org config. A bare (unconfigured) install uses ISO 27001, SOC 2, and GDPR. There is no install-time picker. Suggest recommended never adds CCPA.

Marketing (what a diff can review): CCPA, reviewed in the pull request, What CCPA actually checks in your repo, US SaaS. Whole-program applicability lives on ISMS Copilot, not here.

Selectable US IDs (sample)

Use the live catalog, not a remembered count: GET https://api.heygrc.com/v1/frameworks (no auth). Sample IDs that exist in that catalog today:

SOC_2, HIPAA, CCPA, NIST_800_53

Other catalog IDs US teams often select include NIST_CSF, NIST_800_171, NIST_AI_RMF, CMMC, PCI_DSS, and FEDRAMP. Confirm each id on the live GET before you PUT it. Unknown ids are rejected (422 unknown_frameworks).

SOC_1 and SOX are not in the catalog. Do not send them.

Never PUT blind on an existing org

PUT /v1/config is full-replace for profile and frameworks. If you omit an id that is already selected, it is cleared. For an org that already has config:

1. GET /v1/config
2. Merge the IDs you want into frameworks (do not drop the ones you still need)
3. PUT the full profile + frameworks state
4. GET again and confirm

Sticky fields (eu_inference, review_language) stay unchanged when omitted. profile and frameworks do not.

Example (US SaaS)

Replace the profile with the org's real context. The sample IDs below are SOC_2, HIPAA, CCPA, and NIST_800_53.

# 1. Read current state
curl -sS https://api.heygrc.com/v1/config \
  -H "Authorization: Bearer $HEYGRC_API_KEY"

# 2. Merge IDs, then PUT the full state
curl -sS -X PUT https://api.heygrc.com/v1/config \
  -H "Authorization: Bearer $HEYGRC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "profile": {
      "company": "Acme Inc",
      "product": "B2B SaaS for invoice automation",
      "data_handled": "customer PII, payment metadata, uploaded documents",
      "hosting": "US, AWS us-east-1",
      "compliance_posture": "pursuing SOC 2 and HIPAA; ships an AI feature"
    },
    "frameworks": ["SOC_2", "HIPAA", "CCPA", "NIST_800_53"]
  }'

# 3. Read back
curl -sS https://api.heygrc.com/v1/config \
  -H "Authorization: Bearer $HEYGRC_API_KEY"

A 200 {"ok": true, …} on the PUT means the write landed. Trust the follow-up GET, not the request you think you sent.

You can also select IDs in the console: app.heygrc.com → Set company context / Choose frameworks (/onboarding). Same activation rule: CCPA reviews only after it is selected. Suggest recommended still does not add it.

.heygrc.md is repository context for reviews. It does not enable packs. Selecting CCPA still happens in the console or this API. Do not put ePHI, CUI, secrets, or customer data in that file.

Honesty

• heyGRC does not determine CCPA applicability or covered-entity / business-associate status.
• No BAA. heyGRC does not handle ePHI.
• Not FedRAMP authorized. No CUI.
• No certification claim. heyGRC and ISMS Copilot hold no SOC 2 or ISO 27001 of their own.
• Selecting CCPA makes those duties reviewable in a diff. It does not make you "CCPA compliant" or "CCPA certified."
• Reviews flag changes that appear to touch retention, deletion, or sale/share/GPC mechanics. They do not declare a sale, detect a GPC failure, or catch every violation.

Related

• Set up with your agent
• API reference
• Console and API keys
• Security and data
• heygrc.com/frameworks/ccpa
• heygrc.com/for/us-saas