Frameworks and method
The frameworks covered
The ten frameworks of the catalog, what each contains, and what "covered" means.
The app's catalog holds ten frameworks. Each is broken down into requirements; each requirement is linked to one or more common controls. The catalog has 164 common controls.
| Framework | Family | Scored requirements | Text |
|---|---|---|---|
| ISO/IEC 27001:2022 | Security | 121 | written in our own words |
| SOC 2 (Trust Services Criteria) | Security | 38 | written in our own words |
| NIS2 (Directive (EU) 2022/2555) | Security | 24 | written in our own words |
| NIST CSF 2.0 | Security | 22 | written in our own words |
| ISO/IEC 27701:2019 | Privacy | 69 | awaiting legal review |
| DORA (Regulation (EU) 2022/2554) | Resilience | 24 | written in our own words |
| ISO 22301:2019 | Resilience | 30 | awaiting legal review |
| ISO/IEC 42001:2023 | AI governance | 65 | awaiting legal review |
| Regulation (EU) 2024/1689 (AI Act) | AI governance | 34 | written in our own words |
| NIST AI RMF 1.0 | AI governance | 19 | written in our own words |
Good to know
"Scored requirements" counts leaf requirements, the ones that enter the score. Grouping headings are not scored.
What "covered" means
A requirement is "covered" when at least one control of the catalog answers it. This describes the content of the catalog, not your situation: you are only as ready as the state of your controls, your evidence and your tests. The app helps you prepare and follow; it never says an organization "is compliant" with a framework or a regulation, and it does not replace the advice of a lawyer or an auditor.
What the app offers for each
- ISO 27001 and SOC 2: the questionnaire of the assessment, the statement of applicability (ISO 27001 Annex A) and the SOC 2 categories.
- The other frameworks: they are activated from the Frameworks page and enter the score through the common controls that cover them. They do not go through the assessment questionnaire.
- Texts awaiting legal review: the content is published with that mention on the Frameworks page.
Was this page helpful?