ISMS CORE Compliance Assessments

πŸŽ‹ ISMS CORE β€” Compliance Assessment Modules

Twenty-nine built-in frameworks + custom YAML import. One platform. No separate tools required.

29 Frameworks 700+ Requirements Export Collections

--- ## Overview ISMS CORE Platform includes a unified compliance assessment layer covering 29 built-in frameworks across Europe, North America, and globally, plus custom YAML import for any sector-specific or proprietary control framework. Each module provides structured self-assessment, maturity scoring (0–4 where applicable), gap tracking, and export. Assessment results can be grouped into **Assessment Collections** β€” named bundles that aggregate status across multiple frameworks for reporting or audit purposes, with CSV, XLSX (colour-coded), and PDF (A4) export. All compliance assessment modules live under the **Compliance Assessments** sidebar group in the Platform WebUI. --- ## Quick Reference | Framework | Type | Requirements | Grouping | Scoring | Audience | |-----------|------|-------------|----------|---------|----------| | [NIST CSF 2.0](#nist-csf-20) | NIST | 106 subcategories | 6 Functions | Tier 1–4 | Any sector | | [NIST AI RMF 1.0](#nist-ai-rmf-10-ai-100-1) | NIST | 72 subcategories | 4 Functions (GOV/MAP/MSR/MNG) | 0–4 | AI system providers and operators β€” any sector | | [NIS2](#nis2-directive-eu-20222555) | EU Directive | 15 requirements | 2 Articles | 0–4 | EU essential/important entities | | [DORA](#dora-eu-20222554) | EU Regulation | 27 articles | 5 Pillars | 0–4 | EU financial sector | | [CIS Controls v8](#cis-critical-security-controls-v8) | Best Practice | 153 safeguards | 18 Controls | 0–4 | Any sector | | [BSI IT-Grundschutz](#bsi-it-grundschutz-kompendium) | German standard | 111 Bausteine | 10 Layers | 0–4 | Germany / DACH / IT-Grundschutz cert | | [CSRM (NCSC CH)](#csrm-swiss-ncsc-2025) | Swiss NCSC | 20 baseline requirements | 5 CSF Functions | Binary | Swiss critical infrastructure | | [Swiss ISG (SR 128)](#swiss-isg-sr-128) | Swiss law | 27 requirements | 8 Sections | 0–4 | Swiss federal bodies & critical infrastructure operators | | [TISAX](#tisaxvida-isa-60) | VDA/ENX | 79 requirements | 9 Domains | 0–4 | Automotive supply chain | | [Swiss nDSG](#swiss-ndsg-2023) | Swiss law | 25 provisions | 6 Chapters | 0–4 | Organisations processing Swiss personal data | | [EU Cyber Resilience Act](#eu-cyber-resilience-act-20242847) | EU Regulation | 26 requirements | 6 Groups | 0–4 | EU product manufacturers | | [EU AI Act](#eu-ai-act-20241689) | EU Regulation | 9 articles | Ch. III Sec. 2 + Art. 27 | 0–4 | EU AI system providers/deployers | | [EU Cloud Sovereignty Framework](#eu-cloud-sovereignty-framework-v121) | EC DG DIGIT | 8 Sovereignty Objectives | 1 Group (SEAL) | SEAL 0–4 | EU institutions / public sector cloud procurement | | [CyberFundamentals (BE)](#cyberfundamentals-ccb) | Belgian regulation | 41 practices | 6 CSF Functions | 0–4 | Belgian organisations / CCB certification | | [BaFin BAIT (DE)](#bafin-bait-rundschreiben-102017-amended-2021) | German BaFin | 23 requirements | 12 Modules | 0–4 | German financial sector (banks, investment firms) | | [CSSF Circulaire 20-750 (LU)](#cssf-circulaire-20-750-lu) | Luxembourg CSSF | 19 requirements | 7 Domains | 0–4 | Luxembourg financial sector | | [ACN Cyber Risk Management (IT)](#acn-cyber-risk-management-it) | Italian ACN | 43 measures / 116 requirements | 10 Legal Elements | 0–4 | Italian organisations / critical infrastructure | | [UK NIS Regulations](#uk-nis-regulations-2018) | UK law | 13 requirements | 3 Objectives | 0–4 | UK network and information systems operators | | [UK Operational Resilience (FCA/PRA)](#uk-operational-resilience-fcapra) | UK FCA/PRA | 12 requirements | 4 Objectives | 0–4 | UK financial sector β€” banks, insurers, FMIs | | [COBIT 2019 (ISACA)](#cobit-2019-isaca) | ISACA EGIT | 40 objectives | 5 Domains (EDM/APO/BAI/DSS/MEA) | 0–4 | Enterprise IT governance, audit, CISM/CISA/CGEIT holders | | [NIST SP 800-53 R5](#nist-sp-800-53-rev-5) | NIST | 324 base controls | 20 Control families | 0–4 | US federal agencies, contractors, and any organisation seeking comprehensive security controls | | [CSA CCM v4.1](#csa-cloud-controls-matrix-v41) | CSA | 207 control specifications | 17 Domains | 0–4 | Cloud service providers, cloud consumers β€” any sector | | [CSA AICM v1.1](#csa-ai-controls-matrix-v11) | CSA | 247 controls | 18 Domains | 0–4 | Organisations developing, deploying, or procuring AI systems | | [NCSC CAF v4.0 (UK)](#ncsc-caf-v40-uk) | NCSC UK | 41 Contributing Outcomes | 14 Principles / 4 Objectives | 0/2/4 | UK operators of essential services / CNI | | [ReCyF v2.5 β€” France NIS2](#recyf-v25--france-nis2-anssi) | ANSSI | 20 Security Objectives | 4 Pillars | 0–4 | French NIS2 entities (EI & EE) β€” transposition pending | | [BSI C5:2026](#bsi-c52026) | BSI (Germany) | 168 criteria | 17 Domains | 0–4 | Cloud service providers (DE/EU) seeking C5 attestation | | [BSI C3A](#bsi-c3a-criteria-enabling-cloud-computing-autonomy) | BSI (Germany) | 30 criterion groups | 6 SOV Domains | 0–4 | Cloud CSPs + customers evaluating cloud sovereignty | | [PCI DSS v4.0.1](#pci-dss-v401) | PCI SSC | 198 sub-requirements | 12 requirements / 6 milestones | Milestone | Organisations handling cardholder data | | [FINMA](#finma) | Swiss regulator | 21 requirements | 3 circulars/guidance | 0–4 | Swiss financial institutions (banks, insurers) | | [Custom (YAML)](#custom-frameworks-yaml-import) | User-defined | User-defined | User-defined | User-defined | All | --- ## Maturity Scale (used by most frameworks) | Score | Label | Meaning | |-------|-------|---------| | 0 | Non-compliant | Not implemented | | 1 | Partial | Ad hoc or incomplete | | 2 | Developing | Documented but inconsistent | | 3 | Defined | Consistent and managed | | 4 | Optimised | Measured, improving, embedded | CSRM uses a different model β€” see [CSRM section](#csrm-swiss-ncsc-2025). --- ## Assessment Collections **Assessment Collections** are named groups of assessments that aggregate compliance status across frameworks. Useful for: - Grouping assessments by year or audit cycle - Reporting on a specific regulatory perimeter (e.g. "EU regulatory stack 2025") - Comparing progress across frameworks over time Each collection shows derived statistics: completion %, compliance %, per-status counts, status rollup (a collection is "compliant" only when all member assessments are compliant). **Export formats:** CSV (flat), XLSX (colour-coded by status, one sheet per assessment), PDF (A4, per-assessment scores + non-compliant items listed). --- ## Framework Modules ### NIST CSF 2.0 **Source:** NIST Cybersecurity Framework version 2.0 (2024) **Scope:** 106 subcategories across 6 functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC) **Scoring:** Tier 1–4 per subcategory (Partial β†’ Adaptive), plus current vs target tier **Audience:** Any sector and size β€” widely used as a baseline for maturity assessment globally **Platform features:** - Named profiles (create multiple assessments / track over time) - Radar chart and bar chart report page per profile - XLSX import from the official NIST CSF 2.0 Excel template - XLSX and CSV export **Coverage notes:** - Full 106-subcategory coverage including GV (Govern) β€” the function added in CSF 2.0 that is absent from CSF 1.1 - ISO 27001 ↔ NIST CSF 2.0 crosswalk available in the Crosswalk Viewer --- ### NIST AI RMF 1.0 (AI 100-1) **Source:** NIST AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023 **Scope:** 72 subcategory-level practices across 4 core functions β€” GOVERN (GOV), MAP (MAP), MEASURE (MSR), MANAGE (MNG) β€” divided into 19 Categories **Scoring:** Maturity 0–4 per subcategory **Audience:** AI system providers, developers, deployers, and operators β€” any sector. Voluntary, jurisdiction-neutral. **Function structure:** - **GOVERN (19 subcategories)** β€” organisational AI risk culture, policies, accountability structures, workforce practices - **MAP (18 subcategories)** β€” context and risk framing: intended purposes, categorisation, benefits, costs, societal impacts - **MEASURE (22 subcategories)** β€” quantitative, qualitative, and mixed-method tools to analyse, benchmark, and monitor AI risk - **MANAGE (13 subcategories)** β€” risk treatment, residual risk, incident response, post-market surveillance **Platform features:** - 72 subcategory practices grouped by Category (GOV-1 through MNG-4), maturity 0–4 - No direct NIST AI RMF ↔ EU AI Act crosswalk axis β€” the two are connected transitively via ISO 42001 (NIST AI RMF ↔ ISO 42001: 32 mappings; ISO 42001 ↔ EU AI Act: 13 mappings) or via ISO 27001 (NIST AI RMF ↔ ISO 27001: 56 mappings; ISO 27001 ↔ EU AI Act: 30 mappings) - Assessment Collections β€” group AI RMF assessments alongside EU AI Act assessments **Coverage notes:** - Subcategory descriptions sourced from the official NIST AI RMF Playbook (72 suggested actions) - ISO 27001 ↔ AI RMF crosswalk exists (28 mappings); ISO 42001 ↔ AI RMF crosswalk exists (32 mappings) β€” both are viable mapping paths - Framework is voluntary β€” not a regulatory compliance requirement in any jurisdiction - Related: NIST CSF 2.0 GOVERN function directly mirrors AI RMF GOVERN structure --- ### NIS2 Directive (EU 2022/2555) **Source:** Directive (EU) 2022/2555 β€” Network and Information Security 2 **Scope:** 15 requirements β€” 10 Article 21(2) technical/organisational security measures + 5 Article 23 incident reporting obligations **Scoring:** Maturity 0–4 **Audience:** EU essential entities (energy, transport, banking, health, water, digital infrastructure) and important entities; national transposition varies by member state β€” verify applicability under your jurisdiction's implementing law **Coverage notes:** - Article 21(2) measures mapped (a) through (j) - Article 23 reporting timeline and content obligations - Does not cover Articles 22–24 (supply chain, registration, disclosure) β€” self-assessment of technical measures only - NIS2 crosswalk to ISO 27001 available in the Crosswalk Viewer --- ### DORA (EU 2022/2554) **Source:** Regulation (EU) 2022/2554 β€” Digital Operational Resilience Act **Scope:** binding requirements across 5 pillars: ICT Risk Management, ICT Incident Reporting, Digital Operational Resilience Testing, ICT Third-Party Risk Management, and Information Sharing. 27 articles assessed across these pillars (Chapters II–VI). **Scoring:** Maturity 0–4 **Audience:** EU financial entities (banks, investment firms, insurance, crypto-asset service providers, payment institutions) and their critical ICT third-party providers **Coverage notes:** - Covers the core operational resilience obligations of DORA - Does not replace engagement with your national competent authority (NCA) under DORA - Level-1 articles covered β€” does not include all RTS/ITS delegated acts (regulatory development of delegated acts continues β€” check the current RTS/ITS status) --- ### CIS Critical Security Controls v8 **Source:** Center for Internet Security, CIS Controls v8 (2021) **Scope:** 153 safeguards across 18 controls **Scoring:** Maturity 0–4 **Audience:** Any organisation β€” particularly strong for SMEs and those without a primary framework. Three implementation groups (IG1/IG2/IG3) support prioritisation. **Coverage notes:** - All 153 safeguards assessable regardless of implementation group - CIS Controls v8 to ISO 27001 crosswalk available in the Crosswalk Viewer --- ### BSI IT-Grundschutz Kompendium **Source:** Bundesamt fΓΌr Sicherheit in der Informationstechnik β€” IT-Grundschutz Kompendium **Scope:** the 2023 edition contains 111 official Bausteine (building blocks) across 10 Schichten (layers): ISMS, ORP (Organisation), CON (Concepts), OPS (Operations), DER (Detection), APP (Applications), SYS (Systems), IND (Industrial), NET (Networks), INF (Infrastructure). ISMS CORE covers all 111. **Scoring:** Maturity 0–4 **Audience:** German public sector (mandatory), organisations pursuing dual ISO 27001 / IT-Grundschutz certification, DACH-region organisations **Crosswalk:** - ISO 27001:2022 ↔ BSI IT-Grundschutz: 386 mappings β€” built from BSI's official Zuordnungstabelle - ISO 27701:2025 ↔ BSI IT-Grundschutz: 101 mappings - ISO 27018:2025 ↔ BSI IT-Grundschutz: 51 mappings - Total: 538 cross-standard mappings β€” visible in the Crosswalk Viewer **Coverage notes:** - Based on publicly available Kompendium structure; exact requirement text from the full BSI Kompendium (bsi.bund.de) - All 111 official Bausteine are covered, across all 10 layers --- ### CSRM (Swiss NCSC, 2025) **Source:** Methode CSRM 2025 β€” Cyber Security Risk Method, published by the Swiss National Cyber Security Centre (NCSC / BACS), 2025 **Scope:** 20 mandatory baseline requirements, 6 Control Objectives for reporting **Scoring:** Binary β€” `met` / `partial` / `not_met` / `exception` (not maturity 0–4) **Audience:** Swiss critical infrastructure operators β€” energy, transport, water, healthcare, finance, government > **Important:** CSRM is a fundamentally different model from all other modules. Read this section carefully before using it. #### How CSRM works CSRM is **object-centric**. You do not assess a list of requirements globally β€” you: 1. Define **IT Protection Objects** β€” aggregated groups of systems, applications, and data that share the same protection requirements (not individual assets) 2. Assess each protection object against 20 baseline requirements drawn from NIST CSF 2.0 functions (GV, ID, PR, DE, RS) 3. Identify **elevated protection objects** (higher criticality) and record additional Technical and Organisational Measures (TOMs) 4. Map results to 6 Control Objectives for structured reporting The 5-step CSRM methodology is: 1. Define scope and protection objects 2. Categorise protection objects (standard / elevated) 3. Apply 20 baseline requirements per object 4. Define additional TOMs for elevated objects 5. Report via 6 Control Objectives #### NIST CSF 2.0 alignment CSRM 2025 is aligned to **NIST CSF 2.0** β€” specifically, the 20 baseline requirements map to GV (Govern), ID (Identify), PR (Protect), DE (Detect), and RS (Respond). The ISMS CORE implementation uses CSF 2.0 function codes throughout. > **Note:** The NCSC's own comparison document (*Vergleich-Managementsysteme EN*, 2025) uses CSF **1.1** codes in its cross-reference table β€” because Switzerland's ICT Minimum Standard is still based on CSF 1.1. The CSRM method itself references CSF 2.0, and ISMS CORE reflects the correct version. #### BACS self-critique β€” known limitations The NCSC's own comparison document is unusually candid about CSRM's limitations. The following gaps are surfaced directly in the Platform UI as disclaimers: - **IEC 62443 alignment pending** β€” industrial control systems coverage not yet finalised - **10 ICT Minimum Standard requirements have no CSRM equivalent** β€” these are not gaps in the ISMS CORE implementation; they are gaps in CSRM itself (acknowledged in the comparison document, p. 12–13) - **"No policies" label is misleading** β€” CSRM does not mandate policies as a document type, but expects governance and organisational measures within its Control Objectives - **Parallel ISMS implementation = duplication risk** β€” organisations running both an ISO 27001 ISMS and CSRM should map shared controls to avoid maintaining two parallel control sets **Source documents (official BACS/NCSC):** - CSRM 2025 method: https://www.ncsc.admin.ch/dam/ncsc/en/dokumente/infras/Methode-CSRM-2025-EN.pdf - Management system comparison: https://www.ncsc.admin.ch/dam/ncsc/en/dokumente/infras/Vergleich-Managementsysteme_EN.pdf --- ### TISAX / VDA ISA 6.0 **Source:** Trusted Information Security Assessment Exchange β€” VDA Information Security Assessment (ISA) version 6.0 **Scope:** 79 requirements across 9 domains: IS Policies and Organization, Human Resources, Physical Security, Identity and Access Management, IT / Cyber Security, Supplier Relationships, Compliance, Prototype Protection, and Data Protection **Scoring:** Maturity 0–4 **Audience:** Automotive industry suppliers, OEM partners, and subcontractors handling sensitive data (especially prototype and vehicle data) β€” participation in TISAX certification is a supply chain requirement for most major OEMs (BMW, VW Group, Mercedes, Stellantis, etc.) **Coverage notes:** - Based on VDA ISA 6.0 domain structure and assessment criteria - Full TISAX assessment and label issuance requires engagement with an ENX-accredited auditor - This module is a self-assessment tool for readiness preparation, not a substitute for official TISAX assessment - Assessment labels (TISAX, AL1/AL2/AL3) are only issued through ENX-accredited assessment service providers --- ### Swiss ISG (SR 128) **Source:** Bundesgesetz ΓΌber die Informationssicherheit beim Bund (ISG) / Federal Act on Information Security (LSI), Switzerland β€” SR 128, in force 1 January 2024; cyberattack reporting obligation (Art. 74a–74h) in force 1 April 2025 **Scope:** 27 assessable requirements across 8 sections: Information Security Principles (Art. 6–10a), Information Classification (Art. 11–15), ICT Security (Art. 16–19), Personnel & Access (Art. 20–21), Physical Security (Art. 22–23), Personnel Security Checks (Art. 27–30, 43), Cyberattack Reporting Obligation (Art. 74a–74h), ISMS Organisation (Art. 81, 85) **Scoring:** Maturity 0–4 **Audience:** Swiss federal bodies (mandatory); critical infrastructure operators subject to the cyberattack reporting obligation under Art. 74b (energy, water, finance, transport, health, ICT); private organisations voluntarily aligning with Swiss federal security standards **Key obligations:** - **24-hour cyberattack reporting** β€” mandatory report to BACS/OFCS within 24 hours of detecting a cyberattack that jeopardises operations, involves data manipulation/exfiltration, was undetected for a prolonged period, or involves extortion (Art. 74d–74e) - **Information classification** β€” three-level scheme: internal / confidential / secret, with need-to-know access controls (Art. 11–14) - **ICT security categories** β€” baseline / elevated / very high, each with corresponding minimum security measures (Art. 17–18) - **Personnel security checks (PSC)** β€” base and extended clearance for sensitive functions; periodic repetition (Art. 27–43) - **ISB/RSSI appointment** β€” formal information security officer with advisory, directive, and compliance monitoring responsibility (Art. 81) - **Administrative sanction** β€” failure to report a cyberattack: up to CHF 100,000 (Art. 74h) **ISO 27001 crosswalk:** 27 mappings β€” ISO 27001:2022 controls map directly to ISG requirements; ISO 27001 is the recognised implementation vehicle for ISG compliance in practice. **Coverage notes:** - This module is relevant primarily to Swiss federal bodies and operators of critical infrastructure listed in Art. 74b - Private-sector organisations not subject to Art. 74b are not legally required to comply but may voluntarily adopt the framework as a Swiss security baseline - The cyberattack reporting obligation (Art. 74a–74h) is the most immediate compliance action for critical infrastructure operators β€” it entered into force 1 April 2025 > **Note:** This module is a self-assessment tool. Official compliance determination requires review by a qualified Swiss information security practitioner. --- ### Swiss nDSG 2023 **Source:** Bundesgesetz ΓΌber den Datenschutz (nDSG) / Federal Act on Data Protection, Switzerland β€” entered into force 1 September 2023 **Scope:** 25 key provisions across 6 chapters: Scope & Principles, Data Subject Rights, Controller Obligations, Special Cases, Data Transfers, Enforcement **Scoring:** Maturity 0–4 **Audience:** Any organisation that processes personal data of Swiss residents or is established in Switzerland **Coverage notes:** - The nDSG is Switzerland's counterpart to the EU GDPR (broadly similar scope, different legal basis) - This module covers the core compliance obligations β€” legal interpretation should involve Swiss data protection counsel - Swiss organisations subject to both nDSG and GDPR (e.g. processing EU resident data) should use both this module and the GDPR crosswalk --- ### EU Cyber Resilience Act (2024/2847) **Source:** Regulation (EU) 2024/2847 β€” Cyber Resilience Act **Scope:** 26 essential requirements across 6 groups: Essential Cybersecurity Requirements, Vulnerability Handling, Conformity Assessment, Market Surveillance, Coordinated Disclosure, Incident Reporting **Scoring:** Maturity 0–4 **Audience:** Manufacturers and importers of products with digital elements (hardware and software) sold in the EU market **Coverage notes:** - The CRA is phased: it entered into force on 10 December 2024; the rules for notified (conformity assessment) bodies apply from 11 June 2026; the manufacturer reporting duty for actively exploited vulnerabilities and severe incidents (Art. 14) applies from 11 September 2026; the remaining obligations, including the essential requirements, apply from 11 December 2027 *(dates to be re-checked against Regulation (EU) 2024/2847 Art. 71 before publication)* - Essential requirements in Annex I (Part I and Part II) are the primary compliance target β€” this module covers both - Conformity assessment route depends on product criticality class (Class I, II, or critical product) β€” self-declaration vs. third-party assessment - This module provides a readiness self-assessment; formal conformity assessment involves a notified body for Class II and critical products --- ### EU AI Act (2024/1689) **Source:** Regulation (EU) 2024/1689 β€” Artificial Intelligence Act **Scope:** 9 articles from Chapter III (High-Risk AI Systems): the 8 core requirement articles in Section 2 (Art. 8 Compliance, Art. 9 Risk Management, Art. 10 Data Governance, Art. 11 Technical Documentation, Art. 12 Record-Keeping, Art. 13 Transparency, Art. 14 Human Oversight, Art. 15 Accuracy/Robustness/Cybersecurity) plus Art. 27 Fundamental Rights Impact Assessment from Section 3 **Scoring:** Maturity 0–4 **Audience:** Providers and deployers of AI systems in the EU β€” obligations vary by risk classification (unacceptable risk/prohibited, high-risk, limited-risk, minimal-risk) **Coverage notes:** - This module covers Chapter 3 obligations for **high-risk AI systems** β€” the most substantive compliance tier - Prohibited AI practices (Article 5) are not an assessment target; they require absolute avoidance - General-purpose AI model obligations (Title VIII) are not covered in this module version - The AI Act is phased: prohibited practices apply from February 2025; the AI Omnibus (in force July 2026) moved the high-risk obligations to 2 December 2027 for stand-alone systems (Annex III) and 2 August 2028 for AI embedded in regulated products *(to be re-checked against the Official Journal text before publication)* - Formal conformity assessment for high-risk AI systems involves notified bodies or self-assessment with standardised testing --- ### EU Cloud Sovereignty Framework (v1.2.1) **Source:** European Commission β€” DG DIGIT, EU Cloud Sovereignty Framework v1.2.1 (October 2025) **Scope:** 8 Sovereignty Objectives (SOV-1 to SOV-8) assessed via SEAL-0 to SEAL-4 scale. Weighted Sovereignty Score (weights sum to 100%): SOV-1 Strategic 15% Β· SOV-2 Legal & Jurisdictional 10% Β· SOV-3 Data & AI 10% Β· SOV-4 Operational 15% Β· SOV-5 Supply Chain 20% Β· SOV-6 Technology 15% Β· SOV-7 Security & Compliance 10% Β· SOV-8 Environmental 5% **Scoring:** SEAL-0 (No Sovereignty) β†’ SEAL-1 (Jurisdictional) β†’ SEAL-2 (Data) β†’ SEAL-3 (Digital Resilience) β†’ SEAL-4 (Full Digital Sovereignty) **Audience:** EU institutions, public sector bodies, and regulated entities evaluating cloud service providers under EU procurement and digital sovereignty requirements. Draws on Gaia-X, ENISA/NIS2/DORA, CIGREF Trusted Cloud Referential v2, France Cloud de Confiance, and Germany SouverΓ€ner Cloud strategies. **Coverage notes:** - The framework defines **minimum assurance levels** per procurement tier β€” this module supports self-assessment and gap analysis against those levels - SEAL ratings are qualitative judgements; formal procurement decisions require vendor audit evidence and contractual commitments - SOV-5 Supply Chain assessment requires visibility into sub-supplier chains β€” depth of evidence may vary by vendor transparency - Environmental Sustainability (SOV-8) scoring is indicative; formal green procurement may require certified energy/carbon data --- ### CyberFundamentals (CCB) **Source:** Centre for Cybersecurity Belgium (CCB) β€” CyberFundamentals Framework v2025 **Scope:** 41 practices aligned to NIST CSF 2.0 functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), Recover (RC) **Scoring:** Maturity 0–4 **Audience:** Belgian organisations seeking CCB CyberFundamentals certification; NIS2-in-scope entities in Belgium; any organisation using NIST CSF 2.0 with Belgian regulatory context **Coverage notes:** - CyberFundamentals uses NIST CSF 2.0 control IDs (GV.OC-01, ID.AM-01, etc.) β€” the ISMS CORE crosswalk leverages existing ISOβ†’NIST CSF mappings - Four assurance levels: Small, Basic, Important, Essential (aligned to Belgian NIS2 transposition, Law of 26 April 2024) - Crosswalk: ISO 27001:2022 ↔ CyberFundamentals β€” 107 mappings --- ### BaFin BAIT (Rundschreiben 10/2017, amended 2021) **Source:** Bundesanstalt fΓΌr Finanzdienstleistungsaufsicht β€” Bankaufsichtliche Anforderungen an die IT (BAIT), Rundschreiben 10/2017, amended 16 August 2021 **Scope:** 23 requirements across 12 modules: IT Strategy, IT Governance, Information Risk Management, Information Security, IT Projects, Application Development, IT Operations, IT Outsourcing, IT Emergency Management, IAM, Cryptography, BCM **Scoring:** Maturity 0–4 **Audience:** German banks and financial institutions supervised by BaFin; applies in conjunction with MaRisk and DORA for EU-regulated entities **Coverage notes:** - BAIT is the primary IT supervisory circular for German-supervised banks; VAIT (insurance) and KAIT (capital management) share the same structure - Amended 16 August 2021 (not a replacement circular); includes MaRisk alignment and cloud-specific guidance - Crosswalk: ISO 27001:2022 ↔ BaFin BAIT β€” 69 mappings --- ### CSSF Circulaire 20-750 (LU) **Source:** Commission de Surveillance du Secteur Financier (CSSF), Luxembourg β€” Circulaire CSSF 20/750 **Scope:** 19 requirements across 7 ICT risk domains: Governance, Risk Management, ICT Security, Business Continuity, Third-Party Management, Incident Management, Audit **Scoring:** Maturity 0–4 **Audience:** Luxembourg financial sector entities regulated by CSSF β€” banks, investment firms, payment institutions, fund administrators **Coverage notes:** - CSSF 20/750 is the primary ICT risk management circular for CSSF-regulated entities, aligned to EBA/ESMA guidelines - Entities subject to DORA (from January 2025) should use both this module and the DORA module - Crosswalk: ISO 27001:2022 ↔ CSSF 20/750 β€” 47 mappings --- ### ACN Cyber Risk Management (IT) **Source:** Agenzia per la Cybersicurezza Nazionale (ACN) β€” *Determinazione obblighi di base* (April 2025), implementing Article 24(2) of D.Lgs. 138/2024 **Scope:** Two tiers β€” 37 measures/87 requirements for Important entities (Annex 1), 43 measures/116 requirements for Essential entities (Annex 2) β€” organised around the 10 legal elements of Article 24(2): risk analysis and system security policies, incident management, business continuity, supply chain security, secure acquisition/development/maintenance, risk-measure effectiveness review, basic cyber hygiene and training, cryptography policies, HR security/access control/asset management, and multi-factor authentication/secure communications **Scoring:** Maturity 0–4 **Audience:** Italian organisations β€” public administration, critical infrastructure operators, NIS2-in-scope entities in Italy **Coverage notes:** - ACN is the Italian National Cybersecurity Agency and competent NIS2 authority; these basic security measures align with NIS2 Italian transposition (D.Lgs. 138/2024) - Organisations subject to both ACN obligations and NIS2 can use both modules - Crosswalk: ISO 27001:2022 ↔ ACN Guidelines β€” 43 mappings --- ### UK NIS Regulations 2018 **Source:** The Network and Information Systems (NIS) Regulations 2018 (SI 2018/506) β€” UK implementation of EU NIS Directive **Scope:** 13 requirements across 3 objectives: Governance, Risk Management & Security, Operational Capability **Scoring:** Maturity 0–4 **Audience:** UK operators of essential services (OES) in energy, transport, health, water, digital infrastructure; relevant digital service providers (RDSPs) **Coverage notes:** - UK NIS Regulations remain in force post-Brexit as domestic law; the Cyber Security and Resilience Bill (2025, pending Royal Assent) will update and expand scope - NCSC's Cyber Assessment Framework (CAF) is the recommended tool for OES compliance β€” this module covers the core NIS obligations - Crosswalk: ISO 27001:2022 ↔ UK NIS Regulations β€” 51 mappings --- ### UK Operational Resilience (FCA/PRA) **Source:** FCA Policy Statement PS21/3 + PS26/2; PRA Supervisory Statement SS1/21; Bank of England operational resilience policy **Scope:** 12 requirements across 4 objectives: Important Business Services, Impact Tolerances, Scenario Testing, Self-Assessment **Scoring:** Maturity 0–4 **Audience:** UK financial sector β€” banks, building societies, PRA-designated investment firms, insurers, financial market infrastructures (FMIs), payment systems operators **Coverage notes:** - UK Op. Resilience requirements came into full effect March 2025 (PS21/3 deadline); PS26/2 extended scope to more entities - Entities subject to both UK Op. Resilience and DORA should use both modules - Focus is on important business services (IBS) and impact tolerances β€” not a substitute for formal FCA/PRA supervisory engagement - Crosswalk: ISO 27001:2022 ↔ UK Operational Resilience β€” 34 mappings --- ### COBIT 2019 (ISACA) **Source:** ISACA β€” COBIT 2019 Framework: Governance and Management Objectives (November 2018) **Scope:** 40 governance and management objectives across 5 domains: EDM (Evaluate, Direct and Monitor), APO (Align, Plan and Organise), BAI (Build, Acquire and Implement), DSS (Deliver, Service and Support), MEA (Monitor, Evaluate and Assess) **Scoring:** Capability levels 0–4 (Incomplete β†’ Performed β†’ Managed β†’ Established β†’ Optimizing) **Audience:** Enterprise IT governance programmes, internal audit functions, IT strategy and board-level oversight. Particularly relevant for CISM, CISA, and CGEIT certification holders. **Coverage notes:** - EDM objectives (EDM01–EDM05) are governance-level β€” intended for board/executive oversight; APO, BAI, DSS, MEA are management-level - APO13 (Managed Security) and DSS05 (Managed Security Services) map directly to ISO 27001:2022 Annex A information security controls - COBIT 2019 aligns to ISO/IEC 27001, ISO/IEC 38500, ITIL, NIST CSF, and PMBOK/PRINCE2 - Full COBIT capability scale runs 0–5 (level 5: Optimizing with quantitative management); the platform uses a 0–4 scale consistent with all other assessment modules - Replaces COBIT 5 (2012); key changes include design factors, focus areas, and alignment with NIST CSF 2.0 concepts --- ### NIST SP 800-53 Rev. 5 **Source:** NIST Special Publication 800-53 Revision 5 β€” Security and Privacy Controls for Information Systems and Organizations (September 2020) **Scope:** 324 base controls across 20 control families covering the full security and privacy control catalogue for federal information systems. Families include Access Control (AC), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), System and Communications Protection (SC), and more. **Scoring:** Maturity levels 0–4 (Not Implemented β†’ Initial β†’ Managed β†’ Defined β†’ Optimizing) **Audience:** US federal agencies and contractors required under FISMA; organisations seeking FedRAMP authorization; any sector wanting a comprehensive, baseline-driven control framework. Cross-referenced against ISO 27001:2022 Annex A. **Coverage notes:** - Control families map directly to ISO 27001:2022 Annex A domains β€” the 324 base controls of the catalogue are assessed individually, grouped into the 20 families (control enhancements are not scored separately) - NIST SP 800-53 Rev. 5 integrates privacy controls (previously separate in 800-53A) for the first time - ISO 27001:2022 ↔ NIST SP 800-53 Rev. 5 crosswalk available in the Crosswalk Viewer - Baseline tailoring (Low/Moderate/High) is not automated β€” the platform scores all 324 base controls uniformly --- ### CSA Cloud Controls Matrix v4.1 **Source:** Cloud Security Alliance β€” Cloud Controls Matrix v4.1 (March 2023) **Scope:** 207 control specifications across 17 security domains: Application & Interface Security (AIS), Audit Assurance & Compliance (AAC), Business Continuity Management & Operational Resilience (BCR), Change Control & Configuration Management (CCC), Cryptography, Encryption & Key Management (CEK), Data Center Security (DCS), Data Security & Privacy Lifecycle Management (DSP), Governance, Risk & Compliance (GRC), Human Resources (HRS), Identity & Access Management (IAM), Infrastructure & Virtualization Security (IVS), Interoperability & Portability (IPY), Logging & Monitoring (LOG), Security Incident Management, E-Discovery, & Cloud Forensics (SEF), Supply Chain Management, Transparency & Accountability (STA), Threat & Vulnerability Management (TVM), Universal Endpoint Management (UEM). **Scoring:** Maturity levels 0–4 **Audience:** Cloud service providers seeking CSA STAR certification; cloud consumers performing vendor due diligence; organisations with multi-cloud or hybrid environments. **Coverage notes:** - CCM v4.1 is the definitive cloud security control framework β€” aligned to ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, NIST SP 800-53, CIS Controls v8, and GDPR - CSA STAR (Security, Trust, Assurance, and Risk) Level 1 uses CCM self-assessment; Level 2 uses third-party audit - ISO 27018:2025 (Cloud product) and CCM v4.1 are complementary β€” CCM is broader; ISO 27018 focuses specifically on PII protection --- ### CSA AI Controls Matrix v1.1 **Source:** Cloud Security Alliance β€” AI Controls Matrix (AICM) v1.1 **Scope:** 247 controls across 18 domains including: AI Governance & Accountability (AGA), Data Management & Privacy (DMP), Model Development & Validation (MDV), Security & Resilience (SAR), Transparency & Explainability (TEX), Human Oversight & Control (HOC), Regulatory Compliance & Legal (RCL), and 11 additional domains covering AI risk management, ethics, operations, supply chain, incident response, and more. **Scoring:** Maturity levels 0–4 **Audience:** Organisations developing, deploying, or procuring AI systems; AI governance teams; cloud providers offering AI/ML services; teams managing EU AI Act or ISO 42001 compliance. **Coverage notes:** - AICM is designed as a companion to CCM v4.1 β€” focuses exclusively on AI system security and governance - Aligned to EU AI Act, ISO/IEC 42001:2023, NIST AI RMF 1.0, and OECD AI Principles - ISO 42001 (AI product) and AICM are complementary β€” ISO 42001 is a management system standard; AICM provides detailed technical controls - Particularly useful alongside the platform's ISO 42001 crosswalk mappings (NIST AI RMF: 32, EU AI Act: 13, OECD AI: 14) --- ### NCSC CAF v4.0 (UK) **Source:** UK National Cyber Security Centre β€” Cyber Assessment Framework v4.0 (2024) **Scope:** 41 Contributing Outcomes across 14 Principles and 4 Objectives (A: Managing Security Risk, B: Protecting Against Cyber Attack, C: Detecting Cyber Security Events, D: Minimising the Impact of Incidents). **Scoring:** 3-column model for most outcomes: Not Achieved (0) / Partially Achieved (2) / Achieved (4). Nine outcomes use 2-column model (Not Achieved / Achieved only). **Audience:** UK Operators of Essential Services (energy, transport, health, water, digital infrastructure), Relevant Digital Service Providers, public sector bodies subject to the UK NIS Regulations 2018. **Coverage notes:** - CAF v4.0 (2024) introduced Objective D (Minimising the Impact) and restructured several outcomes from v3.1 β€” platform implements v4.0 only - 41 ISO 27001:2022 crosswalk mappings available in the Crosswalk Viewer (ISO27001_2022 β†’ NCSC_CAF axis) - Organisations subject to both NIS Regulations and CAF should maintain both modules β€” NIS provides the legal baseline, CAF provides the technical assessment methodology --- ### ReCyF v2.5 β€” France NIS2 (ANSSI) **Source:** ANSSI β€” Agence nationale de la sΓ©curitΓ© des systΓ¨mes d'information. RΓ©fΓ©rentiel de CybersΓ©curitΓ© France v2.5 (17/03/2026). **Scope:** 20 Security Objectives (OS-01 to OS-20) structured across 4 pillars: Gouvernance, Protection, DΓ©fense, RΓ©silience. 152 requirements (Moyens acceptables de conformitΓ©). OS-01–15 apply to both EntitΓ©s Importantes (EI) and EntitΓ©s Essentielles (EE). OS-16–20 apply to EE only. **Scoring:** Maturity levels 0–4 **Audience:** French organisations subject to the NIS2 transposition: EntitΓ©s Importantes (EI) and EntitΓ©s Essentielles (EE) as classified by ANSSI under France's pending NIS2 transposition law (PJL Art. 14 β€” not yet enacted as of this writing). Covers all NIS2 sectors: Γ©nergie, transport, santΓ©, eau, infrastructures numΓ©riques, services numΓ©riques, administrations publiques. **Coverage notes:** - Document de travail ANSSI version 2.5 (17/03/2026) β€” subject to revision before final adoption - 20 ISO 27001:2022 crosswalk mappings available in the Crosswalk Viewer (ISO27001_2022 β†’ FR_NIS2_RECYF axis) - EE-only objectives (OS-16 to OS-20) are included in the assessment and clearly labelled; EI-only organisations may use them as an aspirational target - Assessment interface uses official ANSSI French terminology throughout --- ### BSI C5:2026 **Source:** Bundesamt fΓΌr Sicherheit in der Informationstechnik β€” Cloud Computing Compliance Criteria Catalogue (C5:2026), v1.0.1, published 7 April 2026. Replaces C5:2020. **Scope:** 168 criteria across 17 domains: Organisation of Information Security (OIS), Security Policies and Procedures (SP), Personnel (HR), Asset Management (AM), Physical Security (PS), Operations (OPS), Identity and Access Management (IAM), Cryptography and Key Management (CRY), Communication Security (COS), Portability and Interoperability (PI), Procurement/Development/Modification (DEV), Control of Service Providers and Suppliers (SSO), Security Incident Management (SIM), Business Continuity Management (BCM), Compliance (COM), Dealing with Investigation Requests from Government Agencies (INQ), Product Safety and Security (PSS). **Scoring:** Maturity levels 0–4 **Audience:** Cloud service providers (CSPs) seeking BSI C5 attestation (Type 1 or Type 2); cloud customers in Germany and the EU performing vendor due diligence; public sector procurement; organisations subject to NIS2 or KRITIS with cloud dependencies. **Structure notes:** - Each criterion has subcriteria typed as: **Basic** (mandatory threshold), **Additional-Sharpening** (raises the bar on existing requirements), and **Additional-Complementing** (expands scope). The platform assesses at the 168 top-level criterion level β€” subcriteria inform the narrative but are not individually scored. - OIS-01 requires an ISO/IEC 27001-compliant ISMS β€” C5:2026 is therefore a cloud-specific extension layer on top of ISO 27001, not a standalone alternative. - Domain PI (Portability and Interoperability) is new in C5:2026 β€” not present in C5:2020. **Coverage notes:** - Based on the official BSI machine-readable XLSX (`C5_2026_editable_en.xlsx`, published with the standard) - Full English-language criterion text included; German original available at bsi.bund.de - Formal C5 attestation requires engagement with a C5-qualified auditor; this module supports internal readiness assessment --- ### BSI C3A β€” Criteria enabling Cloud Computing Autonomy **Source:** Bundesamt fΓΌr Sicherheit in der Informationstechnik β€” Criteria enabling Cloud Computing Autonomy (C3A), v1.0, published 27 April 2026. **Scope:** 30 criterion groups across 6 Sovereignty (SOV) domains: SOV-1 Strategic Sovereignty, SOV-2 Legal & Jurisdictional Sovereignty, SOV-3 Data Sovereignty, SOV-4 Operational Sovereignty, SOV-5 Supply Chain Sovereignty, SOV-6 Technology Sovereignty. **Scoring:** Maturity levels 0–4 **Audience:** Cloud service providers demonstrating sovereignty capabilities; cloud service customers (government, KRITIS operators, regulated entities) evaluating vendor autonomy; EU public sector procurement under digital sovereignty requirements. **Prerequisite:** C3A presupposes that the cloud service provider meets BSI C5:2026 criteria β€” C5 covers the security foundation (SOV-7 Security & Compliance) that C3A builds upon. Both modules are available in the platform and can be assessed together. **Domain structure:** - **SOV-1 Strategic Sovereignty (4 groups):** Jurisdiction, Registered Office, CSP Effective Control, CSP Control Change notification (90-day advance notice) - **SOV-2 Legal & Jurisdictional Sovereignty (3 groups):** Extraterritorial Exposure (annual non-EU law review), Audit Rights (national/German authority access), State of Defense Takeover - **SOV-3 Data Sovereignty (5 groups):** Data Residence (EU/DE options), External Key Management (BYOK for IaaS/PaaS/SaaS), External Identity Provider, Logging & Monitoring (real-time API access), Client-Side Encryption - **SOV-4 Operational Sovereignty (10 groups):** Operating Personnel (EU/DE residency), Remote Work (EU/DE access paths), Redundant Connectivity, SOC (EU/DE operated), Ingress Data Control, Update Threat Analysis, Data Exchange Monitoring, Data Exchange Gateways, Disconnect (annual tested), Reconnect (90-day recovery) - **SOV-5 Supply Chain Sovereignty (5 groups):** Software Dependencies (SBOM per BSI TR-03183-2), Hardware Dependencies, External Service Dependencies, Export Restriction management, Capacity Management (EU/DE) - **SOV-6 Technology Sovereignty (3 groups):** Source Code Availability (EU backup, max 24h old, 5 versions minimum), Continuous Service Delivery (contingency strategies), Software Development (independent toolchain access) **Coverage notes:** - SOV-7 (Security & Compliance) and SOV-8 (Environmental Sustainability) from the EU Cloud Sovereignty Framework are intentionally not covered β€” SOV-7 is addressed by C5:2026, SOV-8 is outside BSI's scope - Criterion variants (C1/C2 = EU vs. German tiers; AC = Additional criteria) are documented in criterion group descriptions; the platform scores at the criterion group level - Based on the official PDF (C3A_Cloud_Computing_Autonomy.pdf, BSI, April 2026) --- ### PCI DSS v4.0.1 **Source:** PCI Security Standards Council β€” Payment Card Industry Data Security Standard, v4.0.1, published June 2024. **Scope:** 12 top-level requirements; the module assesses 198 sub-requirements (the "x.y.z" level), organised across 6 prioritised implementation milestones: (1) Remove sensitive authentication data and limit data retention, (2) Protect systems and networks and be prepared to respond to a breach, (3) Secure payment card applications, (4) Monitor and control access to your systems, (5) Protect stored cardholder data, (6) Finalise remaining compliance efforts and ensure all controls are in place. **Scoring:** Milestone-based progress tracking; sub-requirements assessed individually and grouped by milestone in the platform UI. **Audience:** Any organisation that stores, processes, or transmits cardholder data β€” merchants, service providers, payment processors. **Coverage notes:** - v4.0.1 (June 2024) is a minor correction release of v4.0; ISMS CORE implements v4.0.1 throughout - PCI DSS formal assessment (SAQ or QSA Report on Compliance) requires a Qualified Security Assessor or an approved SAQ form β€” this module is a readiness self-assessment tool, not a substitute for formal certification - ISO 27001 ↔ PCI DSS 4.0 crosswalk: 39 mappings, substantial overlap in access control, cryptography, logging, and vulnerability management domains --- ### FINMA **Source:** FINMA β€” Swiss Financial Market Supervisory Authority. Covers Circular 2023/1 "Operational Risks and Resilience β€” Banks" (in force 1 January 2024, resilience provisions fully binding since 1 January 2026), Circular 2018/3 "Outsourcing β€” Banks and Insurance Companies" (amended 2020, still current), and Guidance 03/2024 "Cyber Risks." **Scope:** 21 requirements across 3 sources: Circular 2023/1 (7 requirements β€” Operational Risk Management, ICT Risk Management, Cyber Risk Management, Critical Data Risk Management, Business Continuity Management, Cross-Border Service Risks, Operational Resilience), Circular 2018/3 (9 requirements β€” outsourcing inventory, selection/monitoring, intra-group outsourcing, retained responsibility, security, audit rights, cross-border outsourcing, contractual requirements), Guidance 03/2024 (5 requirements β€” governance, protective measures, detection/response/recovery, 24-hour FINMA reporting, cyber exercises). **Scoring:** Maturity levels 0–4 **Audience:** Swiss banks, insurers, and other FINMA-regulated financial institutions. **Structure notes:** - Every requirement traces to the circular's official margin number (Rz) β€” the paragraph reference Swiss supervisors cite directly during review - Requirements are grouped by source circular in the assessment view, not flattened into a single list - New circulars covering conduct obligations (2025/2), liquidity (2025/3), consolidated supervision (2025/4), and climate-related financial risk (2026/1) are out of scope for ICT/security assessment and are not included **Coverage notes:** - FINMA explicitly calibrated Circular 2023/1 for institutions with EU group subsidiaries running DORA in parallel β€” operational resilience, ICT risk framework, incident management, third-party risk, and cyber exercises (TLPT) overlap substantially - ISO 27001 crosswalk: 73 mappings. ISO 27018 and ISO 27701 crosswalk mappings also available for cloud PII and privacy-relevant FINMA obligations (outsourcing, data location, critical data risk) - This module is a compliance readiness self-assessment β€” it does not replace FINMA's own supervisory review or a licensed audit --- ### Custom Frameworks (YAML Import) Upload any custom, sector-specific, or proprietary control framework via YAML. Once imported, the platform maps each control against ISO 27001:2022 via `iso_mappings` fields and shows inferred coverage in the Coverage page. **YAML format:** ```yaml name: "My Framework" short_code: "MY_FW" version: "1.0" description: "Optional" controls: - id: "MY.1.1" title: "Control title" category: "Access Control" iso_mappings: ["A.5.15", "A.8.2"] tags: ["identity"] ``` **Key fields per control:** `id` (required), `title` (required), `category`, `subcategory`, `priority` (HIGH/MEDIUM/LOW), `iso_mappings` (list of ISO 27001:2022 Annex A refs), `tags`. **Coverage display:** After import, the Coverage page Mapping Matrix tab shows a custom framework coverage section with percentage, progress bar, and per-control breakdown. **Admin only:** Import and deletion require admin or super_admin role. --- ## Crosswalk Integration All compliance assessment modules benefit from the Platform's Crosswalk Viewer, which shows cross-framework mappings between: - ISO 27001:2022 ↔ NIST CSF 2.0 - NIST AI RMF 1.0 ↔ ISO 27001:2022 (28 mappings) and ↔ ISO 42001:2023 (32 mappings) β€” no direct NIST AI RMF ↔ EU AI Act axis; connected transitively via ISO 42001 (13 mappings to EU AI Act) - ISO 27001:2022 ↔ NIST SP 800-53 Rev. 5 - ISO 27001:2022 ↔ MITRE ATT&CK v20 (45 mappings) and v19 (36 mappings, kept alongside) - ISO 27001:2022 ↔ DORA - ISO 27001:2022 ↔ NIS2 - ISO 27001:2022 ↔ CIS Controls v8 - ISO 27001:2022 ↔ BSI IT-Grundschutz (386 mappings) - ISO 27701:2025 ↔ BSI IT-Grundschutz (101 mappings) - ISO 27018:2025 ↔ BSI IT-Grundschutz (51 mappings) - ISO 27001:2022 ↔ CyberFundamentals BE (107 mappings) - ISO 27001:2022 ↔ BaFin BAIT DE (69 mappings) - ISO 27001:2022 ↔ CSSF 20-750 LU (47 mappings) - ISO 27001:2022 ↔ ACN Guidelines IT (43 mappings) - ISO 27001:2022 ↔ UK NIS Regulations (51 mappings) - ISO 27001:2022 ↔ UK Operational Resilience (34 mappings) - ISO 27001:2022 ↔ NCSC CAF v4.0 (41 mappings) - ISO 27001:2022 ↔ ReCyF v2.5 / FR NIS2 (20 mappings) - ISO 27017:2026 ↔ CSA CCM v4.1 (11), NIST CSF 2.0 (9), FINMA (7), ISO 27001:2022 (4), DORA (4), NIS2 (2) β€” curated mappings for the 4 CLD-prefixed standalone controls (5.38, 5.39, 8.35, 8.36); no Swiss nDSG axis, as those controls have no PII content Total: **4,632 crosswalk objects across 60 axes** in the core crosswalk, plus the ISO 42001 / ISO 42005 and EU-country crosswalk files, available in the Crosswalk Viewer. --- ## Limitations and Disclaimers **All compliance assessment modules:** - Are self-assessment tools for internal readiness evaluation - Do not constitute legal advice or regulatory opinions - Do not replace engagement with competent authorities, notified bodies, or accredited auditors where mandatory assessment applies - Cover requirements as of the publication date of the relevant regulation/standard β€” regulatory updates (delegated acts, RTS, ITS, implementing decisions) may introduce new obligations not yet reflected here **Specific:** CSRM baseline requirements and BACS limitation notes are based on the publicly available NCSC documents from 2025. TISAX labels require ENX-accredited assessment. CIS Controls safeguard text is based on CIS v8 (2021). BSI IT-Grundschutz full requirement text is available from bsi.bund.de. --- *Part of [ISMS CORE Project](README.md) β€” ISO 27001 Β· ISO 27701 Β· ISO 27017 Β· ISO 27018 Β· ISO 42001* Β· [Compliance details at isms-core.com/compliance.html](https://isms-core.com/frameworks)