Frameworks
ISO 42001 and ISO 27001 first. Every other framework on the same library.
Start with the two management systems that matter most for security and AI teams. Add laws, assurance reports and customer requirements on the same control library when you need them.
Hosted in the Netherlands. Your data stays in the EU.Frameworks in brief
- Lead
- ISO 42001 and ISO 27001Certifiable management systems
- EU legislation
- NIS2, DORA, GDPR, AI Act, CRABuilt on your management system
- Assurance
- SOC 2, ISAE 3402 / 3000Reports for your customers
- Sector and own
- PCI DSS, HIPAA, BIO, customOn the same controls
01 / Start here
Two management systems, one library.
02 / One library
One control.
Multiple frameworks.
You define a control once and link the evidence once. The mapping shows which frameworks it counts for, and where it does not.
See where each control counts. And where it does not.
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
03 / How they relate
Not every framework
is the same.
Standards, laws and assurance reports work differently. Knowing which is which helps you decide where to start.
- 1Certifiable standards
ISO 42001 and ISO 27001. A management system that an accredited body certifies.
- 2EU legislation
NIS2, DORA, the GDPR, the AI Act and the CRA. Obligations set by law, enforced by supervisors.
- 3Assurance reports
SOC 2 and ISAE 3402 / 3000. An independent auditor reports on your controls to your customers.
- 4Sector and customer requirements
PCI DSS, HIPAA, the BIO and your own frameworks. Requirements that come with your sector or your customers.
A management system is the base. Laws and reports build on the controls it already contains.
04 / All frameworks
See every framework.
05 / Questions
Questions about
frameworks.
What are compliance frameworks?
Compliance frameworks are sets of requirements for how an organisation manages security, risk and governance. Some are voluntary standards, such as ISO 42001 for AI management and ISO 27001 for information security. Others are law, such as NIS2, DORA, the GDPR and the EU AI Act.
How does Basenorm support multiple frameworks at once?
Through the Unified Control Library. You define a control once and link it to every standard it counts for. ISO 42001 and ISO 27001 lead; NIS2, DORA, the GDPR, the EU AI Act, SOC 2 and more run on the same library.
Do we need different controls for different frameworks?
Often not. ISO 42001 and ISO 27001 share the structure of clauses 4 to 10, and ISO 27001 and NIS2 share 70 to 80% of their controls according to Basenorm’s published mapping. Reuse is assessed per control: some requirements, such as the AI impact assessment in ISO 42001, apply to one standard only.
Which framework should we start with?
Most organisations start with ISO 27001 as the base for information security. If you develop, provide or use AI, ISO 42001 builds on that base. Legal obligations such as NIS2 or DORA can be added on the same library.
How does AskNorman help with frameworks?
AskNorman answers questions about your controls, risks and evidence per standard, for example what is still open for ISO 42001. You use it in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence and decide.
Can Basenorm help with evidence?
Yes. You link evidence to a control once, and it counts wherever that control counts. The owner of the control reviews whether the evidence is adequate.
Book a demo
Start with ISO 42001 and ISO 27001.
In a demo we look at the frameworks that apply to you and what you can reuse.
- Which frameworks apply to your organisation.
- Where to start, and in which order.
- How one control counts for several frameworks.
Hosted in the Netherlands. Your data stays in the EU.