Unified Control Library
One control. Multiple standards.
Define a control once, link the evidence once, and see which standards it counts for. Start with ISO 42001 and ISO 27001 and add frameworks when you need them.
Hosted in the Netherlands. Your data stays in the EU.The library in brief
- Principle
- Frameworks reference controlsControls never reference frameworks
- Evidence
- Linked onceReused wherever the control counts
- Ownership
- Per controlOne owner, visible for every standard
- Frameworks
- ISO 42001, ISO 27001 and moreNIS2, DORA, GDPR, EU AI Act, SOC 2
01 / The principle
The control comes first.
| Topic | One set per framework | Unified Control Library |
|---|---|---|
| Controls | The same control is set up per framework | One control, linked to every standard it counts for |
| Evidence | Uploaded again for each framework | Linked once and reused where the control counts |
| Ownership | Spread over documents and spreadsheets | One owner per control |
| A new framework | Starts from scratch | Starts from the controls you already have |
Whether a control and its evidence are adequate for a standard is assessed per organisation.
02 / Example mapping
See where it counts.
And where it does not.
The mapping shows per control which standards it counts for. It also shows where it does not count, such as the AI impact assessment that only ISO 42001 asks for.
See where each control counts. And where it does not.
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
03 / Lifecycle
A control
stays current.
Controls change: a new risk, a new supplier, a new standard. The lifecycle keeps the control and its evidence current for every standard it counts for.
- 1Define
Describe the control and assign an owner.
- 2Implement
Carry out the control and record how it works.
- 3Evidence
Link the evidence once.
- 4Review
Check on schedule whether control and evidence are still adequate.
- 5Improve
Adjust after findings, incidents or a new standard.
05 / Questions
Questions about
the library.
What is the Unified Control Library?
The library in Basenorm where you define each control once. A control is linked to every standard it counts for, and its evidence is linked once.
Does Basenorm decide whether a control is adequate?
No. Basenorm shows where a control counts. Whether the control and its evidence are adequate for a standard is assessed per organisation, by you and your auditor.
How much do ISO 42001 and ISO 27001 overlap?
Both share the structure of clauses 4 to 10. Reuse is assessed per control, not as a fixed percentage. For ISO 27001 and NIS2, Basenorm’s published mapping shows 70 to 80% shared controls.
Can we add our own controls?
Yes. You can add your own controls and frameworks and link them in the same way.
Book a demo
See your controls in one library.
Together we look at your standards and what you can reuse.
- Which of your controls count for more than one standard.
- How evidence is linked once.
- What a next framework would add.
Hosted in the Netherlands. Your data stays in the EU.