Measure your own baseline first
Vendors like round numbers: thirty percent of your time, eighty percent less work. Such figures are hard to verify and rarely comparable, because they depend on the frameworks, the organisation and how the work was organised before. The only figure that helps you is your own. Ask the people involved to log their compliance hours for one quarter: chasing evidence, explaining findings, describing controls again for a new framework or questionnaire, and preparing for audits. Include the control owners in the business, not only the security officer. You will see where the hours go, and you can ask every vendor which of those hours their product actually removes.
Frameworks: product or template?
Almost every platform lists ISO 27001, NIS2, DORA and the AI Act. The question is what is behind the name. Ask to see the frameworks that apply to you in the product, with your own scope, rather than on a slide. For ISO 42001, ask how the AI system inventory and the impact assessment are handled; those are the parts with no counterpart in an ISMS, and a template library tends to skip them.
Then look at how controls are stored. If every framework holds its own copy of “access management”, you will maintain the same control, the same owner and the same evidence several times. A platform that defines a control once and links it to every framework it counts for avoids that. Check whether it also shows where a control does not count, because a mapping that only shows overlap hides the gaps your auditor will find.
AI: assistant or decision-maker?
AI features are now standard in compliance tools, and they vary widely. An assistant that explains requirements, drafts documents and searches your controls saves time while leaving the decisions with your team. A tool that marks controls as compliant on its own produces statuses nobody in your organisation decided, which you will have to explain to an auditor. Ask which models are used, where they process your data, whether your data is used for training, and whether the AI can see more than the user asking the question.
Hosting, access and exit
The platform behind your ISMS holds risks, incidents, vulnerabilities and supplier assessments. Under NIS2, DORA and the GDPR you assess the risks of your own suppliers, and the platform vendor is one of them. Ask where your data is hosted on day one, whether EU hosting is the default or an option you have to request, and which legal jurisdiction the vendor falls under. Ask how your auditor gets access: read access to controls, evidence and the audit trail saves weeks of exchanging exports.
Finally, ask about leaving. Your management system is yours. Ask which data you can export, in which format, and what happens to your data after the contract ends. A vendor that is vague here is telling you something.
How Basenorm answers them
Basenorm defines each control once and shows where it counts and where it does not, for ISO 42001, ISO 27001, NIS2, DORA, the GDPR and other frameworks. AskNorman explains and drafts; your team decides. Basenorm is a Dutch company, hosted on Microsoft Azure in the Netherlands, with a database per organisation and an auditor role with read access. The security page has the details, and the pricing page shows what it costs.