Multiple frameworks: questions and answers.
How to run several standards and regulations on one set of controls.
How do you manage several frameworks at once?
Start from controls instead of frameworks. You define each control once, link it to every framework it counts for and attach the evidence to the control. When you add a framework, you see which controls already count and what is missing.
What is control reuse?
Control reuse means one control and its evidence count for more than one framework. Access management, for example, counts for ISO 27001, NIS2 and SOC 2. Whether a control is adequate for each framework is still assessed per framework, together with your auditor.
What is a Unified Control Library?
The Unified Control Library is the control library in Basenorm. Each control is defined once and linked to the requirements of ISO 42001, ISO 27001, NIS2, DORA, GDPR and other frameworks it counts for, including which frameworks it does not count for.
What if frameworks set different requirements for the same topic?
Meet the strictest requirement where it applies and record per framework what is needed. Incident reporting is an example: NIS2 asks for an early warning within 24 hours, while the GDPR asks for notification of a personal data breach within 72 hours. One incident process can cover both if it contains both deadlines.
How much do frameworks overlap?
It differs per combination and per scope. ISO 42001 and ISO 27001 share the structure of clauses 4 to 10, while their Annex A controls cover different topics. Basenorm shows overlap per control, so you can see exactly what counts and what does not.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.