Multiple frameworks
Several frameworks, one control library.
Run ISO 42001, ISO 27001, NIS2, DORA, SOC 2 and more on the same controls and evidence. Define a control once and see which frameworks it counts for.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Lead
- ISO 42001 and ISO 27001The base for the rest
- Controls
- Defined onceLinked to every framework they count for
- Evidence
- Linked onceReused where the control counts
- Overlap
- Assessed per controlDiffers per combination
01 / Example mapping
See where it counts.
And where not.
The mapping shows per control which frameworks it counts for, including the ones it does not.
See where each control counts. And where it does not.
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
02 / Add a framework
How you add
the next one.
A new framework starts from the controls you already have.
- 1Choose the framework
For example NIS2 next to your ISO 27001.
- 2See what already counts
Basenorm shows which of your controls are linked to the new framework.
- 3Add what is missing
Add the controls and evidence the new framework asks for.
- 4Assess and improve
Decide per control whether it is adequate, together with your auditor.
03 / Common combinations
Frameworks that belong together.
ISO 27001 + ISO 42001
Your ISMS and your AI management system, sharing clauses 4 to 10.
02ISO 27001 + NIS2
NIS2 measures built on your ISMS, sharing 70 to 80% of controls.
03ISO 27001 + DORA
ICT risk management for financial entities on your ISMS.
04ISO 27001 + SOC 2
One set of controls for European and North American customers.
04 / Questions
Questions about
multiple frameworks.
How much do frameworks overlap?
It differs per combination. ISO 42001 and ISO 27001 share the structure of clauses 4 to 10, and ISO 27001 and NIS2 share 70 to 80% of their controls according to Basenorm’s published mapping. Reuse is assessed per control.
Which framework do we start with?
Most organisations start with ISO 27001. ISO 42001 and legal frameworks such as NIS2 or DORA build on it.
Does Basenorm decide whether a control is adequate?
No. Basenorm shows where a control counts. Whether the control and its evidence are adequate is assessed by you and your auditor.
Book a demo
Bring your frameworks together.
In a demo we look at your frameworks and what they share.
- Which controls count for several frameworks.
- In which order you add frameworks.
- How you keep one overview.
Hosted in the Netherlands. Your data stays in the EU.