Multi-framework
ISO 27001, NIS2, DORA and GDPR control crosswalk
Filter a control area and read the nearby references in ISO/IEC 27001:2022, NIS2, DORA, the GDPR and Model 231. The point is to collect one proof and show it where it is needed.
| Area | ISO/IEC 27001:2022 | NIS2 | DORA | GDPR | Model 231 | Single piece of evidence |
|---|---|---|---|---|---|---|
| Governance and risk | A.5.1, A.5.2, A.5.4 | Arts. 20 and 21(2)(a) | Arts. 5, 6 and 16 | Arts. 24 and 32 | Protocols and delegations of the governing body | Approved policy, risk register, review minutes |
| Supply chain and third parties | A.5.19, A.5.21, A.5.22 | Art. 21(2)(d) | Arts. 28–30 | Art. 28 | Due diligence and clauses toward partners | Critical supplier list, contract, proof of review |
| Incident handling | A.5.24, A.5.25, A.5.26 | Arts. 21(2)(b) and 23 | Arts. 17–19 | Arts. 33 and 34 | Reporting path to the oversight body | Procedure, event log, proof of notification or of the decision not to notify |
| Access and credentials | A.5.15, A.5.16, A.5.17, A.8.5 | Art. 21(2)(i) and (j) | Arts. 9 and 10 | Art. 32 | Segregation and tracing of privileged access | Access matrix, MFA on privileges, periodic review |
| Continuity and backup | A.5.29, A.5.30, A.8.13 | Art. 21(2)(c) | Arts. 11 and 12 | Art. 32(1)(c) | Restore tests on sensitive processes | Plan, restore test, dated result |
| Training and hygiene | A.6.3, A.5.7 | Art. 21(2)(g) | Art. 13 | Arts. 29 and 32 | Training on predicate offences | Training plan, attendance, content |
An indicative aid for compliance work. It is not legal advice, a filing with an authority, or a certification.
Why a correspondence is not a legal table
ISO/IEC 27001 Annex A, NIS2 article 21, the DORA articles on ICT risk and third parties, GDPR article 32 and Model 231 protocols are not the same text. They do ask for similar proof: who decided, what was done, when it was reviewed.
The tool shows operational affinity, not a certified mapping. An ISO control does not by itself “close” NIS2 if the link to the essential service and the supplier is missing.
How GRC teams use it
Start from the area an auditor asks for first: incidents, suppliers, access, continuity, training, inventory. For each row, note the evidence you already have and the evidence you do not. Do not rewrite the same procedure four times under different names.
From a row to a live control
A row becomes useful when it has an owner, a due date and a file someone can retrieve. The multi-framework guide shows how to stop the same control living unnamed in four registers.
FAQ
Does ISO 27001 cover NIS2 article 21 on its own?
No. Annex A is a strong skeleton, but NIS2 also wants the link to services, notification and the national supply chain. A certificate does not replace those duties.
Does the GDPR belong in a security map?
Yes, where the measure protects personal data: access, article 28 suppliers, breach handling and article 32 security. Not every NIS2 row is also a GDPR row.
Where does Model 231 sit?
In the predicate offences that run through systems, suppliers and delegations. The oversight body asks for protocols and proof they are followed, not an ISO statement of applicability.
Can I filter one framework?
Yes. The filters hide columns on the page. The full text stays in the table HTML.