Frameworks
Thirteen frameworks plus your own.
One piece of evidence counts for all.
Not every framework ends in a certificate. The difference decides to whom you have to prove something and what you can show. Here you can see what is required – and how Sightadel gets you there.
Which framework first?
Start with the trigger.
Almost every compliance project has a concrete reason. That reason decides which framework comes first – and whether you need a certificate at the end or evidence for the supervisory authority.
A customer asks for proof
Ask exactly what is required. Usually it is an ISO 27001 certificate for information security or ISO 9001 for quality. Customers from the USA often ask for SOC 2, cloud customers for BSI C5.
A tender requires it
The tender documents usually name the certificate and sometimes the scope. Plan realistically: months pass between project start and certificate, and the certification body needs lead time for dates.
A law obliges you
Here the first question is whether you are in scope. NIS2 depends on sector and size, DORA applies to financial entities, the GDPR to anyone who processes personal data. The goal is not a certificate but accountability.
Your industry has its own rules
Medical practices implement the IT security guideline under § 390 SGB V (German Social Code, Book V), food businesses a HACCP plan, providers and deployers of AI systems the EU AI Act – optionally with ISO 42001 as the management system.
No concrete trigger? Then ISO 27001 is a solid foundation, because many other frameworks build on similar measures. If you only want to gauge your own maturity, start with the NIST CSF.
What you end up with
Certificate, obligation, evidence – and for whom.
If you want to show customers a certificate, you need a different framework from someone who is accountable to a supervisory authority. The matrix shows for each framework whether it is mandatory, to whom you provide evidence and what you end up with.
| Framework | Type | Mandatory or voluntary | Evidence for | What you end up with |
|---|---|---|---|---|
| ISO 27001 | Certification | Voluntary, often required by contract | Customers, contracting authorities in tenders, insurers | Certificate from an accredited certification body, three-year cycle |
| ISO 9001 | Certification | Voluntary, often required by contract | Customers, contracting authorities in tenders | Certificate from an accredited certification body, three-year cycle |
| ISO 42001 | Certification | Voluntary | Customers and partners who obtain AI systems from you | Certificate for the AI management system, structured like ISO 27001 |
| NIS2 | Legal obligation | Legal obligation for entities in scope | BSI as supervisory authority, your own management | No certificate. Evidence for the supervisory authority, reports after 24 and 72 hours and one month, implementation and oversight by management |
| GDPR | EU regulation | Legal obligation where personal data is processed | Data protection supervisory authority, data subjects, clients | No certificate. Accountability, record of processing activities, technical and organisational measures |
| BSI C5:2026 | Attestation | Voluntary, often required of cloud providers | Customers, public-sector clients | Attestation from an independent auditor (certified public accountant) under ISAE 3000, at a point in time or over a period |
| DORA | EU regulation | Legal obligation for financial entities | Financial supervisory authority | No certificate. Evidence for the supervisory authority, register of information, testing programme |
| NIST CSF 2.0 | Framework | Voluntary | Management, supervisory board, insurers | No evidence foreseen. A common language for presenting maturity to management, the supervisory board and insurers |
| SOC 2 | Audit report | Voluntary, often required by contract | Customers, especially from the USA | Report from an independent audit firm (certified public accountants), Type I at a point in time or Type II over a period |
| HACCP | EU regulation | Legal obligation for food businesses | Food control authorities | No separate certificate. HACCP procedures under Regulation (EC) No 852/2004, checked by the food control authorities |
| § 390 SGB V | Legal obligation | Legal obligation for medical and dental practices | Evidence on request | No certificate. Implementation of the IT security guideline according to practice size, evidence on request |
| EU AI Act | EU regulation | Legal obligation depending on role and risk class | Market surveillance; conformity assessment for high-risk AI systems | No general certificate. Obligations depending on role and risk class, conformity assessment for high-risk AI systems |
| ISO 27090 | Framework | Voluntary | Customers, auditors in ISO 27001 or ISO 42001 audits | No certificate. Threat analysis and controls for AI systems, built into the ISMS or AI management system |
| Custom framework | Self-defined | Depends on the requirement | Group, customers, contractual partners | Group policies, customer requirements from contracts, industry standards without a ready-made module |
One piece of evidence, several frameworks
The same question four times. One answer.
The same matter is asked about by several frameworks. Access management appears in ISO 27001 Annex A, in the NIS2 measures under section 30 of the German BSI Act (BSIG), in DORA’s ICT risk management and in the SOC 2 common criteria.
- A piece of evidence is stored once and attached to every requirement it supports.
- If it changes, it changes everywhere. If it expires, it expires everywhere.
- We also tell you what does not carry over: the reporting deadlines of NIS2 and DORA are not identical, and the DORA register of information has no counterpart in ISO 27001.
We deliberately do not give a percentage for the overlap. It depends on your scope.
Common combinations
Which frameworks often go together.
It rarely stays with one set of rules. We see these pairs particularly often – with what can be shared and what comes on top.
ISO 27001 and NIS2
The ISMS provides risk management and many measures. NIS2 adds registration, reporting channels with fixed deadlines and management’s duty to implement and oversee the measures.
ISO 27001 and ISO 9001
Same high-level structure. You set up document control, internal audit, management review and corrective actions once and use them for both.
ISO 27001 and GDPR
You evidence technical and organisational measures with the same evidence. Legal bases, data subject rights and the record of processing activities are topics of their own.
DORA and ISO 27001
ICT risk management and incident handling rest on the same foundations. Only DORA requires the register of information and the testing programme.
EU AI Act and ISO 42001
The AI management system provides the structure for inventory, responsibilities and risk assessment. It does not replace conformity assessment and registration.
ISO 9001 and HACCP
Supplier evaluation, training records and corrective actions are managed once and feed into both systems.
Questions and answers
Questions about choosing a framework
More in our FAQ or directly via our contact form.
Which framework should I start with?
The one with a concrete trigger: a customer requirement, a tender or a law. If there is none, ISO 27001 is a good foundation, because many other frameworks build on similar measures.
Can I add a second framework later?
Yes, at any time. You attach evidence you have already stored to the requirements of the new framework. If your licence includes ISO 27001 or ISO 9001, every other framework comes with a permanent discount. The terms are on our pricing page.
Does an ISO 27001 certificate replace the NIS2 obligations?
No. It covers many risk management measures, but NIS2 adds registration, reporting channels and management’s responsibility for implementation and oversight. The certificate is good evidence, not a substitute.
How do I know whether NIS2 or DORA applies to me?
That depends on sector, size and group structure. You will find the criteria on the NIS2 and DORA pages. In borderline cases, clarify whether you are in scope with a consultant or a law firm – we do not provide legal advice.
My framework is not listed. What now?
Create it as a custom framework, for example for group policies or customer requirements from contracts. Or tell us which one you need – we build missing frameworks.
How long does it take to get certified?
That depends on your starting point, size and scope. A reliable figure can only be given after the stocktake. In the assessment you see after the first controls how much is still missing.
What do the frameworks cost in Sightadel?
Each framework has its own monthly price per edition. ISO 42001, § 390 SGB V, EU AI Act and ISO 27090 are available on request. All details are on the pricing page.
Do I need an auditor for NIS2 or DORA?
No certificate is foreseen. But you must be able to demonstrate implementation to the supervisory authority, and under NIS2 management implements the measures and oversees their implementation. An external review before an inspection is often worthwhile all the same.
What is the difference between a certificate and an attestation?
A certificate is issued by an accredited certification body, for example for ISO 27001. An attestation or audit report, for example for BSI C5 or SOC 2, is prepared by an independent audit firm (certified public accountants). Both show third parties that an independent audit has taken place.
Start with one framework.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.