Frameworks
Frameworks linked to the same controls: NIS2, ISO/IEC 27001, DORA, AI Act, GDPR, ISO/IEC 42001, SOC 2, CRA.
Each framework has its own rules, but much of the proof is the same. EVIDEVO links requirements to the organisation's controls: evidence collected once counts for every framework that asks for it.
Priority areas
- 01Cybersecurity NIS2 Risk-management measures (Art. 21), incident reporting (Art. 23) and management body accountability (Art. 20) for essential and important entities.
- 02Information security ISO/IEC 27001 Requirements for an information security management system (ISMS), certifiable by an accredited body.
- 03Digital operational resilience DORA ICT risk management, ICT incidents, resilience testing and ICT third-party risk for banks, insurers and other financial entities.
- 04Artificial intelligence AI Act Obligations for AI systems based on the organisation's role and the level of risk.
- 05Personal data protection GDPR Processing of personal data: records, security measures, breaches, impact assessments and data subject rights.
Specialist areas
- 06AI management systems ISO/IEC 42001 AI management system: establishing, operating and continually improving it.
- 07AICPA attestation SOC 2 Attestation report by an independent auditor on a service organisation's controls, under the AICPA Trust Services Criteria.
- 08Products with digital elements Cyber Resilience Act Cybersecurity requirements across the life cycle of products with digital elements.
One control, many frameworks
One control linked to the requirements of several frameworks: four examples.
Each of the organisation's controls is linked to the requirements of every framework that asks for it, in their official form. When a piece of evidence is updated, the status changes across all of them.
Illustrative mapping examples. The full mapping is in the platform.
How the applicable frameworks are determined
Sector, size, services offered and use of AI systems define the scope. The starting assessment identifies it and shows where to begin.
Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.
A thirty-minute presentation based on the organisation's scope.
It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.