Virtual CISO · Compliance mapping
One piece of work, counted against every framework you answer to
NIS2, ISO 27001, DORA and GDPR ask many of the same questions in different words. Doing the work once and counting it everywhere is the difference between one security program and four parallel audits, and it is the difference your portal exists to make visible.
Finish a task once, and every gauge it touches moves
Behind every framework is a set of controls, and behind the controls are things somebody has to actually do: write the policy, get it approved, back the data up, test the restore, train the people, keep the evidence. Most of those things serve more than one framework.
So we keep one task list rather than one per framework. Each task carries the controls it satisfies, in every framework it touches, and closing it moves all of them at once. The alternative — a NIS2 project, an ISO project and a DORA project running beside each other — is how an organization ends up documenting the same backup policy three times in three formats, and defending three different versions of it.
The frameworks a task can count against
Not a wish list. These are the control sets your tasks are mapped to, and the ones a coverage figure is calculated from.
- 01
European and national law
NIS2 and the national implementations that carry it — the Hungarian security classes, the German NIS2UmsuCG, the Belgian CyFun, Croatia and Poland. Alongside them DORA for financial entities, GDPR, and the EU AI Act. Where a national implementation is not yet a template of its own, the work runs from the directive’s control set mapped to the national text.
- 02
Standards and certifications
ISO/IEC 27001:2022 — both clauses 4 to 10 and Annex A, counted separately because auditors treat them separately — ISO/IEC 42001 for AI management systems, ISO/SAE 21434 for automotive, CIS Controls v8.1, NIST CSF 2.0 with SP 800-53 and 800-171, PCI DSS 4.0.1, SOC 2 and Cyber Essentials.
Each of these has a page of its own if what you need is the obligation rather than the mechanics: our framework pages set out who falls in scope and what is actually required. Awareness training is the clearest case of one obligation counted several times: NIS2 names it among the basic cyber-hygiene measures, while ISO 27001 and DORA both want the evidence that it happened.
Every control, and the work that is actually behind it
A coverage percentage is only worth what you can open underneath it. Pick a framework, pick a control — NIS2 Article 21(2)(a), say — and you get the tasks that satisfy it, each with its own status, its priority and the policy it belongs to.
That is the view an auditor wants, and it makes the internal argument short. Not “we are at 63% on NIS2”, but “here is Article 21(2)(a), here are the five things we did for it, and here is the evidence attached to each one”.
- An implementation status per control, and a separate validated status with the date it was checked
- The tasks behind each control, each carrying its own status and its own evidence
- A next validation date, so a control signed off a year ago does not quietly pass for current
- The same control list exported, for the auditor who asked for it in writing
A percentage is not a certificate, and your portal does not pretend otherwise
Coverage is computed from tasks actually completed, and it is shown twice: a potential score from task completion alone, and a validated score counting only what somebody has checked and signed off. The distance between the two is usually the honest picture.
It also says what it is not counting. Coverage reflects only the tasks currently in scope, and the overview says so on the page rather than in a footnote — a figure calculated over a quietly narrowed scope is the easiest number in this industry to mislead yourself with. And nothing here will tell you that you are compliant. That is a conclusion for your auditor, your regulator or your customer to reach, from evidence we can hand them.
A report per framework, not a screenshot of a dashboard
Each framework has a report behind it: the controls, their status, what sits under each one, and the gaps named. It goes to an auditor, to a customer running a supplier assessment, or into a board pack, without anybody rebuilding it in a spreadsheet first.
The same holds when the question comes from a customer rather than a regulator. A supplier questionnaire usually asks for a subset of what is already here, and answering it from the framework report is faster than answering it from memory — and, more to the point, consistent with what you told the last one.
Adding a framework when somebody finally asks for it
A customer asks for ISO 27001 eighteen months into a NIS2 program. The ISO control set is added to the scope you already have, your completed tasks are mapped onto it, and you get the delta — usually far smaller than it feels, because the overlap with what you have already done is real rather than claimed.
What you do not do is start again. The evidence you collected still counts, the policies you wrote still apply, and the gap list you are left with is the work that genuinely was not covered.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
No, and nothing in your portal will say it is. The figure counts completed tasks against the controls currently in your scope. It cannot see whether a policy is any good, whether your people follow it, or whether the scope was drawn honestly in the first place — and a number computed over a quietly narrowed scope looks exactly like a number computed over an honest one. Compliance is a conclusion your auditor, your regulator or your customer reaches from evidence. The figure tells you where to point them, and where not to.
The one with a date attached. A statutory deadline, or an audit already booked with a certification body, beats a framework chosen because it looks thorough. If nothing has a date yet, start with whichever one your customers keep writing into contracts, because that is the one that will get a date. The overlap is what makes this a low-stakes decision: the second framework is never a second project.
Yes. The Hungarian security classes are our own templates rather than a generic NIS2 list translated into Hungarian, and that distinction is the reason we built them. Which class applies to you is the first thing we settle, because it decides the size of everything that follows.
It helps most in exactly that case. A certified organization already has evidence, a statement of applicability and a surveillance cycle, and a large share of that answers NIS2 questions too. Mapping what you have across is the cheapest compliance work available to you, and what is left over is genuinely new rather than paperwork you have already done once.
Where this sits, and what comes next
The assessment
Two weeks, your answers and our review, scored against the frameworks you are held to.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.