- Home
- News & articles
- Cyber security
One control set, five frameworks: stop running compliance as separate projects
ISO 27001, NIS2, DORA, PCI DSS and GDPR ask for many of the same things. Build them once and you save months of duplicated effort and evidence.
A company that needs ISO 27001 for its customers, NIS2 for its regulator and PCI DSS for its card payments can easily end up with three projects, three owners and three sets of evidence. It is an expensive way to answer what is often the same question three times.
The overlap is real
Take access control. One well-written policy, with evidence that it works, supports all of these at once:
- ISO 27001:2022: Annex A control A.5.15
- NIS2: Article 21(2)(i)
- DORA: Article 9
- GDPR: Article 32
- PCI DSS v4.0.1: Requirement 7
The same holds for asset management, risk assessment, supplier security, business continuity, incident response and training. Implement the control once, evidence it once, and map it to every framework that applies.
Compliance gets cheaper when you stop asking "what does this framework want?" and start asking "what control do we already have that answers it?"
Where they genuinely differ
A shared control set does not mean the frameworks are identical. Each adds something the others do not:
- ISO 27001 adds a certifiable management system, internal audit and management review.
- NIS2 adds strict incident deadlines, management liability and supply chain duties.
- DORA adds a Register of Information, reports to your competent authority and resilience testing.
- PCI DSS adds a tightly scoped cardholder data environment, regular scans and independent validation.
- GDPR adds records of processing, impact assessments and data-subject rights.
A sensible order
- Start with scope, assets and risks, since every framework depends on them.
- Use ISO 27001 as the backbone, even if you do not plan to certify straight away.
- Layer on the legal obligations that apply to you, starting with the hardest deadlines.
- Add the specialist requirements, such as cardholder data scoping or the Register of Information.
- Keep a single evidence pipeline, with one owner for each control.
How we do it
This is the approach behind our Cyber Security Framework Consulting, supported by CogniRes, the AI-native ISMS platform our team built, which maps one set of controls and evidence across all five frameworks.
