Frameworks
The regulations and standards, explained
What each regime requires, who it applies to and by when — written from the primary sources, and checked against them.
Guides
Start with the regime you're accountable for.
Scope, requirements, deadlines and overlaps for each regime, with the primary sources cited and the date they were last checked.
01NIS2The EU's cybersecurity directive for essential and important entities: who is in scope, the Article 21 measures and the 24-hour reporting clock.02DORAThe financial sector's operational resilience regulation: ICT risk, major-incident reporting, resilience testing and the register of information.03EU AI ActThe EU's risk-based AI regulation: prohibited practices, Article 50 transparency, high-risk duties and the dates the Digital Omnibus moved.04ISO 42001The certifiable standard for AI management systems: clauses 4 to 10, 38 Annex A controls, and how it relates to the EU AI Act.05ISO 27001The certifiable standard for information security management: clauses 4 to 10, the 93 Annex A controls, the certification cycle, cost and timeline.06GDPRThe EU's data protection regulation: who it covers, the principles and controller duties, records and DPIAs, the 72-hour breach clock and fines.07EU Cyber Resilience ActThe EU's cybersecurity law for hardware and software products: who is in scope, the Annex I requirements, vulnerability reporting since September 2026 and the 2027 deadline.08SOC 2The AICPA attestation report on a service organisation's controls: Type 1 and Type 2, the Trust Services Criteria, the audit cycle and its cost.
More frameworks
The platform covers 30+ frameworks from one evidence base, among them HIPAA, PCI DSS, NIST CSF, CIS v8, ISO 27017, ISO 27018 and ISO 22301. The full catalogue lists every one, with its id and category.
One programme, every framework.
See how your frameworks map onto one control library, with the evidence you already collect.