Findings mapped to the frameworks you report against
Each finding is mapped to the controls it bears on in four frameworks. The pages below list those controls, the findings that count against them, and what outside-in evidence cannot show.
Last reviewed
Outside-in evidence supports only the technical controls whose results show on the internet. Policies, processes and internal systems need evidence from inside the organisation, so no framework is covered in full, and a good score is never proof of compliance. For financial entities under DORA, see the guide to DORA and ICT third-party risk.
NIS2 Directive
Risk-management measures under Article 21.
4 controls with evidence
ISO/IEC 27001:2022
Annex A technological controls.
10 controls with evidence
CIS Controls
Safeguards for internet-facing assets.
6 controls with evidence
SOC 2
Trust services criteria.
5 controls with evidence