Combine several frameworks
How mappings work, with a real example.
FEATURES · REQUIREMENTS & SoA
Every requirement with a reason and evidence.
Adopt centrally maintained frameworks or record your own. For each requirement you record whether it applies, how it is met and what proves it, right up to the approved Statement of Applicability.
Custom catalogues in all plans · standard catalogues from Starter · cross-check and coverage from Pro
WHAT YOU GET
- Frameworks: ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-53, NIS2, ICT baseline protection (Switzerland), ICT Minimum Standard (Switzerland), FINMA Circular 2023/1, DORA, data security under the FADP/DPO
- Applicability with a mandatory justification for exclusions
- Annex A cross-check under ISO/IEC 27001 6.1.3 c
- SoA versions with approval, print and CSV
Frameworks
ISO/IEC 27001:2022, NIST CSF 2.0, NIST SP 800-53, NIS2, the ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland), FINMA Circular 2023/1, DORA and data security under the FADP/DPO are available as centrally maintained catalogues. You record your own catalogues and internal requirements by hand or, from Starter, by CSV import.
- Adopt standard catalogues (Annex A from Starter, all from Pro)
- Maturity level 0–4 per requirement with a suggestion from your data, as in the ICT Minimum Standard (from Pro)
- Custom catalogues with an assistant, in all plans
- Explanations and implementation guidance per requirement
- You adopt new versions and editions of a framework step by step, per requirement or chapter; the ISMS manager sees the impact first and decides when
Applicability in one go
Decide for all requirements of a framework whether they apply. Whoever excludes a requirement gives a reason, for several at once if needed.
- Justification mandatory for “not applicable”
- Filters and search
- Applicability is set per framework and never carried over automatically
Implementation and evidence
For each requirement the status is recorded: open, planned, partial or implemented, with a description. A requirement only counts as implemented with effective evidence.
- Evidence from measures, internal controls, policies and documents
- Notice of contradictions, e.g. an open measure
- Implementation level per framework
Annex A cross-check
ISO/IEC 27001 6.1.3 c requires you to compare the controls you have chosen with Annex A. For each framework, Varmo shows where a justification for inclusion is missing, where an excluded requirement still appears in a risk treatment and which treated risks are not mapped to any requirement. A new SoA version can only be created once the blocking points are resolved.
Mappings and coverage
Mappings between ISO/IEC 27001, NIST CSF 2.0, NIST SP 800-53, NIS2, the ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland), FINMA Circular 2023/1, DORA and data security under the FADP/DPO show where one implementation affects several requirements. If a requirement is equivalent to, or contained in, one that is met, its fulfilment is inherited. Coverage compares frameworks across the six functions of the NIST CSF. Both are included from the Pro plan.
- Equivalent, contained and overlapping mappings
- Your own assessment with a justification
- Radar chart and list of gaps
Statement of Applicability (SoA)
A version freezes the applicability, justifications, implementation and evidence of a framework. It is approved under the four-eyes principle or rejected with a reason. If anything significant changes afterwards, Varmo shows that the SoA is out of date.
- Versions with approval
- Print and CSV export
- Earlier versions are kept as evidence
Related
Frameworks
ISO/IEC 27001, NIST CSF 2.0, NIST SP 800-53, NIS2, the ICT baseline protection (Switzerland), the ICT Minimum Standard (Switzerland), FINMA Circular 2023/1, DORA and data security under the FADP/DPO in detail.
Pricing and plans
Which frameworks are included in which plan.
Frequently asked questions
What is a Statement of Applicability (SoA)?
The Statement of Applicability is a mandatory document under ISO/IEC 27001 6.1.3 d. It lists all controls from Annex A, whether they are applied, why, and whether they are implemented.
How are the mappings between the frameworks created?
The mappings between ISO/IEC 27001 and NIST CSF 2.0 come from NIST’s public catalogue of Online Informative References. NIST itself published the mappings from NIST SP 800-53 to ISO/IEC 27001 and to NIST CSF 2.0, in the same catalogue and as Informative References of CSF 2.0 respectively. We added most of the controls that NIST does not map to the CSF; a few with no relation to the CSF remain unmapped. The mappings of NIS2 and the ICT baseline protection (Switzerland) to the other frameworks are our own expert mapping, as there is no official source. The ICT Minimum Standard (Switzerland) is mapped to CSF 2.0 through NIST’s crosswalk and to ISO/IEC 27001 and NIST SP 800-53 through the references in the standard. Every mapping has a type: equal (both essentially require the same), subset or superset (one requirement is fully contained in the other) or overlapping (they only partly coincide). For equal and contained requirements, one automatically counts as met as soon as the other is met; we only assign these types after a review. Overlapping mappings merely show where one implementation also affects other requirements. You can assess every mapping differently, with a justification.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.