Many requirements appear in several catalogues, for example in ISO/IEC 27001 Annex A, the NIS2 Directive and NIST SP 800-53. Mappings connect such requirements so that you do not do work twice. This guide explains the types of mappings, inherited fulfilment and the “Coverage and delta” analysis.

Before you start

  • People with the “Manage mappings between catalogues” permission see and maintain mappings. By default, these are the ISMS managers.
  • You need at least two catalogues, see Adopting requirement catalogues and keeping them up to date. The mappings between standard catalogues are already in place.
  • Plan: inherited fulfilment and the Coverage page are included from the Pro plan. You can view and assess mappings in every plan in which you keep several catalogues. The Free plan has no standard catalogues; there you only connect your own catalogues.

The types of mappings

The type always describes the requirement you are currently looking at in relation to the other one:

  • Equal: both require the same. Fulfilment applies in both directions.
  • Subset of: this requirement is entirely contained in the other. If the other is fulfilled, this one counts as fulfilled, not the other way round.
  • Superset of: this requirement requires more than the other. It also fulfils the other, not the other way round.
  • Intersects with: both concern the same topic but do not require the same. This is only a hint; fulfilment is suggested for review.
  • No relationship: is only available when you assess a mapping differently. It then has no effect.

What is a subset from one side is a superset from the other side.

Viewing and assessing mappings

  1. Open Requirements › All requirements and choose a requirement.
  2. In the Mappings to other catalogues section, you see the connected requirements of your other catalogues with their type.
  3. If a standard mapping from Varmo does not fit your organisation, click I see it differently, choose the type from your perspective and justify it. From then on, your assessment applies. With Withdraw deviation, Varmo's assessment applies again.
  4. If a connection is missing, create it with Add mapping. Between two standard catalogues, a justification is required.

You find all deviations and custom mappings with justification under Requirements › Mappings. “Mappings” is the name of this list in the menu; it contains the same mappings described here.

Inherited fulfilment

From the Pro plan, Varmo automatically inherits fulfilment if a requirement is equal to, or a subset of, a fulfilled requirement. Fulfilled means: applicable, marked as “Implemented” and supported by a description or effective evidence.

  • You see the inheritance on the requirement in the “Implementation” section. Your own implementation status remains unaffected.
  • For intersecting mappings and supersets, fulfilment appears under Suggested for review. You confirm it with Adopt and a justification.
  • If the source is later no longer fulfilled, the inheritance ends automatically. Inheritance never spans chains.
  • If the text of a requirement or the version of a catalogue changes, the mapping is marked as outdated and transfers nothing until it has been reviewed.

Many standard mappings from Varmo are “intersects with”. Automatic inheritance therefore applies less often than one might expect; the rest appear as suggestions for review. Inherited fulfilment refers to the evidence of the source; it does not replace your own review: in an audit, the requirement in the target catalogue is assessed on its own. Particularly for legal catalogues (e.g. NIS2 Directive, Data Protection Ordinance), record in the implementation how the source fulfils the requirement.

Adopting applicability, measures and evidence

The inherited fulfilment described above works continuously and automatically, but only concerns implementation. When a new catalogue is added, from the Pro plan you can also adopt applicability including justification, linked measures and evidence from your existing catalogues once. This is a deliberate step with a preview, and it can be undone. How this works is described in Adopt from existing catalogues.

Coverage and delta

Under Requirements › Coverage (from the Pro plan), you compare up to three catalogues in a radar chart. The axes are the six functions of the NIST Cybersecurity Framework 2.0. Only applicable requirements are counted; implemented and inherited ones count in full, partially implemented ones count half. This is why coverage is usually higher than the “implemented” share on the catalogue page.

For a target catalogue, the delta shows what is still missing, grouped by:

  • Contradictory decisions: an equal requirement is marked as not applicable elsewhere.
  • Builds on what exists: something similar is already implemented, often with little effort.
  • Nothing in place yet: this is where the actual work lies.

Frequently asked questions

Why can't I see any mappings on the requirement?

Either you do not have the “Manage mappings between catalogues” permission, or you only keep one catalogue. Without the Pro plan, a notice also appears that inherited fulfilment is not included there.

Does my assessment go to Varmo?

Yes. Deviations and additions between standard catalogues are sent to Varmo as feedback. For your organisation, your assessment applies immediately.

Can I withdraw a confirmed adoption?

Yes. On the requirement, choose Withdraw confirmed adoption. The requirement then no longer counts as fulfilled via the other one; the history is kept.