Implement once, demonstrate compliance across frameworks.
Many requirements appear in similar form in ISO/IEC 27001, NIST, NIS2 and other frameworks. Varmo links them through mappings so that you do not do the work twice.
Three frameworks, one implementation.
A mapping links a requirement to a requirement in another catalogue, for example an Annex A control from ISO/IEC 27001 to a control from NIST SP 800-53. The type always describes this requirement in relation to the other: what is a subset from one side is a superset from the other.
- If you implement A.8.3, AC-3 counts as fulfilled – and vice versa, because the two are equivalent.
- If PR.AA-05 is fulfilled, AC-3 counts as fulfilled too: AC-3 is entirely included in PR.AA-05 (subset).
- AC-3 on its own only partly covers PR.AA-05 (seen from there, a superset). Varmo only suggests the fulfilment for review.
- A.8.3 and PR.AA-05 only overlap. The mapping shows that your implementation affects both; nothing is taken over automatically.
Four types of mapping.
The type determines whether fulfilment is inherited automatically or only suggested for review.
Equal
Two requirements from different catalogues require essentially the same. If one is met, the other automatically counts as met too – in both directions.
Fulfilment applies in both directions
Subset of
One requirement requires less than the other and is fully contained in it. If the more comprehensive requirement is met, the contained one automatically counts as met too – not the other way round.
Counts as met if the other is met
Superset of
One requirement requires more than the other and fully includes it. If only the smaller one is met, the more comprehensive one is only partially met; the fulfilment is only suggested for review.
Also meets the other, not the other way round
Intersects with
Two requirements only partially overlap; each requires something the other does not. The fulfilment is not inherited automatically, but only suggested for review.
Hint only, fulfilment for review
What you gain.
Mappings save work without taking decisions away from you.
- Inherited fulfilment (from Pro)If a requirement is equivalent to or included in a fulfilled one, it automatically counts as fulfilled. Inheritance never runs through chains, and you can rate any mapping differently with a justification.
- Add a framework later (from Pro)When a framework is added, you take over applicability, measures and evidence from existing frameworks – with a preview, and it can be undone.
- Coverage and delta (from Pro)Compare up to three frameworks by the six functions of NIST CSF 2.0, and see for each target framework what is still missing.
- Applicability remains your decisionYou decide per framework whether a requirement applies to you. If decisions on equivalent requirements contradict each other, the requirement points it out.
These frameworks are linked.
The platform frameworks are centrally maintained and linked to each other through mappings. You link your own frameworks yourself.
- ISO/IEC 27001:2022
- NIST CSF 2.0
- NIST SP 800-53
- NIS2
- ICT baseline protection (Switzerland)
- ICT Minimum Standard (Switzerland)
- FINMA Circular 2023/1
- DORA
- Data security under the FADP
Explained step by step: Using mappings between frameworks
Frequently asked questions.
- How are the mappings between the frameworks created?
- The mappings between ISO/IEC 27001 and NIST CSF 2.0 come from NIST’s public catalogue of Online Informative References. NIST itself published the mappings from NIST SP 800-53 to ISO/IEC 27001 and to NIST CSF 2.0, in the same catalogue and as Informative References of CSF 2.0 respectively. We added most of the controls that NIST does not map to the CSF; a few with no relation to the CSF remain unmapped. The mappings of NIS2 and the ICT baseline protection (Switzerland) to the other frameworks are our own expert mapping, as there is no official source. The ICT Minimum Standard (Switzerland) is mapped to CSF 2.0 through NIST’s crosswalk and to ISO/IEC 27001 and NIST SP 800-53 through the references in the standard. Every mapping has a type: equal (both essentially require the same), subset or superset (one requirement is fully contained in the other) or overlapping (they only partly coincide). For equal and contained requirements, one automatically counts as met as soon as the other is met; we only assign these types after a review. Overlapping mappings merely show where one implementation also affects other requirements. You can assess every mapping differently, with a justification.
- Does inherited fulfilment replace the review in the audit?
- No. Inherited fulfilment refers to the evidence of the source; in the audit, every requirement in the target framework is assessed on its own. Especially for statutory frameworks such as NIS2, record in the implementation how the source fulfils the requirement.
- Is applicability transferred too?
- Not automatically. You decide per framework whether a requirement applies to you. When a framework is added, from the Pro plan you can take over applicability including the justification, measures and evidence from existing frameworks – as a deliberate step with a preview that can be undone.
- Which plan includes this?
- You can link custom frameworks yourself in every plan. You use the platform frameworks with their mappings together from the Pro plan (Starter includes ISO/IEC 27001 Annex A). Inherited fulfilment, taking over from existing frameworks, and coverage and delta are included from Pro.
Several frameworks, one ISMS.
Try it free for 30 days with every framework, or let us show you the mappings in a demo.