Frameworks for your organisation.
20 frameworks for information security, data protection, resilience, quality and AI: an overview of purpose, scope, implementation and evidence.
- Laws · Standards · Methods · Assurance models
- By Derya Altinay
- As of: 10/22/2026
- Reading time: 3 min.
EU law.
- BSIG · Directive (EU) 2022/2555
NIS2
Risk management, reporting and management responsibility for entities in scope in Germany.
- Regulation (EU) 2022/2554
DORA
Digital operational resilience for financial entities in scope and their use of ICT services.
- Regulation (EU) 2024/2847
Cyber Resilience Act
Cybersecurity of products with digital elements and vulnerability handling throughout their lifecycle.
- Regulation (EU) 2024/1689, as amended
EU AI Act
Roles, risk classification and obligations when providing and deploying AI.
- Regulation (EU) 2016/679
GDPR
Lawful processing of personal data, rights, safeguards and accountability.
German standards.
- BSI standards and Compendium
IT-Grundschutz
The BSI methodology for information security management with a defined information domain.
- Cloud Computing Compliance Criteria Catalogue
BSI C5
Cloud security examination of a service, with a report covering a point in time or examination period.
ISO standards.
- Information security management
ISO 27001
Requirements for an ISMS and independent certification of its defined scope.
- Information security controls
ISO 27002
Implementation guidance for selecting security controls and putting them into operation.
- Business continuity management
ISO 22301
A management system for continuing and recovering prioritised services.
- AI management system
ISO 42001
Organisational governance of AI, its risks, impacts and responsibilities.
- Quality management
ISO 9001
A management system for reliable services, customer requirements and continual improvement.
Industries and assurance models.
- ENX · VDA ISA
TISAX
An assessment and exchange mechanism for information security in the automotive supply chain.
- AICPA · Trust Services Criteria
SOC 2
An independent report on a described service system and the selected categories.
- PCI Security Standards Council
PCI DSS
A security standard for handling payment card data and the associated validation procedures.
US frameworks and control catalogues.
- Cybersecurity Framework 2.0
NIST CSF
A common language for cyber risks, target outcomes and organisational profiles.
- Center for Internet Security
CIS Controls
Prioritised security safeguards with Implementation Groups for different operating contexts.
- Security and Privacy Controls
NIST SP 800-53
A control catalogue for selecting security and privacy controls to suit the context.
- Controlled Unclassified Information
NIST SP 800-171
Protection requirements for certain CUI in nonfederal systems and organisations.
- AI Risk Management Framework
NIST AI RMF
A voluntary framework for context-specific AI risk management throughout the lifecycle.
Checks and templates.
- Check
NIS2 applicability
Prepare the classification of your entity under § 28 BSIG.
- Check
NIS2 implementation status
Assess your progress on the ten measures under § 30 BSIG.
- Templates
NIS2 templates
Review existing policies, registers and evidence for your own environment.
Frequently asked questions.
Start with the applicable legal and contractual requirements and your organisation's specific activities. A voluntary management system or implementation guide can structure this work; you still need to examine each framework's scope.
Yes. Responsibilities, processes and evidence may serve several purposes. The objectives, scopes and decisions about evidence must nevertheless remain traceable for each framework.
No. A certificate concerns the conformity of a defined management system, an assurance report describes its particular subject and point in time or period, and a TISAX label belongs to the ENX process. For any evidence, check its scope, issuer and limitations.
First define a specific service, processing activity or product and the person responsible. Then determine the applicable requirements, existing controls and evidence needed; the relevant framework page describes a suitable starting point.
Manage requirements with a clear audit trail.
In Secani, you connect responsibilities, controls and evidence for your framework work.
These pages summarise standards, methods and the legal position. The original documents and the specific circumstances take precedence; the content does not replace legal advice or independent examination.