Explore laws, practice frameworks, sector standards and assurance reports on their own terms. Then dive into the ISO/IEC family map. Select any node for a useful preview and open its full, source-checked guide.
Selected reference / EU directive and Dutch implementing law
NIS2 / Dutch Cyberbeveiligingswet: Cyber resilience for essential and important services
NIS2 sets a common EU floor for cyber risk management and incident reporting across critical sectors. Dutch organizations should assess their duties under the Cyberbeveiligingswet (Cbw), which implements the directive locally; the directive alone is not a universal certification scheme.
Who or what is in scope
The EU directive covers defined entity types in Annexes I and II, normally subject to a size test, with important exceptions for some services and entities. Dutch Cbw scope depends on the activity, size, designation and sector rules. Covered organizations are classed as essential or important and should confirm their status rather than infer it from an industry label.
What this does not prove
NIS2 is a directive, so national implementation and sector-specific rules matter. A company's ISO/IEC 27001 certificate, supplier questionnaire or sector membership cannot by itself establish Cbw applicability or legal compliance. Where DORA provides equivalent sector-specific ICT duties for a financial entity, the DORA route takes precedence for those duties; check the applicable supervisory and reporting route.
Current status: EU Directive 2022/2555; in the Netherlands, the Cyberbeveiligingswet has applied since 15 August 2026.
Selected reference / EU directive and Dutch implementing law
NIS2 / Dutch Cyberbeveiligingswet: Cyber resilience for essential and important services
NIS2 sets a common EU floor for cyber risk management and incident reporting across critical sectors. Dutch organizations should assess their duties under the Cyberbeveiligingswet (Cbw), which implements the directive locally; the directive alone is not a universal certification scheme.
Who or what is in scope
The EU directive covers defined entity types in Annexes I and II, normally subject to a size test, with important exceptions for some services and entities. Dutch Cbw scope depends on the activity, size, designation and sector rules. Covered organizations are classed as essential or important and should confirm their status rather than infer it from an industry label.
What this does not prove
NIS2 is a directive, so national implementation and sector-specific rules matter. A company's ISO/IEC 27001 certificate, supplier questionnaire or sector membership cannot by itself establish Cbw applicability or legal compliance. Where DORA provides equivalent sector-specific ICT duties for a financial entity, the DORA route takes precedence for those duties; check the applicable supervisory and reporting route.
Current status: EU Directive 2022/2555; in the Netherlands, the Cyberbeveiligingswet has applied since 15 August 2026.
NIST Cybersecurity Framework 2.0: Organize cyber risk around outcomes
A common language for deciding which cybersecurity outcomes matter to an organization, how far current practice reaches and where to invest next.
Who or what is in scope
Any organization can use CSF 2.0 across business units, suppliers, services and technology environments. The scope of a working profile should be stated explicitly.
What this does not prove
The six functions describe outcomes, not a universal technical checklist. NIST does not certify or endorse a CSF implementation. A crosswalk to a regulation or control catalog does not establish compliance.
Current status: CSF 2.0 was published in February 2024. NIST provides a live reference tool, profile templates and quick-start guides alongside the core publication.
Selected reference / Directly applicable EU regulation
DORA: Digital operational resilience in EU finance
DORA gives EU financial entities a common operating framework for ICT risk, major incidents, resilience testing and ICT third-party dependencies. Its core question is whether a financial service can remain dependable through serious technology disruption.
Who or what is in scope
Article 2 lists the financial entities and exclusions. Financial entities carry the main resilience duties; ICT third-party providers have contract obligations, while providers formally designated critical face the separate EU oversight framework. The obligations are proportionate to an entity's size, risk profile and activities, with specific simplified provisions for certain categories.
What this does not prove
DORA is law, not a certification. The most advanced threat-led penetration testing applies to selected entities, not every firm. A third-party contract does not transfer the financial entity's responsibility. For covered financial entities, DORA is the sector-specific ICT regime in its overlap with NIS2; GDPR duties for personal data continue separately.
Current status: Regulation (EU) 2022/2554 has applied since 17 January 2025; detailed delegated rules also apply.
Selected reference / Directly applicable EU regulation
GDPR / AVG: Govern personal data throughout its lifecycle
The GDPR governs how organizations process personal data and how people can exercise their rights. Security is one part of a wider accountability model that also covers purpose, lawful basis, transparency, minimization, retention, processors and international transfers.
Who or what is in scope
It applies to processing in the context of an EU establishment and can also reach non-EU organizations that offer goods or services to, or monitor the behavior of, people in the EU. The duties differ for controllers and processors and depend on the type and risk of processing; some rules have specific thresholds or exceptions.
What this does not prove
Consent is one possible lawful basis, not a universal requirement or a cure for every processing activity. GDPR is not an information-security certificate: ISO/IEC 27001 or 27701 can help organize controls and evidence, but neither proves that a particular use of personal data is lawful. A security incident is reportable under GDPR only when it is a personal-data breach meeting the relevant risk test.
Current status: Regulation (EU) 2016/679 has applied since 25 May 2018; Dutch organizations commonly call it the AVG.
A practical set of defensive actions for reducing common attack paths, with Implementation Groups that help teams sequence the work.
Who or what is in scope
Useful to security and IT operators in organizations of different sizes. Applicability and the chosen Implementation Group depend on risk, resources and the assets in scope.
What this does not prove
CIS Controls are distinct from product-specific CIS Benchmarks. Implementing a safeguard or using a CIS crosswalk does not by itself satisfy PCI DSS, NIS2, DORA or another obligation.
Current status: Version 8.1 is CIS's current published Controls release. It retains 18 Controls and 153 Safeguards while refreshing asset-class language and alignment with NIST CSF 2.0.
The payment industry's technical and operational baseline for environments that handle payment account data or can affect the security of that environment.
Who or what is in scope
Relevant to merchants, service providers and other entities that store, process or transmit cardholder data or sensitive authentication data, or can affect the cardholder data environment.
What this does not prove
The payment brands and acquirers set validation and reporting obligations. An outsourced payment flow does not automatically remove all scope. PCI SSC does not recognize informal 'PCI compliance certificates' as validation evidence.
Current status: PCI SSC published v4.0.1 in June 2024 as a limited clarification release. PCI DSS v4.0 retired at the end of 2024; the future-dated v4.x requirements became effective on 31 March 2025.
A CPA examination of a service organization's system description and controls against selected Trust Services Criteria, delivered as an assurance report.
Who or what is in scope
Most useful to customers and partners assessing the specific services, systems, commitments and trust categories covered by a service provider's report.
What this does not prove
SOC 2 is a report, not a product or organization-wide certification. The report's type, scope, dates, opinion, exceptions, excluded subservice organizations and customer responsibilities all affect what can be concluded.
Current status: SOC 2 uses AICPA's 2017 Trust Services Criteria with revised 2022 points of focus and 2018 Description Criteria with revised 2022 implementation guidance. The report is scoped to a named system and reporting period or date.
Selected reference / Dutch healthcare standard with legal relevance
NEN 7510: Information security for Dutch healthcare
NEN 7510 adapts information security management to Dutch healthcare and the protection of personal health information. Part 1 frames the management system; Part 2 addresses controls and healthcare-specific application. Dutch healthcare law and the IGJ's supervision make demonstrable use of the norm important for care providers.
Who or what is in scope
IGJ says care providers that process data in a care information system must arrange information security according to NEN 7510 under the Wabvpz, even when they fall outside the Dutch Cyberbeveiligingswet. Other parties handling personal health information, including suppliers, should assess their role, contracts and applicable duties. Jeugdhulp organizations have a distinct Jeugdwet route that IGJ describes through ISO 27001.
What this does not prove
NEN 7510 is a standard, not the GDPR or Cbw itself. Certification is optional even when demonstrable conformance is required; an independent assessment can also provide evidence. Its alignment with ISO/IEC 27001 and 27002 is helpful, but a generic ISO certificate does not automatically cover healthcare-specific risks, legal duties or the right certification scope. Check the current Part 2 amendment and any applicable certification transition.
Current status: Current catalogue editions: NEN 7510-1:2024 for the management system and NEN 7510-2:2024+A1:2026 for controls.
CSA Cloud Controls Matrix v4.1: Make cloud controls and responsibility visible
A cloud-focused control framework and assessment language that helps providers and customers examine control design, shared responsibility and service assurance.
Who or what is in scope
Cloud service providers, cloud customers, assessors and procurement teams can use the matrix for a specific service and deployment model.
What this does not prove
The matrix is not a stand-alone legal compliance claim or automatic certification. CAIQ self-assessment and third-party STAR attestation or certification have different assurance levels. Use the dedicated STAR Level 1 CAIQ for registry submission, not the reference copy bundled with the matrix.
Current status: CSA released CCM and CAIQ v4.1 in January 2026. The current matrix contains 207 controls across 17 domains; STAR accepts v4.1 submissions during its published transition.
No other map cards match this view. Try another term or All areas.
Selected standard / Requirements
ISO/IEC 27001:2022 + Amd 1:2024: The ISMS requirements
ISO/IEC 27001 establishes the requirements for running and continually improving an ISMS. Its management system clauses frame governance and risk treatment, while Annex A provides 93 reference controls to check for possible omissions.
Where it fits
This is the certifiable ISMS anchor; organizations determine necessary controls through risk treatment and compare them with Annex A rather than implementing all 93 automatically.
Who uses it
Executive sponsors, ISMS owners, risk owners, control owners and certification candidates
Edition check: The current published requirements edition is 2022; Amendment 1:2024 adds the climate action changes.
ISO/IEC 27000:2026: The information security management map
This is the entry point to the information security management system (ISMS) family. It helps readers understand why the family has separate documents for requirements, controls, risk, measurement and assurance.
Where it fits
Use it to orient the reader before moving to ISO/IEC 27001 requirements or specialist guidance; it does not itself set ISMS requirements.
Who uses it
Leaders, new ISMS owners, buyers and teams comparing standards
Edition check: The 2026 sixth edition replaces the 2018 edition and focuses on ISMS concepts and relationships, rather than serving primarily as a vocabulary document.
ISO/IEC 27001:2022 + Amd 1:2024: The ISMS requirements
ISO/IEC 27001 establishes the requirements for running and continually improving an ISMS. Its management system clauses frame governance and risk treatment, while Annex A provides 93 reference controls to check for possible omissions.
Where it fits
This is the certifiable ISMS anchor; organizations determine necessary controls through risk treatment and compare them with Annex A rather than implementing all 93 automatically.
Who uses it
Executive sponsors, ISMS owners, risk owners, control owners and certification candidates
Edition check: The current published requirements edition is 2022; Amendment 1:2024 adds the climate action changes.
ISO/IEC 27002:2022: Guidance for security controls
ISO/IEC 27002 helps teams interpret and implement information security controls. It gives more operational depth to the control references used alongside ISO/IEC 27001 risk treatment.
Where it fits
Use it when designing or improving controls selected for an ISMS; ISO/IEC 27002 itself is not an organization certification standard.
Who uses it
Control owners, security architects, operations teams and internal auditors
Edition check: The current third edition was published in 2022; its 93 controls are organized into organizational, people, physical and technological themes.
This document helps organizations reason through the work of establishing and operating an ISMS. It is useful as implementation context when roles, scope, processes and improvement activity need to be made concrete.
Where it fits
It supports the ISMS requirements in ISO/IEC 27001, but the current published text was written for the superseded 2013 requirements edition.
Who uses it
ISMS programme leads, process owners and implementation advisers
Edition check: The 2017 edition is still published but explains ISO/IEC 27001:2013; a replacement draft aligned to the 2022 edition is under development.
ISO/IEC 27004:2016: Measure whether security works
ISO/IEC 27004 focuses on monitoring, measurement and evaluation of information security performance and ISMS effectiveness. It encourages useful measures tied to decisions, rather than collecting metrics simply because they are easy to count.
Where it fits
It supports the performance evaluation work in ISO/IEC 27001, with an edition-alignment check needed when using it beside 27001:2022.
Who uses it
ISMS owners, service owners, security operations and management reviewers
Edition check: The 2016 edition remains published and refers to ISO/IEC 27001:2013; a replacement draft is under development.
ISO/IEC 27005:2022: Manage information security risk
ISO/IEC 27005 helps teams identify, assess, treat and revisit information security risks. It connects risk decisions to the controls and management attention needed inside an ISMS.
Where it fits
It is specialist risk-management guidance supporting ISO/IEC 27001, not a separate set of certifiable ISMS requirements.
Who uses it
Risk owners, ISMS leads, architects and service owners
Edition check: The current fourth edition was published in 2022.
Selected standard / Certification-body requirements
ISO/IEC 27006-1:2024: Trust the ISMS certifier
This standard adds ISMS-specific requirements for bodies that audit and certify organizations against ISO/IEC 27001. Its purpose is to make those certification decisions competent, consistent and impartial.
Where it fits
It governs the certification body rather than adding requirements to the organization seeking a 27001 certificate.
Who uses it
Certification bodies, accreditation bodies and buyers evaluating certificate assurance
Edition check: The 2024 Part 1 edition replaces the withdrawn ISO/IEC 27006:2015 reference.
ISO/IEC 27007 helps plan and conduct audits of an ISMS and consider auditor competence. It focuses on how to examine the management system, including whether its processes work in the defined scope.
Where it fits
It supports internal and external audits of an ISO/IEC 27001 ISMS and sits alongside, rather than replacing, the certifier rules in 27006-1.
Who uses it
Internal auditors, audit programme owners and external ISMS auditors
Edition check: The 2020 third edition remains published; a replacement draft is under development.
ISO/IEC TS 27008:2019: Assess controls in operation
ISO/IEC TS 27008 guides the assessment of information security controls, including technical checks where appropriate. It helps reviewers move from a documented control design to evidence about implementation and operation.
Where it fits
It deepens control-level assessment for an ISMS and complements the ISMS-wide audit approach of 27007.
Who uses it
Control assessors, technical auditors, security engineers and assurance teams
Edition check: The current 2019 publication is a Technical Specification (TS), with a revision under development; it is not designated simply ISO/IEC 27008.
ISO/IEC 27017:2026: Security across the cloud boundary
ISO/IEC 27017 adds cloud-specific direction for security controls used by cloud service customers and providers. It is especially useful where responsibility for access, infrastructure, monitoring or response is divided between parties.
Where it fits
Use it to adapt ISO/IEC 27002-based controls to cloud services within a risk-led ISO/IEC 27001 programme.
Who uses it
Cloud customers, cloud providers, platform teams, architects and supplier managers
Edition check: The 2026 second edition replaces the withdrawn 2015 edition and is based on ISO/IEC 27002 control guidance.
ISO/IEC 27035-1:2023, -2:2023, -3:2020: Prepare, respond and learn
The 27035 series connects incident preparation with detection, assessment, response and learning. Its parts let a team distinguish the overall process, readiness work and operational ICT response.
Where it fits
It provides specialist incident-management guidance that can support response-related controls and improvement within an ISO/IEC 27001 ISMS.
Who uses it
Incident managers, security operations, service owners and crisis coordinators
Edition check: The incident-management series has separate current parts: 2023 principles and process, 2023 response preparation, and 2020 ICT response operations.
ISO/IEC 27036-1:2021, -2:2022, -3:2023, -4:2016: Security in supplier relationships
The 27036 series addresses information security across the relationship between buyers and suppliers. It covers both routine service arrangements and harder-to-see exposures in hardware, software, service and cloud supply chains.
Where it fits
Use it to develop supplier risk and control decisions inside an ISO/IEC 27001 ISMS; Part 2 specifies supplier-relationship requirements but does not replace 27001 certification.
Who uses it
Procurement, supplier managers, product teams, security architects and risk owners
Edition check: The series has four separately published parts: concepts, relationship requirements, supply-chain guidance and cloud-service relationship guidance; Part 4 remains the confirmed 2016 edition.
ISO/IEC 27090:2026: Protect AI systems from compromise
ISO/IEC 27090 considers security threats to AI systems across their life cycle, including attacks on data, models and their use. It helps teams connect possible compromise to detection and mitigation choices while retaining ordinary cybersecurity foundations.
Where it fits
It complements 27001 and 27002 security practices; 42001 addresses the wider organizational management of AI.
Who uses it
AI developers, AI service buyers, cybersecurity teams, data owners and AI governance leads
Edition check: First edition published on 14 October 2026, confirmed by both ISO and IEC.
ISO/IEC 42001:2023: Govern AI as a management system
ISO/IEC 42001 specifies requirements for managing AI responsibilities, risks and opportunities across an organization. It addresses policies, processes and improvement for organizations that develop, provide or use AI systems.
Where it fits
It is an adjacent AI management-system requirements standard; 27090 narrows in on security threats to AI systems, while 27001 covers information security management.
Who uses it
AI governance leaders, executives, product owners, risk teams and AI service providers
Edition check: The first edition of the AI management-system standard was published in 2023.
ISO/IEC 27701:2025: Manage personal information responsibly
ISO/IEC 27701 specifies a management approach for organizations acting as controllers or processors of personally identifiable information. It helps align privacy responsibilities, decisions and improvement across the information life cycle.
Where it fits
It can be integrated with an ISMS but stands as its own management-system standard; it is a useful bridge to future legal and privacy-framework pages.
Who uses it
Privacy officers, data controllers, processors, ISMS owners and supplier managers
Edition check: The 2025 second edition replaces 27701:2019 and is an independent privacy information management-system (PIMS) standard, no longer only an extension of 27001 and 27002.
Requirements, guidance and assurance play different roles
01 / Manage
Start with the management system
27001 sets ISMS requirements. Risk decisions, scope, ownership and evidence make the system real. Annex A is a reference set, not a universal implement-everything checklist.
02 / Apply
Use guidance for the problem at hand
27002, 27005 and specialist standards support control design, risk work, cloud services, incidents, suppliers and AI. Guidance does not automatically create a new certification claim.
03 / Verify
Test what actually operates
Measurement, internal audit and control assessment reveal whether decisions work. 27006-1 is written for certification bodies, while 27007 and TS 27008 guide different assessment activities.
Scope note
This is a curated subset and original interpretation of public catalogue information. The full standards are copyrighted, and some require purchase; see ISO copyright guidance. Read the official edition before making a conformity, certification or legal claim.
Use the maps together
A mapping starts the work; evidence finishes it.
An ISO/IEC control can support an obligation or a framework outcome, but a mapping alone does not establish legal compliance, card-industry validation or a positive audit opinion. Confirm the scope and current source text, then test what operates.