Map once, comply with many.
RiskVantis relates every framework through the Secure Controls Framework, so a control, risk or artefact mapped once contributes everywhere it applies.
Secure Controls Framework (SCF)
The common control set RiskVantis uses to relate requirements across every other framework.
ISO/IEC 27001:2022
Information security management systems: clauses and Annex A, with the ISMS self-assessment.
ISO/IEC 27002:2022
Control guidance included in the ISMS self-assessment.
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond and Recover functions.
PCI DSS v4.0.1
Payment card data security, including the requirement-level self-assessment.
SOC 2 Type II
AICPA Trust Services Criteria for service organisations.
HIPAA Security Rule
US safeguards for electronic protected health information.
HIPAA Privacy Rule
US rules on uses and disclosures of protected health information.
GDPR
EU General Data Protection Regulation, with an EU GDPR DPIA methodology.
UK GDPR
UK GDPR and the Data Protection Act 2018, with a UK GDPR DPIA methodology.
CCPA/CPRA
California privacy law as amended by the CPRA, with a risk-assessment methodology.
DPDP Act 2023
India's Digital Personal Data Protection Act, with a DPIA methodology.
NIS2 Directive
EU cybersecurity obligations for essential and important entities.
EU Cyber Resilience Act
EU security requirements for products with digital elements.
EU AI Act
EU rules for AI systems (Regulation (EU) 2024/1689).
ISO/IEC 42001
AI management systems, including AI agent governance and readiness.
NYDFS 23 NYCRR 500
New York cybersecurity requirements for financial services.
APRA CPS 234
Australian prudential standard for information security.
CMMC 2.0
US Cybersecurity Maturity Model Certification practices.
European Health Data Space (EHDS)
EU regulation on electronic health data (Regulation (EU) 2025/327).
ITGC
IT general controls for financial reporting and internal audit.
Your own frameworks, including DORA
Load DORA or any other regulation, internal standard or contractual requirement into the Framework Library, or import it from Excel, and map it to your controls.
Framework names are trademarks of their respective owners. RiskVantis supports your compliance activities; certification decisions rest with your auditors and assessors.
See RiskVantis in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.