ISO, NIST, SOC 2, DORA — map your controls once, evidence them everywhere.

Different goals, different audiences. ISO 27001 is a certifiable international ISMS standard — best when customers, regulators or tenders ask for a certificate. NIST CSF 2.0 is a voluntary framework — best as an internal organising model and the default starting point in the US. SOC 2 is an attestation by a CPA firm against the Trust Services Criteria — table stakes for US SaaS selling to mid-market and up. Most mature programmes run ISO + SOC 2 together because the underlying controls overlap by ~80%, and use NIST CSF as the organising language inside.

You can run multiple — and most regulated companies do. The trick is to map each control implementation to every framework reference it satisfies, instead of implementing the same control three times. Lojycal's Control Library is built around that mapping: add MFA-on-everything once, and it satisfies ISO A.5.17 + A.8.5, NIST CSF PR.AA-03, NIST 800-53 IA-2, SOC 2 CC6.1, PCI DSS 8.4, DORA Art. 9 and NIS2 Art. 21 simultaneously.

Practically: ~80% by control count. ISO 27001:2022 Annex A has 93 controls; the SOC 2 Trust Services Criteria has roughly 64 common criteria plus optional categories. A solid majority map one-to-one or one-to-many. Authentication, change management, vulnerability management, incident response, vendor management and logical access are essentially identical in substance — the language differs more than the obligation.

Type I is point-in-time: 'on this date, the controls were designed appropriately'. Type II is operating effectiveness over a period (usually 6–12 months): 'between these dates, the controls operated continuously and were tested by sampling'. Type II is what enterprise buyers ask for. Lojycal's continuous evidence stream gives a Type II auditor a population to sample from instead of forcing your team to reconstruct one each quarter.

Partially. ISO 27001 + ISO 22301 + ISO 27036 cover most of the ICT risk-management surface DORA Art. 5–14 demands, but DORA adds explicit obligations on major-incident classification and reporting, threat-led penetration testing for significant entities, and a structured ICT third-party register that ISO doesn't impose. Lojycal's DORA workspace inherits ISO evidence where it overlaps and adds the DORA-specific artefacts on top.

The AI Act sits on top of GDPR (which applies whenever a model processes personal data) and complements ISO 42001 (the AI management system standard). For high-risk AI systems you need ISO-style risk and quality records, GDPR's data governance and DPIA evidence, and the AI Act's risk tiering, technical documentation, post-market monitoring and serious-incident reporting. Lojycal links each AI system to its GDPR Record of Processing and its ISO control set so the same data governance work counts for all three.

The big change is the new Govern function: a sixth pillar covering organisational context, risk-management strategy, roles, policy, oversight and supply-chain risk. CSF 2.0 also broadens its audience beyond critical infrastructure and adds explicit profiles and tiers guidance. Lojycal's CSF view defaults to 2.0 and surfaces the Govern outcomes alongside the existing five functions.

Yes. The Trust Center → Evidence Pack action bundles the selected control(s), the supporting WORM audit-log entries, the signed configuration snapshots and the period's incident records into a JSON + CSV + PDF bundle with a detached HMAC signature using a per-organisation signing key. Your auditor can verify the bundle independently — no shared screenshot folder, no 'send us a CSV by Friday' email.