Platform / Verisq Control Framework

Platform foundation · VCF

One set of objectives under every framework you answer to.

The Verisq Control Framework is the control language under every Hub. Each objective is authored once, graded against each framework clause by clause, and backed by the evidence that proves it. Where a framework is silent, VCF records the absence and the reason.

See the coverage map Already on a framework?

87Normalized objectives

663Authored mappings

339+Deliberate empty cells

Sample dataset loaded (40 objectives, 8 frameworks). Every view below is calculated from the data. Load the VCF export to render all 87 objectives.

40Objectives

10Families

8Frameworks

262Graded mappings

58Recorded absences

How to read VCF

One objective. 8 answers.

Pick any objective to see what must be true, the evidence that proves it, and how each framework treats it, clause by clause.

ObjectiveThis week: Cisco SD-WAN auth bypass exploited

Identity and access

ACC-03 · Strong authentication

Authentication is proportionate to risk, with multi-factor authentication on administrative and remote access.

Typical evidenceAuthentication configuration · MFA coverage report · exception list

6 of 8 frameworks credit this one piece of evidence.

SOC 2Full · CC6.1

ISO 27001Full · A.8.5

NIST CSFFull · PR.AA-03

PCI DSSFull · 8.4

HIPAAPartial · 164.312(d)Addressed in part; narrower than the objective

GDPRPartial · Art. 32Addressed in part; narrower than the objective

EU AI ActAbsentNot addressed at control level

NIST AI RMFAbsentNot addressed at control level

The coverage map

All 40 objectives against all 8 frameworks

Coverage by framework

SOC 2

2884

ISO 27001

3235

NIST CSF

3244

PCI DSS

2695

HIPAA

19147

GDPR

9256

EU AI Act

61915

NIST AI RMF

131512

Objective by objective

Show only objectives with absencesClick a family to open its objectives. Click an objective to read it.

Objective	SOC 2	ISO 27001	NIST CSF	PCI DSS	HIPAA	GDPR	EU AI Act	NIST AI RMF
▸Governance and accountability 4
GOV-01Trust governance structure	CC1.2	5.1	GV.RR-01	12.4	164.308(a)(2)	Art. 24	Art. 17	GOVERN 2.1
GOV-02Policy framework	CC5.3	5.2	GV.PO-01	12.1	164.316	Art. 24(2)		GOVERN 1.2
GOV-03Awareness and role training	CC1.4	A.6.3	PR.AT-01	12.6	164.308(a)(5)	Art. 39(1)(b)	Art. 4	GOVERN 2.2
GOV-04Oversight and reporting	CC1.2	9.3	GV.OV-01	12.4.1	164.308(a)(1)			GOVERN 1.5
▸Risk and decisions 4
RSK-01Risk assessment method	CC3.1	6.1.2	ID.RA	12.3.1	164.308(a)(1)(ii)(A)	Art. 32(2)	Art. 9	MAP 1
RSK-02Risk register and treatment	CC3.2	6.1.3	GV.RM	12.3	164.308(a)(1)(ii)(B)	Art. 32	Art. 9	MANAGE 1
RSK-03Risk acceptance and exceptions	CC3.2	6.1.3(f)	GV.RM-02	12.3.4	164.308(a)(1)			MANAGE 1.3
RSK-04Threat and vulnerability intelligence	CC7.1	A.5.7	ID.RA-02	6.3.1	164.308(a)(1)			MEASURE 2.7
▸Obligations and compliance 3
OBL-01Obligations register	CC2.3	4.2	GV.OC-03	12.5.2	164.316	Art. 5(2)	Art. 16	GOVERN 1.1
OBL-02Scope and asset boundary	CC2.1	4.3	ID.AM-01	12.5.2	164.310(d)	Art. 30	Art. 11	MAP 1.1
OBL-03Regulatory change monitoring	CC2.3	4.2	GV.OC-03	12.4	164.316(b)(2)(iii)	Art. 24(1)	Art. 72	GOVERN 1.1
▸Data and privacy 4
DAT-01Data inventory and classification	C1.1	A.5.9	ID.AM-07	3.1	164.308(a)(1)	Art. 30	Art. 10	MAP 2
DAT-02Encryption and data protection	CC6.7	A.8.24	PR.DS-01	3.5	164.312(a)(2)(iv)	Art. 32(1)(a)
DAT-03Retention and disposal	C1.2	A.8.10	PR.DS-11	3.2.1	164.310(d)(2)	Art. 5(1)(e)
DAT-04Data subject rights	P5.1				164.524	Art. 12–22	Art. 86
▸Identity and access 4
ACC-01Identity lifecycle	CC6.2	A.5.16	PR.AA-01	8.2	164.308(a)(3)(ii)(C)	Art. 32
ACC-02Least privilege and access reviews	CC6.3	A.5.15	PR.AA-05	7.2	164.308(a)(4)	Art. 25
ACC-03Strong authentication	CC6.1	A.8.5	PR.AA-03	8.4	164.312(d)	Art. 32
ACC-04Privileged access	CC6.1	A.8.2	PR.AA-05	7.2.2	164.312(a)(1)	Art. 32
▸Secure operations 5
OPS-01Vulnerability and patch management	CC7.1	A.8.8	ID.RA-01	6.3	164.308(a)(1)(ii)(B)	Art. 32(1)(d)	Art. 15
OPS-02Secure configuration	CC6.8	A.8.9	PR.PS-01	2.2	164.312(c)	Art. 32
OPS-03Logging and monitoring	CC7.2	A.8.15	DE.CM-01	10.2	164.312(b)	Art. 32	Art. 12	MEASURE 3.1
OPS-04Change management	CC8.1	A.8.32	PR.PS-02	6.5.1			Art. 43(4)	MANAGE 2
OPS-05Malware and endpoint protection	CC6.8	A.8.7	DE.CM-09	5.2	164.308(a)(5)(ii)(B)	Art. 32
▸Third parties and supply chain 4
TPR-01Vendor due diligence	CC9.2	A.5.19	GV.SC-06	12.8	164.308(b)	Art. 28(1)	Art. 25	GOVERN 6.1
TPR-02Contractual terms	CC9.2	A.5.20	GV.SC-05	12.8.2	164.314(a)	Art. 28(3)	Art. 25(4)	GOVERN 6.1
TPR-03Continuous vendor monitoring	CC9.2	A.5.22	GV.SC-07	12.8.4	164.308(b)	Art. 28(3)(h)		MANAGE 3.1
TPR-04Software supply chain	CC8.1	A.5.21	GV.SC-04	6.3.2			Art. 15	MAP 4.1
▸Resilience and response 4
RES-01Incident response	CC7.4	A.5.24	RS.MA-01	12.10	164.308(a)(6)	Art. 33	Art. 73	MANAGE 4.3
RES-02Breach notification	CC2.3	A.5.26	RS.CO-02	12.10.1	164.404–410	Art. 33	Art. 73	MANAGE 4.3
RES-03Backup and recovery	A1.2	A.8.13	PR.DS-11	12.10	164.308(a)(7)(ii)(A)	Art. 32(1)(c)
RES-04Continuity testing	A1.3	A.5.30	RC.RP-01	12.10.2	164.308(a)(7)(ii)(D)	Art. 32(1)(d)
▸AI and automated decisions 4
AIG-01AI inventory and risk classification			ID.AM-02			Art. 35	Art. 6	MAP 1.1
AIG-02Human oversight of automated decisions						Art. 22	Art. 14	MANAGE 2.4
AIG-03AI transparency						Art. 13(2)(f)	Art. 13	MEASURE 2.9
AIG-04AI data quality and bias testing						Art. 5(1)(d)	Art. 10	MEASURE 2.11
▸Assurance and evidence 4
ASR-01Evidence collection	CC4.1	7.5	ID.IM-01	10.5	164.316(b)	Art. 5(2)	Art. 18	GOVERN 1.4
ASR-02Control testing and internal audit	CC4.1	9.2	ID.IM-02	11.4	164.308(a)(8)	Art. 32(1)(d)	Art. 17	MEASURE 1.3
ASR-03Corrective action	CC4.2	10.2	ID.IM-03	12.4.2	164.308(a)(1)		Art. 20	MANAGE 4.2
ASR-04External assurance and disclosure	CC2.3	7.4	GV.OC-02	12.9		Art. 28(3)(h)	Art. 47	GOVERN 4.3

Full, clause shownPartialDeliberately absent, with a reasonTested by this week's feed

What the map shows

Three things most programs learn the hard way

ISO 27001 and NIST CSF overlap almost completely

Both fully address the same 30 objectives. Evidence for one is most of the work for the other.

Security frameworks leave AI to you

4 of 4 security frameworks address none of the 4 AI objectives. Passing those audits says nothing about your AI controls.

15 objectives form a common core

Every framework on the map addresses these, fully or partly. Get them right first: GOV-01, GOV-03, RSK-01, RSK-02, OBL-01, OBL-02 and more.

Already on a framework?

See how far one framework takes you toward another

Already on→Moving to

100%35 of 35 ISO 27001 objectives are already covered by your SOC 2 evidence

What is left to do (0)

Nothing. Your evidence covers it.

Framework crosswalk

	SOC 2	ISO 27001	NIST CSF	PCI DSS	HIPAA	GDPR	EU AI Act	NIST AI RMF
SOC 2	36	35	35	35	33	30	21	24
ISO 27001	35	35	35	35	32	29	20	24
NIST CSF	35	35	36	35	32	30	21	25
PCI DSS	35	35	35	35	32	29	20	24
HIPAA	33	32	32	32	33	29	18	21
GDPR	30	29	30	29	29	34	22	22
EU AI Act	21	20	21	20	18	22	25	23
NIST AI RMF	24	24	25	24	21	22	23	28

Objectives both frameworks address, fully or partly. The diagonal is each framework's own total.

The frameworks

What each one covers, and what it leaves to you

SOC 236 of 40 addressed

28full8partial4absent

Complete onGovernance and accountability; Identity and access; Secure operations; Assurance and evidence

Silent onAI and automated decisions

ISO 2700135 of 40 addressed

32full3partial5absent

Complete onGovernance and accountability; Risk and decisions; Obligations and compliance; Identity and access; Secure operations

Silent onAI and automated decisions

NIST CSF36 of 40 addressed

32full4partial4absent

Complete onGovernance and accountability; Risk and decisions; Obligations and compliance; Identity and access; Secure operations; Third parties and supply chain; Resilience and response

Silent onNothing entirely

PCI DSS35 of 40 addressed

26full9partial5absent

Complete onIdentity and access; Secure operations; Third parties and supply chain

Silent onAI and automated decisions

HIPAA33 of 40 addressed

19full14partial7absent

Complete onResilience and response

Silent onAI and automated decisions

GDPR34 of 40 addressed

9full25partial6absent

Complete onNo family in full

Silent onNothing entirely

EU AI Act25 of 40 addressed

6full19partial15absent

Complete onAI and automated decisions

Silent onIdentity and access

NIST AI RMF28 of 40 addressed

13full15partial12absent

Complete onAI and automated decisions

Silent onIdentity and access

The families

Everything a trust program has to achieve, in 10 parts

A red dot marks an objective this week's threat feed is testing.

Governance and accountabilityGOV · 4

GOV-01Trust governance structure
GOV-02Policy framework
GOV-03Awareness and role training
GOV-04Oversight and reporting

Risk and decisionsRSK · 4

RSK-01Risk assessment method
RSK-02Risk register and treatment
RSK-03Risk acceptance and exceptions
RSK-04Threat and vulnerability intelligence

Obligations and complianceOBL · 3

OBL-01Obligations register
OBL-02Scope and asset boundary
OBL-03Regulatory change monitoring

Data and privacyDAT · 4

DAT-01Data inventory and classification
DAT-02Encryption and data protection
DAT-03Retention and disposal
DAT-04Data subject rights

Identity and accessACC · 4

ACC-01Identity lifecycle
ACC-02Least privilege and access reviews
ACC-03Strong authentication
ACC-04Privileged access

Secure operationsOPS · 5

OPS-01Vulnerability and patch management
OPS-02Secure configuration
OPS-03Logging and monitoring
OPS-04Change management
OPS-05Malware and endpoint protection

Third parties and supply chainTPR · 4

TPR-01Vendor due diligence
TPR-02Contractual terms
TPR-03Continuous vendor monitoring
TPR-04Software supply chain

Resilience and responseRES · 4

RES-01Incident response
RES-02Breach notification
RES-03Backup and recovery
RES-04Continuity testing

AI and automated decisionsAIG · 4

AIG-01AI inventory and risk classification
AIG-02Human oversight of automated decisions
AIG-03AI transparency
AIG-04AI data quality and bias testing

Assurance and evidenceASR · 4

ASR-01Evidence collection
ASR-02Control testing and internal audit
ASR-03Corrective action
ASR-04External assurance and disclosure

VCF

VCF runs through every Hub

Compliance evidence, vendor answers, risk signals, privacy records and Trust Center claims all map to the same objectives.

Compliance Vendor risk RiskOps

One set of objectives under every framework you answer to.

One objective. 8 answers.

ACC-03 · Strong authentication

All 40 objectives against all 8 frameworks

Coverage by framework

Objective by objective

Three things most programs learn the hard way

ISO 27001 and NIST CSF overlap almost completely

Security frameworks leave AI to you

15 objectives form a common core

See how far one framework takes you toward another

Framework crosswalk

What each one covers, and what it leaves to you

Everything a trust program has to achieve, in 10 parts

See it running on today's threats.