the map
one control, many rulebooks
The same nine jobs answer NIS2, DORA, GDPR, the AI Act, ISO 27001 and SOC 2. Do each once, keep the proof once, and point every rule at it.
nine pieces of work, six rulebooks
articles and evidence
- NIS2
- Art. 20(1)
- DORA
- Art. 5(2)
- GDPR
- Art. 24(1)
- ISO 27001
- clause 5.1
- SOC 2
- CC1.2
- leaves
- signed minutes, a yearly report to the board
articles and evidence
- NIS2
- Art. 21(2)(a)
- DORA
- Art. 6(1)
- GDPR
- Art. 32(1)
- ISO 27001
- clause 6.1.2
- SOC 2
- CC3.2
- leaves
- risk register with owners and dates
articles and evidence
- NIS2
- Art. 21(2)(i)
- DORA
- Art. 8(1)
- GDPR
- Art. 30(1)
- ISO 27001
- A.5.9
- SOC 2
- CC6.1
- leaves
- asset list, record of processing
articles and evidence
- NIS2
- Art. 21(2)(b), Art. 23(4)
- DORA
- Art. 17(1), Art. 19(1)
- GDPR
- Art. 33(1), Art. 33(5), Art. 34(1)
- AI Act
- Art. 26(5)
- ISO 27001
- A.5.24, A.5.26
- SOC 2
- CC7.3, CC7.4
- leaves
- incident log, filed notifications, post-incident review
articles and evidence
- NIS2
- Art. 21(2)(d), Art. 21(3)
- DORA
- Art. 28(3), Art. 30(2)
- GDPR
- Art. 28(1), Art. 28(3)
- ISO 27001
- A.5.19, A.5.20
- SOC 2
- CC9.2
- leaves
- supplier list, contract clauses, assessment records
articles and evidence
- NIS2
- Art. 21(2)(i), Art. 21(2)(j)
- DORA
- Art. 9(4)(c), Art. 9(4)(d)
- GDPR
- Art. 32(1)(b)
- ISO 27001
- A.5.15, A.5.18, A.8.2, A.8.5
- SOC 2
- CC6.1, CC6.3
- leaves
- admin list, MFA report, review sign-offs, exception list
articles and evidence
- NIS2
- Art. 21(2)(c)
- DORA
- Art. 11(1), Art. 12(1)
- GDPR
- Art. 32(1)(c)
- ISO 27001
- A.5.30, A.8.13
- SOC 2
- A1.2, A1.3
- leaves
- restore test record, recovery plan with its test date
articles and evidence
- NIS2
- Art. 20(2), Art. 21(2)(g)
- DORA
- Art. 13(6)
- GDPR
- Art. 39(1)(b)
- AI Act
- Art. 4
- ISO 27001
- A.6.3
- SOC 2
- CC1.4
- leaves
- attendance records with dates and content
articles and evidence
- NIS2
- Art. 21(2)(e), Art. 21(2)(f)
- DORA
- Art. 24(1), Art. 25(1)
- GDPR
- Art. 32(1)(d)
- ISO 27001
- A.8.8, clause 9.2
- SOC 2
- CC4.1, CC7.1
- leaves
- scan results, patch records, a dated review of the controls
- the text asks for this directly
- a reasonable link, an interpretation
- no direct duty found
basis articles listed per row. ISO 27001 and SOC 2 numbers were not re-read at source.
how far the overlap goes
An overlap means the same work helps with each rule. It does not mean that doing it for one rule automatically satisfies another, because the rules differ in detail: the DORA register asks for more than a NIS2 supplier list, for example.
The practical move is to build to the strictest rule that applies to you, then reuse the result. Then give each row one owner, because a row with three owners has none.
basis NIS2 Art. 21(2); DORA Art. 28(3); GDPR Art. 32(1). Ownership is practice.
what makes it reusable
from a control to an answer
- 1the control runsan access review, a restore test, a board decision
- 2it leaves a recorda dated export, a signed sheet, a minute
- 3an owner checks ita named person, on a set rhythm
- 4it gets filedone place, named by date and control
the same file answers
- your boardwhat did we decide, and is it running?
- an auditorshow me the last one
- a regulatorwere your measures appropriate?
- a customerthe security questionnaire
basis GDPR Art. 5(2), 24(1); NIS2 Art. 21(2)(f)
check it yourself
ISO/IEC 27001 is a paid document and the AICPA criteria are gated. Their numbers on this page are the commonly published ones and were not re-read at source, so check them against your licensed copy or with your auditor.
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Regulation (EU) 2024/1689 (AI Act), original text (EUR-Lex)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending the AI Act (EUR-Lex)
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.