How findings map to DORA and ISO 27001

One weakness, three vocabularies. Your NIS2 auditor asks about Article 21(2)(j). A prospective customer's security questionnaire asks which ISO 27001:2022 Annex A controls you operate. If you are a financial-sector entity or you supply one, a DORA reviewer asks about Article 9. All three are asking about the same thing: whether people in your organisation prove who they are with more than a password.

Findings and controls in this platform carry the mappings so that you can answer each question in its own language without re-deriving the answer each time. This article explains what those mappings are, and — more importantly — what they do not entitle you to say.

How a single finding carries its mappings

Every posture check carries a list of framework references, and they appear on the finding itself rather than in a separate crosswalk document that drifts out of date. This is a real check, rendered the way the product renders it:

Four references, each usable directly in the document that asks for it. The severity on this check is not fixed, incidentally: where half the organisation or more is unprotected, it is raised to critical, on the reasoning that this then stops being one item on a list and becomes the organisation's defining weakness.

The NIS2 to ISO 27001:2022 Annex A mapping

The catalogue-level mapping is held as version-controlled data alongside the code, so it changes by review rather than by someone editing a spreadsheet. Its stated sources are ENISA's NIS2 control mapping guide and ISO/IEC 27001:2022 — cite those rather than citing us, because an auditor will accept ENISA and has no reason to accept a vendor's crosswalk on trust.

Two observations that will save you an awkward exchange. First, the mapping is not symmetric: it tells you which Annex A controls a NIS2 measure corresponds to, and it does not tell you that operating those Annex A controls satisfies the NIS2 measure. A.8.5 being in place does not by itself discharge Article 21(2)(j) for your estate. Second, Annex A is 93 controls and this mapping touches fourteen of them. Anyone reading the mapping as your Statement of Applicability is reading it wrongly, and it is your job to say so before they do.

A SOC 2 mapping is held in the same form, with 14 entries. It is a smaller and blunter crosswalk than the ISO one, and it is useful for answering the trust-services questions on an American customer's questionnaire rather than for anything a SOC 2 auditor would rely on.

DORA: the articles findings cite

Posture findings reference three DORA articles, and each one covers a different phase of the same lifecycle.

Article 9 — Protection and prevention

Cited by findings about how access is granted and how identity is proven: multi-factor coverage, administrative accounts, privileged access. If a finding names a person's sign-in, it is usually an Article 9 finding.

Article 10 — Detection

Cited by findings about whether anything is watching: audit logging switched off, detection coverage, alerting on anomalous activity. The check "Nothing is recording what happens in your Microsoft 365" cites NIS2 Art 21(2)(f), NIS2 Art 23, GDPR Art 33, ISO 27001 A.8.15 and DORA Art 10 in a single finding, which is a fair illustration of how much regulatory weight one disabled audit log carries.

Article 12 — Backup, restoration and recovery

Cited by findings about retention and recoverability — whether the record you would need after an incident will still exist when you look for it.

The DORA section of the evidence bundle holds the ICT third-party vendor register and a concentration view over it. The concentration view is the part reviewers actually interrogate: it shows where your dependency is clustered, which is the question DORA is fundamentally about. A register listing forty vendors of which one underpins everything is a different risk from forty independent ones, and only the concentration view makes that visible.

Using a mapping honestly in a questionnaire

1. 1

   Answer in the framework the question was asked in

   If the questionnaire asks about A.8.24, answer about cryptography — TLS 1.2 minimum with 1.3 preferred in transit, AES-256-GCM at rest for privileged credential vaults using envelope encryption with a per-vault data key and the key-encrypting key in a managed key service. Do not answer by explaining NIS2. The reviewer is filling in a grid.

2. 2

   Attach the evidence, not the mapping

   The mapping tells the reviewer where to look. The stamped evidence bundle is what shows the control operating during a stated window. A crosswalk with nothing behind it is the answer most likely to trigger a follow-up call. See The evidence bundle.

3. 3

   Distinguish what the platform evidences from what your organisation does

   The platform can evidence detection coverage, privileged action audit trails, multi-factor enrolment and vendor register contents. It cannot evidence that you rehearsed a restore, that your staff completed training, or that a policy was read by anyone. Where a control depends on human activity, say so and attach your own artefact.

4. 4

   Name the granularity you are citing

   "This finding tags ISO 27001 A.5.17" and "the NIS2 control catalogue maps A21-10 to A.8.5" are both true and they are different statements. Being explicit about which one you are making is what a reviewer reads as competence.

5. 5

   State scope boundaries before you are asked

   A thin DORA section, an unverified AI inference region, two NIS2 controls evidenced by proxy — volunteering these costs you a sentence each and buys you credibility on everything else in the response. Discovering them yourself is much cheaper than having them discovered.

What a mapping is not

• It is not certification. ISO 27001 certification requires a management system, a Statement of Applicability, a risk treatment plan, an internal audit programme and an accredited certification body. A control mapping is an input to that work, not a substitute for it, and nothing in this platform issues a certificate.
• It does not make your organisation compliant with anything. A product cannot. What the mapping and the bundle do is produce the evidence your NIS2 audit asks for, expressed in whichever framework's vocabulary the person in front of you uses.
• It is not exhaustive. Ten NIS2 controls, fourteen Annex A controls, three DORA articles, fourteen SOC 2 entries. The catalogue is short deliberately, because ten controls with a defensible evidence trail are worth more at an audit than sixty with none — but short means incomplete, and an auditor's scope is theirs to set, not ours.
• It does not survive without review. Framework versions change and mapping guidance changes with them. The mapping is version-controlled data with its sources named so that a change is a reviewable event rather than an unnoticed drift.

What to read next

1. NIS2: what your management is personally responsible for — the control catalogue and the reporting clock.
2. The evidence bundle: what an auditor gets — the artefact you attach to any of these answers.
3. Severity, blast radius and what to fix first — how to prioritise the findings behind the mappings.