How do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?

Start

DORA, NIS2 and ISO 27001 may all apply to us

ISO/IEC 27001 is a standard you choose to certify against. NIS2 and DORA are laws with their own obligations, such as incident reporting to an authority, which a certificate does not prove. Certification is evidence that a management system is working. It is not compliance with a law. The aim is one set of controls that serves all three without duplication and without gaps.

• Then: List every legal, regulatory and contractual requirement

Step

List every legal, regulatory and contractual requirement

Keep one register of the security requirements that laws, regulators and contracts place on you, with an owner for each and how you meet it. Say what each requires of you, not just the name of the law. Include customer contract security schedules, which are often missed. Review it at least every 12 months and whenever a law or major contract changes.

• Then: Is it settled which regimes apply, and to which services?

Decision

Is it settled which regimes apply, and to which services?

Each regime has its own test of who is covered and which services or functions it reaches. The answer decides everything after it: the scope, the risks and the controls. If any part of this is still open, answer no.

• Yes: Make the ISMS scope cover what the regulations cover
• No, or not known: Settle applicability first, with legal counsel

Outcome

Settle applicability first, with legal counsel

Do not design a control set around regimes you have assumed. Get a written view, from your legal or compliance function, of which regimes apply, to which entities and to which services. Then come back to this flow.

Step

Make the ISMS scope cover what the regulations cover

If the ISMS scope leaves out services a regulation covers, the certificate will evidence little of what the regulator asks. Bring the legal and regulatory requirements into the risk assessment, and check that the scope includes the regulated services.

• Then: Choose controls from risk and from what the law requires

Step

Choose controls from risk and from what the law requires

Controls come from the risk assessment, not from a list. Where a law requires a control, record Legal or regulatory as its reason in the Statement of Applicability. Never exclude a control a law requires. Laws may also set duties that no Annex A control covers, such as reporting deadlines or specific testing; list these too.

• Then: Design each shared control to the strictest requirement

Step

Design each shared control to the strictest requirement

Where more than one regime asks for the same kind of control, build one control that meets the most demanding version: the shortest deadline, the widest coverage, the most frequent test. One control run well is cheaper to operate and to evidence than three similar ones. The pack does not set these levels for you; they come from the texts of the regimes that apply.

• Then: Look the pair up in the CISO Times Library

Step

Look the pair up in the CISO Times Library

Take each overlap you are relying on, one pair of requirements at a time. The CISO Times Library shows how the two requirements line up, how confident that comparison is, and where they differ. Treat a mapping there as a lead worth following, not as proof: confirm it against the texts. If there is no mapping, the overlap is only your assumption so far.

• Then: Read both texts yourself, with legal counsel if needed

Step

Read both texts yourself, with legal counsel if needed

Compare what each requirement actually asks for: who must act, what, by when, to whom, and what evidence proves it. Record your reading and who made it, so the reasoning can be shown to a supervisor or auditor later.

• Then: Does your own reading confirm the overlap?

Decision

Does your own reading confirm the overlap?

Confirm it only if every part of one requirement is met by the control you designed for the other. A partial match is not an overlap. If you are unsure, answer no and treat the two as separate.

• Yes: Does either regime add a timing, recipient, scope or test?
• No, or not known: Treat it as a separate obligation, with its own control

Decision

Does either regime add a timing, recipient, scope or test?

Even a real overlap can hide a difference: a reporting deadline, a named authority to notify, a wider set of systems, a specific form of testing. Laws may set duties the Annex A controls do not cover, and these are the usual place. If not known, answer yes.

• Yes, or not known: Treat it as a separate obligation, with its own control
• No: Use one control, and note each requirement it serves

Step

Use one control, and note each requirement it serves

In your own control list, record the control once, with every requirement it serves and the basis for linking them: the mapping you relied on, or your own reading. That record is how you show a supervisor why one control answers more than one duty.

• Then: Are there overlaps left to check?

Step

Treat it as a separate obligation, with its own control

Keep the extra duty as its own item: its own owner, its own procedure step or control, and its own evidence. It may be a small addition to an existing control, such as a regulatory reporting step in the incident procedure. What matters is that it is visible and owned.

• Then: Are there overlaps left to check?

Decision

Are there overlaps left to check?

Work through every overlap you are counting on to keep the set small. Each unchecked one is a place where a regime's requirement may be going unmet without anyone noticing.

• Yes: Look the pair up in the CISO Times Library (back to an earlier step)
• No: Keep evidence for each regime

Step

Keep evidence for each regime

A supervisor and a certification auditor each ask for evidence in their own terms. Keep regulatory findings in the same gap tracker as ISMS gaps, with their own reference, so one list is managed. Keep each month's readiness assessment export, because a supervisor may ask for the assessment and its history.

• Then: One control set, with each overlap checked and evidenced

Outcome

One control set, with each overlap checked and evidenced

You now have the smallest set you can defend: shared controls where overlaps are checked, separate obligations where the regimes differ, and evidence for each. Review it with the Statement of Applicability, at least every 12 months, and when a law or the scope changes.