Features
What multi-framework compliance actually costs you
The cost of running several regulatory frameworks at once is not the frameworks. It is the duplication. The same encryption control, the same access review, the same third-party register, the same incident write-up, re-entered and re-evidenced once per framework because the tools keep them in separate silos. Add a framework and the busywork multiplies rather than adds.
The five capabilities below all attack that one problem: enter a fact once, and let the platform apply it wherever it is relevant. Everything described here is built and verified in the product. Regulatory deadlines cited in this post point to the official texts, listed under Primary sources at the end.
Feature 1
Cross-framework control crosswalk with live propagation
The problem
One "encryption at rest" control answers requirements in ISO 27001, SOC 2, NIST CSF, NIS2, GDPR and DORA at the same time. If your tooling treats each framework as its own island, you implement it once and then record it six times.
Venvera's Control Crosswalk is built on 43 shared control domains such as encryption, key management, access control, privileged access, logging and monitoring, incident reporting, backup and restoration, supplier due diligence, secure development and segregation of duties. Each domain carries the specific control references that satisfy it in each framework, so one domain is a single row you read across.
The important part is not the matrix, it is the propagation behind it. When you mark a control as implemented in one framework, the platform writes the equivalent status to the mapped controls and gap-assessment questions in every other framework you have enabled, and records what it did.
How the propagation behaves
Forward only, never a downgrade
Propagation only raises a target that is behind. A stronger existing status is left alone, so an automated write can never quietly weaken a control you have already evidenced.
Works in both directions
Any framework can be the source. An implemented ISO 27001 control fans out to gap-assessment answers; a strong gap-assessment answer marks the equivalent control implemented.
Auditable, not magic
Every propagated write is logged with its source, and propagated answers are flagged as such, so an auditor can see which records you filled in and which the crosswalk derived.
Live status, filterable
Each cell reads your real data: implementation status for control frameworks, assessment scores for gap frameworks. Filter by domain, by framework, or by status (compliant, partial, gap).
The outcome
The overlap between frameworks stops being a tax and starts being leverage. Work you did for one obligation is credited against the others automatically, and the crosswalk shows you exactly where it landed.
Feature 2
Evidence you upload once, attached to every control it proves
Mapping controls is only half of the duplication. The other half is the artefact: the same encryption configuration screenshot, the same access review export, the same penetration test report, uploaded again and again into a different folder for each audit.
In Venvera, when you attach evidence to a control you can also select the other controls the same artefact satisfies, in any framework you are entitled to edit. The file is stored once and linked to every one of those controls, so the same artefact closes the requirement in each framework without a second upload.
What the platform does with it
- One upload, one stored file, one shared file reference across every control it is linked to.
- Evidence can be a description, a file, or both, and is typed accordingly (document, screenshot, mixed).
- Permissions are enforced per framework: a control you are not allowed to edit is silently skipped rather than written to.
- A rejected file (too large, wrong type) fails before anything is marked satisfied, so a failed upload never creates fake coverage.
The outcome
Crosswalking tells you the same requirement appears in five places. Evidence reuse is what stops you proving it five times. Together they are the reason adding a framework does not multiply the work.
Feature 3
One incident, analysed against every reporting regime at once
The problem
A single cyber incident can pull in several reporting regimes at the same time. GDPR Article 33 sets a 72 hour clock for notifying the supervisory authority. NIS2 Article 23 requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. DORA's reporting technical standard sets an initial notification within 4 hours of classifying the incident as major and no later than 24 hours from becoming aware of it, an intermediate report within 72 hours of that notification, and a final report within one month. Nobody should be reading three legal texts while an incident is live.
Venvera's classification engine reads the attributes of the incident you have already recorded and evaluates them against each regime you have enabled, in one pass. For each one it returns whether the regime is triggered, which criteria matched, a confidence level, the reporting milestones with due timestamps, the legal basis, and a list of suggested next actions.
What the engine evaluates
| Regime | Criteria the engine checks | Output |
|---|---|---|
| DORA | Seven impact criteria: clients affected, transactions affected, service duration, data losses, critical or important functions, economic impact, geographical spread. | Major or non-major, plus the initial, intermediate, final and root cause milestones with due timestamps. |
| NIS2 | Six criteria: severe operational disruption, financial loss, affected persons, cross-border impact, service unavailability, data integrity or confidentiality breach. | Significant or not significant, plus the early warning, notification and final report milestones. |
| GDPR | Whether the incident is a personal data breach, the sensitivity of the data categories involved, the scale of impact and the risk to individuals. | Reportable to the authority, and separately whether the affected individuals must be told. |
| EU AI Act | AI system involvement, impact on fundamental rights, potential for serious harm, and breadth of impact. | Flags the incident as a serious incident candidate for review against the AI Act reporting duty. |
The criteria above are the engine's operational interpretation, designed to surface the obligations you should look at. They are a triage aid, not a legal determination: the classification thresholds that bind you are the ones in the regulation and its technical standards, and the final call stays with your compliance function.
How it shows up in the workflow
- Available while you type. Classification can be run from the incident form, not only after the record is saved.
- A panel on the incident. The incident detail view shows each regime, the criteria that matched, and a high, medium or low confidence rating.
- Suggested actions. Concrete next steps per triggered regime rather than a raw verdict.
- Re-runnable. As facts firm up (more data subjects identified, financial impact clarified), re-run it and the classification updates.
Feature 4
A single compliance health score across the frameworks you run
Executives do not want to read a dashboard per framework. They want to know whether the position is improving. The health score gives a 0 to 100 score with an A to F grade per framework, and one weighted overall score across the frameworks you have enabled.
The four signals, and what each is worth
40%
Gap assessment
Your answers to the framework's formal assessment questionnaire
30%
Control implementation
ISO controls, SOC 2 criteria, NIST subcategories, register and processing-activity completeness
15%
Operational health
Open incidents, the rate at which incidents are resolved, and whether policies are current
15%
Policy coverage
Approved policies against total policies
Grades are banded: 80 and above is an A, 65 a B, 50 a C, 35 a D, below that an F. The overall score is a weighted average rather than a flat mean, because a heavyweight regime should not be diluted by a lighter one that happens to be at 100. The banner sits at the top of the dashboard with per-framework badges that link straight into the framework that is dragging the number down.
The score is a management signal derived from your own data. It is not a certification, an attestation, or a regulator's view of you.
Feature 5
Regulatory change mapped onto your own records
Two things make regulatory change expensive across several frameworks. First, a directive like NIS2 is not one rulebook: each member state transposes it into national law, so the entity in Germany and the entity in Ireland are not answering the same questions. Second, when an update lands, somebody has to work out which of your controls, policies and open items it actually touches.
National transposition, tracked per country
Venvera tracks NIS2 transposition for all 27 EU member states inside the NIS2 dashboard. For each country the tracker records the transposition status, the national law and its adoption and effective dates, the supervisory authority and national CSIRT, the penalty regime, the sectors in scope, and the notable ways the national law departs from the directive. If you operate across borders, that is the difference between one NIS2 programme and several.
Impact assessment on a change, against your live data
Regulatory updates arrive in the platform either by hand or from public feeds published by the European authorities, including the EBA, ESMA, ENISA, the ECB, the European Commission, the EU AI Office and EUR-Lex. From an update, one action assesses its impact.
1
Map the update to frameworks
The affected modules recorded on the update are resolved to the frameworks they belong to.
2
Query your actual records
It then looks at your own data: policies, ISO 27001 controls, gap assessments and open incidents in the affected frameworks.
3
Return the impacted items
Each hit comes back with its type, framework, current status and whether it needs a review or action.
4
Generate the tasks, if you want them
Optionally, the items needing action become tasks on your board, tagged with the framework and de-duplicated against open tasks for the same update.
The outcome
The question changes from "what does this update mean" to "here are the records it touches, which of them do we act on". The judgement stays with your team; the search for the affected records does not.
What these five capabilities do, in one table
Each row is built and verified in the product.
| Capability | What it does in Venvera |
|---|---|
| Control crosswalk | 43 shared control domains, each showing live status per enabled framework, filterable by domain, framework and status. |
| Status propagation | Marking a control implemented raises the equivalent control or assessment answer in other enabled frameworks, forward only, with an audit log. |
| Evidence reuse | One uploaded artefact is stored once and linked to every control it satisfies, across frameworks, subject to your permissions. |
| Incident classification | One incident evaluated against DORA, NIS2, GDPR and the EU AI Act in a single pass, with matched criteria, confidence, milestones and suggested actions. |
| Compliance health score | 0 to 100 score and A to F grade per framework from four weighted signals, plus one weighted overall score. |
| NIS2 transposition tracker | Status, national law, authorities, penalties, sectors and national divergences for all 27 EU member states. |
| Regulatory impact assessment | Maps an update to affected frameworks, finds the policies, controls, assessments and incidents it touches, and can generate de-duplicated tasks. |
Under the hood
Tenant isolation at every layer
Queries run inside PostgreSQL row-level security boundaries with an explicit organisation filter on top. One organisation's crosswalk, evidence or score cannot pull another's rows.
Degrades instead of failing
The crosswalk and health score fan their per-framework queries out with Promise.allSettled. If one framework's data is unavailable, that framework is omitted and the rest of the answer still returns.
Propagation cannot loop or downgrade
Propagation carries a per-call visited set so a cross-framework write cannot cycle, and it never lowers a target that is already at or above the propagated value.
Driven by configuration
The crosswalk, health score and classification engine all read the set of frameworks enabled for your organisation. Enable one and it appears in each of them.
Frequently Asked Questions: multi-framework compliance
What is multi-framework compliance?
It is running more than one regulatory or certification framework at the same time, for example ISO 27001 alongside NIS2, GDPR and DORA. The frameworks overlap heavily at the control level, so the practical challenge is capturing that overlap instead of re-doing the same work per framework.
Can one control really satisfy several frameworks at once?
At the control level, yes: access control, encryption, logging, incident reporting and supplier due diligence appear in nearly every framework. Venvera models 43 such shared domains and, when you mark one implemented, writes the equivalent status into the other frameworks you have enabled. What it does not do is invent evidence: the artefact still has to exist, and each framework's specific wording still has to be met.
Do I have to upload the same evidence for each framework?
No. When you attach an artefact to a control you can select the other controls it also proves, in any framework you can edit. The file is stored once and linked to all of them.
Does automatic classification decide my reporting obligations for me?
No, and it should not. It evaluates the incident against each regime's criteria, tells you which look triggered and with what confidence, and lays out the reporting milestones so nothing is missed while the incident is live. The determination remains yours, against the regulation and its technical standards.
Why does NIS2 need a country-by-country tracker?
Because NIS2 is a directive. Member states had to transpose it into national law by 17 October 2024, and they did so with different scopes, authorities and penalty regimes. If you operate in several member states, you comply with several national laws, not with the directive in the abstract.
Primary sources
- GDPR, Regulation (EU) 2016/679, Article 33 (72 hour notification of a personal data breach to the supervisory authority): eur-lex.europa.eu/eli/reg/2016/679/oj
- NIS2, Directive (EU) 2022/2555, Article 23 (24 hour early warning, 72 hour notification, final report within one month) and Article 41 (transposition by 17 October 2024): eur-lex.europa.eu/eli/dir/2022/2555/oj
- DORA, Regulation (EU) 2022/2554, Articles 18 and 19 (classification and reporting of major ICT-related incidents): eur-lex.europa.eu/eli/reg/2022/2554/oj
- Commission Delegated Regulation (EU) 2025/301, Article 5 (time limits: initial notification within 4 hours of classification and no later than 24 hours from becoming aware, intermediate report within 72 hours, final report within one month): eur-lex.europa.eu/eli/reg_del/2025/301/oj
- EU AI Act, Regulation (EU) 2024/1689, Article 73 (reporting of serious incidents): eur-lex.europa.eu/eli/reg/2024/1689/oj
See the crosswalk on your own frameworks
Bring the frameworks you actually run and we will show you where they overlap, what one control already covers, and what is genuinely still open.
This is a product update describing Venvera capabilities as built and verified in the product as of July 2026. Regulatory references point to the official texts; confirm current obligations against the applicable regulation, its technical standards, your national transposition, or your adviser. Venvera supports readiness and coverage work and does not by itself make an organisation compliant or certified.
Venvera · Built for EU regulated organisations · Amsterdam, Netherlands
