Frameworks & Standards
Fluent in the standards that govern modern enterprise risk.
From control frameworks and zero-trust reference models to an EU regulatory landscape that is now live and supervised — DORA, NIS2, the Cyber Resilience Act and the EU AI Act — applied across Banking, Aviation, Defence, Government, and Critical National Infrastructure.
Control & architecture frameworks
| Framework | Purpose | Where it applies |
|---|---|---|
| NIST CSF 2.0 | Risk-based cybersecurity outcomes across six functions: Govern, Identify, Protect, Detect, Respond, Recover (Feb 2024) | Enterprise-wide programme & board reporting |
| ISO/IEC 27001:2022 | Information security management system (ISMS) certification standard | Certification, audit, supplier assurance |
| NIST SP 800-207 | Zero Trust Architecture — identity-first, resource-centric security | Architecture & access design |
| CIS Controls | Prioritised, prescriptive technical safeguards | Hardening & baseline assurance |
| SABSA | Business-driven security architecture method | Security architecture & design authority |
| TOGAF | Enterprise architecture framework and method | Operating-model & enterprise design |
NIST CSF 2.0 added the Govern function and broadened scope to all organisations, not just critical infrastructure.
Regulatory & operational resilience
| Regulation | Scope | Status |
|---|---|---|
| DORA | Digital Operational Resilience Act — ICT risk, incident reporting, third-party oversight, resilience testing for EU financial entities | Applying since Jan 2025 · live & supervised |
| NIS2 Directive | Raised cybersecurity baseline & incident handling for essential/important entities and critical infrastructure | Transposed · enforcement stepping up |
| Cyber Resilience Act (CRA) | Security-by-design, vulnerability handling and lifecycle duties for products with digital elements | In force Dec 2024 · reporting duties since 11 Sep 2026 · full application 11 Dec 2027 |
| IEC 62443 | Security for industrial automation & control systems — OT/ICS zones, conduits and supplier requirements | Applied in OT/CNI estates |
| GDPR | Personal data protection & breach notification | In force |
| ISO 27001:2022 | Shared risk-management foundation that DORA, NIS2 & CRA build on | Certifiable |
DORA, NIS2 and the CRA build on — not replace — ISO 27001 and GDPR. With DORA supervised, NIS2 enforced nationally and CRA reporting duties live since September 2026, the disciplines converge on one evidence base for ICT risk and incident handling.
AI governance & emerging tech
| Standard | Purpose | Relevance |
|---|---|---|
| EU AI Act | Risk-tiered regulation of AI systems across the EU — prohibited practices and GPAI duties already applying; transparency obligations live since August 2026; high-risk obligations deferred to Dec 2027 and Aug 2028 | AI adoption strategy & controls |
| ISO/IEC 42001 | AI management system (AIMS) — governance for responsible AI, including autonomous and agentic systems | Certifiable AI governance |
| NIST AI RMF | Voluntary framework to manage AI risk across the lifecycle | AI risk identification & mitigation |
| AI Agent Governance | Identity, permission scoping and audit trails for autonomous agents — containing shadow agents and permission sprawl | The fastest-growing enterprise attack surface |
| Post-Quantum Migration | Crypto discovery and inventory, cryptographic agility, migration to the NIST PQC standards | FIPS 140-2 certificates now Historical; RSA-2048 and P-256 deprecated from 2030 |
CISOs now manage the "regulatory collision" where NIS2, DORA, the CRA and the EU AI Act intersect — increasingly on autonomous agents no one formally owns.
Applied outcomes
Standards in service of the business.
Frameworks are a means, not an end. Kai uses them to reduce risk, earn regulator trust, and unlock value.
Harmonised compliance
Consolidating overlapping live obligations (DORA · NIS2 · CRA · ISO 27001) into a single, defensible control set.
Zero-trust resilience
Identity-first architectures aligned to NIST SP 800-207 that limit blast radius and lateral movement — human and machine identities alike.
Governed AI & agents
Governance that lets the enterprise adopt AI and autonomous agents with control — mapped to the EU AI Act, ISO 42001 and the NIST AI RMF.
Post-quantum migration
Cryptographic discovery, inventory and agility — a sequenced route to the NIST PQC standards well ahead of the 2030 deprecation of RSA-2048 and P-256.
OT & critical infrastructure
IEC 62443 zones and conduits applied where safety, availability and national resilience are the real requirements.
Put the frameworks to work.
Translate standards into a defensible, board-ready control posture.