“Which controls cover which systems, and where is the proof?”
Every NIST CSF 2.0 function, every ISO/IEC 27001:2022 clause and Annex A control, every SOC 2 Trust Services Criterion, every COBIT 2019 objective and the SEC’s cyber disclosure rules — mapped to one library of controls and the applications, data, cloud, infrastructure, suppliers and AI they cover. Implement a control once and let every framework that asks for it read the same evidence. Keep your own control IDs; a new framework version arrives as remaps you approve. And see what each gap costs and which funded work closes it. Dotwork doesn’t issue audit reports or certificates — it gets you to the auditor with the proof in one place.
Runs in
Covers
NIST CSF · ISO 27001 · SOC 2 · COBIT · SEC cyber rules
The pressure
Security teams answer to several frameworks at once — a certification, a customer audit, a regulator, the board. Each arrives with its own control list, so the same access review is documented five ways. Controls are listed without the systems they cover. Evidence is screenshots. And when the board asks about cyber risk, the answer is a heat map with no cost and no owner behind it.
What it looks like today
Full coverage
Each framework keeps its own structure and language. The controls behind them are shared, and tied to the estate, the suppliers and the money.
Built for NIST CSF 2.0 · ISO/IEC 27001:2022 · SOC 2 · COBIT 2019 · SEC cyber rules
Six functions, with Govern at the center.
The ISMS clauses and all 93 Annex A controls.
The Trust Services Criteria.
Governance and management of enterprise IT.
For US-listed companies, since December 2023.
What keeps every framework honest.
What changes
A control list per framework
One control library, crosswalked to every framework that asks
Controls in the abstract
Every control implemented on named applications, data, cloud, infrastructure and AI
Evidence by screenshot
Attestations with an owner, a date and the next one due
Cyber risk as a heat map
Residual risk on the systems that carry it, with the cost to fix and the project funding it
Controls across the estate
Read control families — access, resilience, data protection, change, vendor risk — across applications, data, cloud, infrastructure and AI. Full, partial and missing coverage show at a glance, with the run cost of assets nobody has attested and the waivers about to expire. Behind each cell are the controls, the frameworks they satisfy and the evidence that proves them.
Where other tools stop
GRC and compliance automation tools list the controls and collect the evidence. What an asset costs, who funds the fix and which change is about to touch it usually sit somewhere else.
Flexed to how you run
Most companies already have a control set that grew over years. Dotwork keeps it and lets each framework read it in its own language.
Your control IDs
Keep the numbering your teams and auditors know. Framework references sit beside each control.
Adopt, reference or evaluate
Mark each framework as adopted, used for reference or under evaluation, and report against the ones you answer to.
Scope by asset class
Apply controls to applications, data, cloud, infrastructure and AI where they belong, not everywhere at once.
Crosswalks that admit partial matches
Every mapping is labeled exact, broader, narrower or partial, so auditors can see where one control only partly covers a requirement.
When frameworks revise
Security frameworks revise on their own clocks. Each new version is crosswalked to the controls you already have, with merges and additions proposed for the compliance lead to approve. Past audits keep the version they were run against.
NIST CSF 2.0 adds Govern as a sixth function
Policies, roles, oversight and supply chain controls grouped under Govern — nothing re-entered
CSF scope widened from critical infrastructure to every organization; 108 subcategories become 106
Subcategories remapped, with merged and moved ones proposed for approval
ISO 27001 Annex A cut from 114 controls in 14 domains to 93 in four themes; 2013 certificates expired 31 October 2025
Each existing control remapped to its new theme, with merges proposed for approval
Eleven new Annex A controls, including threat intelligence, cloud services and data leakage prevention
New controls added, with the assets they should cover proposed
SEC rules add Form 8-K Item 1.05 and Regulation S-K Item 106 from December 2023
Disclosure items linked to the risks, controls and oversight they describe
COBIT 2019 organizes IT governance into 40 objectives
Objectives mapped to the same model as strategy, portfolio and architecture
Every framework, one model
Security controls carry most of the weight for SOX, resilience and AI rules too. Here those frameworks draw on the same library instead of keeping copies.
SOX · COSO
The access and change controls you attest for ISO 27001 are the IT general controls SOX tests.
Explore Financial ControlsEU DORA · NIS2 · UK op-res
EU DORA and NIS2 measures read the same controls and the same dependency map.
Explore Operational ResilienceEU AI Act · NIST AI RMF · ISO 42001
ISO 42001 and the AI Act reuse the access, data and change controls already in place.
Explore AI RegulationStandards and review for every architecture component
New solutions are reviewed against the same security standards.
Explore Solution GovernanceADM · TOGAF Standard, 10th Edition
The architecture model is the asset inventory every framework starts from.
Explore TOGAFISO/IEC 19770 · licenses, contracts and renewals
Hardware and software inventories drawn from what you own, use and renew.
Explore IT Asset ManagementAI-native security governance
Mapping, chasing evidence and remapping for a new version are where a multi-framework program spends its time. Dot prepares them from the model; every mapping, attestation and exception still goes to a named owner.
Proposes which requirements in each framework an existing control already satisfies, with a stated fidelity on every match.
Follows each policy to the controls that implement it and the assets they cover, and flags any policy that stops short.
Sorts attestations into current, due soon, overdue and never attested, by owner and asset class, so one attestation serves every framework its control maps to.
Reads the run cost of every asset with missing or unattested controls, so a control gap carries a dollar figure.
Totals what security debt costs to fix and to carry, and shows how much has a funded project behind it.
Crosswalks a new framework version to your existing controls and proposes each remap, merge and addition.
Tracks rule violations, assets with no owner and crosswalk fidelity, so the inventory every framework relies on stays sound.
Answers questions about controls, coverage and evidence, pointing to the evidence and saying where it falls short.
Where it runs in Dotwork
Dotwork does not ask you to adopt a new method. The framework becomes a view over the same model these solutions already read and write.
How it compares
GRC suites run the control program and the audit workflow. Compliance automation tools pull technical evidence from cloud and identity systems. Security & IT Governance on Dotwork puts one control library on the same model as the estate, the suppliers and the money — and works beside the tools that collect the evidence.
| Capability | GRC suites | Compliance automation tools | Security & IT Governance on Dotwork |
|---|---|---|---|
| NIST CSF, ISO 27001, SOC 2 and COBIT in one library | Partly | ||
| One control crosswalked to every framework | |||
| Attestations with owner, date and next due | |||
| Mapping fidelity stated on every crosswalk row | Partly | ||
| New framework versions remapped, past audits as they ran | Partly | ||
| Controls tied to named applications, data, cloud, infrastructure and AI | Partly | Partly | |
| Cost of control gaps and unattested assets | |||
| Security debt funded through the portfolio | |||
| Wired to architecture, suppliers, budgets and change | Partly |
Who it is for
“Which systems are not covered, and what would it cost to fix?
“Are we governing technology, or only auditing it?
“How do we answer the next framework without starting over?
“Can I test one control and rely on it for every framework?
“Does our 10-K describe our cyber risk management and oversight accurately?
“Is cyber risk governed, and who is accountable for it?
Before you buy
How to get a number instead of a pitch.
1
Good answer · Once. One control, mapped to each requirement with a stated fidelity.
Bad answer · Once per framework, kept in sync by hand.
2
Good answer · Named applications, data, cloud and infrastructure, each with its status.
Bad answer · A control description and a link to the policy.
3
Good answer · The run cost of the assets affected, and the funded project that closes it.
Bad answer · A red cell on a heat map.
More in Risk, Compliance & AI
Risk, Compliance & AI
The rules your controls have to prove they meet — including the new ones for AI.
The model underneath
Steer, Fund & Optimize and Govern & Deliver all read and write the same Enterprise Operating Model. The first module you license builds the model. Every module after it adds context instead of another silo — and Dotwork AI reads all of it, stopping where the decision is yours.
See the Enterprise Operating Model© 2025-2026 Dotwork, Inc. All rights reserved.