Home  /  Frameworks
Frameworks

One set of controls, many frameworks.

Tenders, regulators and overseas customers ask for different frameworks. Most of them overlap. We help you pick the one that wins the work in front of you, then reuse that effort for the next.

8 frameworksCertification, assessment and privacy
Build onceMapped across every framework
In short: ISO 27001, SOC 2, ISO 42001, ISO 9001 and ISO 27701 can be independently certified or attested. The Essential Eight, NIST CSF and GDPR are assessed rather than certified. They share most of their controls, so Cyber Veda builds one control set and maps it to every framework you need.
Information security US customers AI governance Quality Essential Eight Cyber risk posture EU personal data Privacy

Filled marks can be certified or attested. Outlined marks are assessed, or, for GDPR, a law you demonstrate compliance with.

The frameworks at a glance

FrameworkWhat it coversOutcomeWho usually asks
ISO 27001Information security managementCertificateTenders, enterprise and government buyers
SOC 2Security and the other Trust Services CriteriaAttestation reportUS software buyers
ISO 42001AI governanceCertificateBuyers of AI products
ISO 9001Quality managementCertificateTenders in government, construction and manufacturing
Essential EightEight technical mitigationsMaturity levelAustralian government and its suppliers
NIST CSFOverall cyber risk postureCurrent and target profileUS customers, boards, insurers
GDPREU personal dataDemonstrable complianceEU customers and regulators
ISO 27701Privacy information managementCertificateCustomers asking about privacy

Certification

ISO 27001 is the international standard for an information security management system and the one most Australian tenders ask for. SOC 2 is the attestation US software buyers expect. ISO 42001 does for AI governance what ISO 27001 does for security, and shares the same structure. ISO 9001 certifies quality management and runs alongside ISO 27001 as one integrated system.

Essential Eight

The Australian Signals Directorate’s eight technical mitigation strategies, rated on a maturity scale from zero to three. Often requested in government and critical-infrastructure supply chains. Essential Eight assessment

NIST CSF

The world’s most widely adopted way to describe cyber risk, across six functions from Govern to Recover. Useful for US customers, boards and insurers. NIST CSF assessment

GDPR

EU data protection law, which can reach Australian businesses that sell to or monitor people in the EU. GDPR readiness program

ISO 27701

The certifiable privacy management standard, standalone since its 2025 edition and often run alongside ISO 27001. It maps closely to GDPR. ISO 27701 internal audit

Build once, reuse

Access control, risk assessment, incident response, supplier management and backups show up in almost every framework. We build them once, collect the evidence once and map it to each framework you need, so adding the next one is a fraction of the effort of the first.

What's included

  • Advice on which framework your customers, tenders or regulators actually require
  • One control set mapped to every framework you need
  • Evidence collected once and reused across audits and assessments
  • A roadmap for adding the next framework when you need it
FAQ

Common questions

Which framework should we start with?

Start with the one your customers or tenders ask for. In Australia that is usually ISO 27001; for US software buyers it is often SOC 2; for government work it may be the Essential Eight. If no one has asked yet, a short consultation will tell you which one opens the most doors.

Essential Eight or ISO 27001?

They answer different questions. The Essential Eight measures specific technical mitigations; ISO 27001 certifies a whole management system. Some tenders accept either, many ask for both. We help you read what the tender actually requires.

Which frameworks can be certified?

ISO 27001, ISO 42001, ISO 9001 and ISO 27701 are certified by an accredited certification body. SOC 2 is an attestation report issued by a licensed CPA firm. The Essential Eight and NIST CSF are assessed, not certified, and GDPR is a law you demonstrate compliance with.

Can Cyber Veda certify us?

No, and that independence matters. Certificates come from accredited certification bodies and SOC 2 reports from CPA firms, which you engage directly. We implement the framework, run the internal audit or assessment, recommend and introduce auditors we have worked with, and support you through their audit.

Which frameworks do Australian government tenders ask for?

Most often ISO 27001, the Essential Eight, or both, with ISO 9001 common in construction and infrastructure. Requirements vary by agency and contract, so we read the tender with you before you commit to anything.

How much extra work is a second framework?

Far less than the first. Risk assessment, access control, incident response, supplier management, policies and training appear in almost every framework, so the second mostly adds what is specific to it, such as AI impact assessments for ISO 42001 or prescriptive technical settings for the Essential Eight.

Can we do more than one at once?

Yes, and it is usually the most efficient way. We design one set of controls and map it to each framework, so the second framework costs far less than the first.

Talk to someone who has taken companies like yours to audit.

Book a free 30-minute consultation. Tell us what is driving the need, and leave with a realistic timeline and the first three things to do.

Book a 30-min consultation Explore services