DoveSureSign inUse your InvitationSign in

Frameworks

Implement Once. Satisfy Many.

Canonical controls map to each framework’s requirements through versioned mappings you can review. Add a framework and see straight away what you already meet and what is missing.

Information security

ISO/IEC 27001

The international standard for an information security management system, with its Annex A controls mapped to your canonical controls.

  • Statement of Applicability kept current from your records, and downloadable
  • Risk treatment linked to the controls that reduce each risk
  • Evidence ready for your certification body

DoveSure today: partly ready. Not yet: no end-to-end journey adopts ISO 27001 itself and walks it to an audit export.

Service organisations

SOC 2

The Trust Services Criteria your customers ask about, mapped to the same controls you already run.

  • Controls tested continuously, not once before the audit
  • Evidence with its provenance in a scoped auditor workspace
  • Findings closed only when a test proves the fix

DoveSure today: partly ready. Not yet: no SOC 2 journey end to end.

UK government-backed

Cyber Essentials

The UK scheme’s five technical themes: firewalls, secure configuration, user access control, malware protection and security update management.

  • Answer each area in your own words, with the files you have; connectors are optional
  • A signed readiness pack for the self-assessment you submit to an IASME certification body, which certifies you
  • Your certificate recorded, with reminders before it expires
  • The same controls count towards ISO 27001 and SOC 2

DoveSure today: ready, proved end to end. Not yet: doveSure does not certify: the certification body decides.

Data protection

UK GDPR

Accountability for personal data: records of processing, impact assessments, data-subject rights and security of processing.

  • Processing records and DPIAs linked to your systems
  • Data-subject requests tracked against deadlines
  • Security of processing shown by tested controls

DoveSure today: partly ready. Not yet: the full DPIA workflow and executable retention are not built.

AI management

ISO/IEC 42001

The standard for an AI management system, alongside a registry of the AI systems and agents you run.

  • AI systems and agents registered with owners and purpose
  • Risk classes informed by the EU AI Act
  • Human approval for sensitive actions

DoveSure today: partly ready. Not yet: no journey adopts ISO 42001 or the AI Act through to an audit.

US healthcare

HIPAA Security Rule

The administrative, physical and technical safeguards for electronic health information, mapped to the controls you already run.

  • Risk analysis, workforce security and contingency planning
  • Access, audit, integrity and transmission safeguards
  • Business associate arrangements through vendor management

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

Payment cards

PCI DSS

The twelve principal requirements of PCI DSS v4.0.1 for anyone who stores, processes or transmits cardholder data.

  • Secure configuration, network controls and malware protection
  • Account data protected at rest and in transit
  • Access, logging and regular security testing

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

EU financial services

DORA

The EU Digital Operational Resilience Act: ICT risk management, incident handling, resilience testing and ICT third-party risk.

  • ICT risk framework and asset identification
  • Incident management and major-incident reporting
  • ICT third-party risk and contractual provisions

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

AI risk

NIST AI RMF

The NIST AI Risk Management Framework: govern, map, measure and manage the risks of the AI systems you build or use.

  • AI policies and accountability
  • Context and impacts of each AI system
  • Evaluation, monitoring and documented treatment

DoveSure today: partly ready. Not yet: no journey adopts ISO 42001 or the AI Act through to an audit.

EU data protection

EU GDPR

The EU General Data Protection Regulation, from the same controls as UK GDPR: rights, records, security, breaches and transfers.

  • Records of processing, lawful basis and DPIAs
  • Rights answered within the statutory period
  • Breach notification and lawful international transfers

DoveSure today: partly ready. Not yet: the full DPIA workflow and executable retention are not built.

EU AI regulation

EU AI Act

Regulation (EU) 2024/1689: AI literacy, prohibited practices, high-risk obligations, transparency and serious-incident reporting.

  • Every AI system classified, and prohibited uses refused
  • Risk management, data governance, logging and human oversight
  • Post-market monitoring and serious-incident reporting

DoveSure today: partly ready. Not yet: no journey adopts ISO 42001 or the AI Act through to an audit.

EU cybersecurity

NIS2

The NIS2 Directive: management accountability, the Article 21 risk-management measures and staged incident reporting.

  • Management approval, oversight and training
  • The ten Article 21 measures, from supply chain to MFA
  • Early warning, notification and final report for significant incidents

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

Cybersecurity

NIST CSF 2.0

The NIST Cybersecurity Framework 2.0: govern, identify, protect, detect, respond and recover.

  • Governance and supply chain risk
  • Protection, monitoring and response
  • Recovery plans that are exercised

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

Privacy management

ISO/IEC 27701

The privacy extension to ISO 27001, for PII controllers and processors, from the controls you already run.

  • Records of processing and lawful basis
  • Obligations to individuals, and privacy by design
  • Processors, sub-processors and transfers

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

US privacy

CCPA / CPRA

The California Consumer Privacy Act as amended by the CPRA: notice, consumer rights, contracts and reasonable security.

  • Requests to know, delete, correct and opt out
  • Service-provider and third-party contracts
  • Reasonable security, risk assessments and audits

DoveSure today: partly ready. Not yet: none has an end-to-end journey.

Framework builder

Your own frameworks

Contracts, customer requirements and internal standards, built as versioned frameworks and mapped into the same record.

  • Versioned, so changes are reviewable
  • Mapped to existing controls: see what you already meet
  • Reported like any other framework

DoveSure today: ready, proved end to end. Not yet: reading accuracy has not been measured on an independent corpus.

How the Mapping Works

You run one set of controls, such as “privileged access is restricted and protected by MFA”. Each control maps to the requirements it satisfies in every framework. Test it once and the result counts everywhere it applies. Mappings are versioned, so a change to a mapping is itself reviewable.

Ready to prove it?

Know what you are responsible for, control whether it works, and prove it to anyone who asks.

Use your Invitation