Single-framework tools or one platform for multiple frameworks: which fits your company?

Key takeaways

• One single-framework tool is enough as long as you run exactly one framework. From the second framework onward, the work shifts from implementation to reconciling two separate bodies of evidence.
• Kertos covers ISO 27001, GDPR, NIS2, EU AI Act, SOC 2, TISAX, and C5 in one platform and supplies external CISO and DPO mandates from its own team.
• ENISA maps every requirement of the NIS2 implementing regulation (EU) 2024/2690 to ISO/IEC 27001:2022 and ISO/IEC 27002:2022, but states explicitly that the mapping is not a measure of equivalency.
• The outcome differs per framework: ISO 27001 ends in a certificate, SOC 2 in a report, C5 in an attestation, TISAX in an assessment with a label. GDPR, NIS2, and the EU AI Act have no certification at all.

One platform for multiple frameworks pays off from the second framework onward; a single-framework tool remains the better choice as long as you stay with one. What decides it is the body of evidence, not the license price. ISO 27001, NIS2, the GDPR, and the EU AI Act draw on largely the same records from the same systems: asset inventory, vendor list, risk register, access reviews, training records, and incident tickets. Two tools keep two copies of those, and someone has to keep both current. Kertos holds that evidence in one place and maps it to the controls of every covered framework at once; the external CISO and DPO mandates are held by certified experts on its own team.

Single-framework tools or one platform: when does each make sense?

The decision turns on one number: how many frameworks you will be running in the next eighteen months. With one framework, you pay for platform surface you do not use. With two, work appears that is visible in neither tool, namely the reconciliation between them. A vendor rated non-critical in one system and critical in the other only surfaces in the audit.

Miriam Mindt, Information Security Expert at Kertos, describes the same effect for the scope of an ISMS:

"It can be more work in a way to define a narrow scope and have all these exclusions and kind of edge cases than to just say everything inside this development process is in scope."
Miriam Mindt, Information Security Expert at Kertos

She is talking about how widely a company draws its ISMS scope. The same arithmetic applies to the tool landscape. Every additional boundary between two systems creates a reconciliation that someone has to maintain, and that reconciliation appears in no quote.

Single-framework tools and a multi-framework platform compared, with the effect on the next audit

Criterion	Several single-framework tools	One platform for multiple frameworks	What changes in the next audit
Body of evidence	One separate set per tool	One set, each record mapped to several controls	The auditor sees the same record the second framework also relies on
Control mapping	Maintained by hand in a spreadsheet	Held in the system	Divergence between two frameworks surfaces before the audit rather than during it
Vendors and assets	Maintained twice	Maintained once	A vendor does not appear with two different risk ratings
Roles and permissions	A separate user list per tool	One permission structure	The access review covers every framework in one pass
Onboarding	One small tool per framework	More surface on day one	No difference in the audit, but real effort in the first month
Changing tools	Low per tool	Migration of the entire body of evidence	Running both in parallel until the next audit has to be planned for

Which one platform covers NIS2 and ISO 27001 together?

A platform covers both when it holds the ISO 27001 control set and also carries the duties that only NIS2 imposes. The overlap in substance is documented: in June 2025 ENISA published its Technical Implementation Guidance on implementing regulation (EU) 2024/2690 and maps every requirement in it to ISO/IEC 27001:2022 and ISO/IEC 27002:2022. In the same document ENISA states that this mapping is not to be read as equivalency between the standards.

What an ISO 27001 tool does not bring with it are the two duties NIS2 places on the company itself. Under Article 20 of the NIS2 Directive, management bodies have to approve the risk management measures, oversee their implementation, and take part in training; in Germany that sits in § 38 BSIG. Alongside it comes the reporting chain under Article 23, with an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. There is no certificate for NIS2, and an ISO 27001 certificate does not replace registration or the reports.

One point matters more outside Germany than inside it. NIS2 is a directive, so the obligations reach you through your own member state's transposition, and the timetable differs from one country to the next. A platform that hard-codes one national regime does not serve a group operating in several. Check whether it runs the reporting process as a task with deadlines rather than filing it as a policy. A provider-level assessment is in our comparison of software for NIS2 implementation.

Which one platform covers the GDPR and ISO 27001 together?

Both require the same foundation and end in different places. Article 32 GDPR calls for technical and organizational measures appropriate to the risk, naming encryption, pseudonymization, availability, restoration, and a process for regularly reviewing those measures. That overlaps closely with what Annex A of ISO 27001 requires.

The difference that matters is evidentiary weight. Article 32(3) GDPR allows compliance to be demonstrated through an approved certification mechanism under Article 42 GDPR. ISO 27001 is not such a mechanism. An ISO 27001 certificate is strong evidence of appropriate measures in front of a supervisory authority, but it is not a GDPR proof in the sense of Article 42.

On top of that come the duties ISO 27001 has no counterpart for: the record of processing activities under Article 30, answering data subject requests under Articles 15 to 22, the data protection impact assessment under Article 35, processor contracts under Article 28, and the appointment of a data protection officer under Article 37. Anyone running both frameworks on one platform needs it for privacy management just as much as for the ISMS control set. ISO 27701 extends the ISMS into a privacy information management system and closes part of that gap, but it does not replace the duties.

Further reading: ISMS software compared and software for data subject requests.

Which one platform covers the GDPR and the EU AI Act together?

A platform covers both when it runs the data protection impact assessment and the fundamental rights impact assessment as two connected but separate procedures. Article 27(4) of the EU AI Act settles the relationship explicitly: "If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the fundamental rights impact assessment referred to in paragraph 1 of this Article shall complement that data protection impact assessment." The fundamental rights impact assessment therefore sits alongside the DPIA rather than replacing it. The duty under Article 27(1) falls on public bodies, private providers of public services, and deployers of high-risk systems under Annex III points 5(b) and 5(c).

The deadlines are worth a close look, because many overviews still carry the old position. Regulation (EU) 2026/1744 of 8 July 2026 moved the obligations for high-risk systems back: stand-alone high-risk systems under Annex III apply from 2 December 2027, and systems embedded in products under Annex I from 2 August 2028 (checked 23 September 2026). The AI literacy duty under Article 4 already applies.

For a selection decision that means the platform has to keep an AI inventory that assigns every system a risk class, and it has to be able to link the DPIA to the fundamental rights impact assessment instead of filing both as separate documents. A provider overview is at tools for EU AI Act compliance.

Which one platform covers risk assessments under the GDPR and AI law together?

The word risk means three different protected objects across the three regimes, and that is where most shared risk registers fail. ISO 27001 assesses risk to the company's own information assets by confidentiality, integrity, and availability. The GDPR assesses, in Article 35, the risk to the rights and freedoms of natural persons. The EU AI Act assesses, in Article 27, the impact on health, safety, and fundamental rights. One and the same system can be uncritical on one scale and high-risk on another.

A platform covers both when a risk can be held in the same register under different assessment criteria. Push every risk through the same CIA scale and you get a register that holds up in an ISO 27001 audit and says nothing to a supervisory authority. Selection detail is at risk management software for compliance.

The four framework pairings: shared requirement, additional duty, examining body, and outcome

Pairing	What both require	What only one of the two requires	Who examines the result	Outcome
NIS2 and ISO 27001	Risk management, supply chain security, incident handling, business continuity	NIS2: management body duties and the reporting chain. ISO 27001: statement of applicability and internal audit	NIS2: the competent national authority. ISO 27001: an accredited certification body	NIS2: no certificate, but registration and reports. ISO 27001: a certificate valid three years
GDPR and ISO 27001	Technical and organizational measures, risk assessment, vetting of processors	GDPR: record of processing activities, data subject requests, DPIA, data protection officer	GDPR: the supervisory authority. ISO 27001: an accredited certification body	GDPR: no certificate follows from ISO 27001, only via Article 42. ISO 27001: a certificate
GDPR and EU AI Act	Risk assessment before deployment, documentation, informing the people affected	EU AI Act: fundamental rights impact assessment under Article 27, AI literacy under Article 4, AI inventory	GDPR: the supervisory authority. EU AI Act: the market surveillance authority	No certificate. ISO 42001 is separately certifiable on a voluntary basis
DPIA and fundamental rights impact assessment	Trigger, methodology, documentation, repetition on material change	Protected object: rights and freedoms of natural persons versus health, safety, and fundamental rights	The supervisory authority	No certificate. The fundamental rights impact assessment complements the DPIA under Article 27(4)

How do you tell whether a platform covers multiple frameworks together?

Almost every platform now lists the same frameworks on its website. The difference lies in what of that is held in the system and what sits beside it as a template. Miriam Mindt names the point at which this is decided in the audit:

"A general misconception for many customers is that it's enough to have a policy in place instead of evidence that you are actually living the process that you're documenting in your policy."
Miriam Mindt, Information Security Expert at Kertos

Applied to several frameworks, that means a platform generating policies for seven frameworks without pulling the records from connected systems multiplies the documentation and not the evidence. Miriam Mindt also points out that ISO 27001 is by no means an IT matter alone; it creates work for HR, operations, and marketing, through information classification and training among other things. A platform connected only to the IT systems does not cover those records.

Selection criteria for a multi-framework platform, with the proof to ask for in the demo

Criterion	What to ask them to show you	How you know it only exists on paper
Control mapping	One control with the requirements from two frameworks side by side	The mapping sits in a spreadsheet next to the tool rather than in the tool
Origin of evidence	A record pulled from a connected system, with a timestamp	Records are uploaded screenshots with no source system
Separate risk objects	Two risks with different assessment criteria in the same register	Every risk runs through the same CIA scale
Framework coverage	Per framework, what the tool holds and in which outcome	A row of logos with no statement of what sits in the system
Roles across frameworks	One access review covering every framework in a single pass	A separate user list per framework
External expertise	Who takes the external CISO or DPO mandate, and under what contract	Expertise is offered only as consulting hours

The last criterion is where the difference sits that overviews of this category mostly fail to capture at all. Kertos pairs the platform with certified experts on its own team who take external CISO and DPO mandates, and pulls evidence through more than 300 integrations from the systems where it arises anyway. Customers describe that combination above all:

"Our main concern is not having to worry about our data protection, and Kertos solves that perfectly for us. Working together is straightforward, and I had a dedicated contact person at all times. The exchange with the whole team happened on an equal footing, which made coordination very pleasant."
Verified User in Health, Wellness and Fitness, G2, translated from German

"Kertos helps us carry out the ISO 27001 certification in an organised and structured way. It defines clear tasks and offers AI-supported suggestions tailored to our company structure."
Martin S., Agentic AI Engineer, G2, translated from German

When is Kertos not the right choice?

If you run exactly one framework and no second one is coming in the foreseeable future, a specialized tool is the smaller thing to learn. A platform for multiple frameworks brings more surface on day one and that shows up in reviews:

"At first the platform is a bit overwhelming and the benefits do not come through."
Verified User in Health, Wellness and Fitness, G2, translated from German

A second customer puts the same impression more briefly: "A bit overloaded" (Laurin H., G2, translated from German). Both reviews are positive overall; the objection is about getting started.

There is also a limit of substance. Kertos covers information security, data protection, and AI governance, which is ISO 27001, ISO 27701, ISO 42001, the GDPR, NIS2, the EU AI Act, SOC 2, TISAX, and C5. Quality management is not among them. One customer puts it as a wish in his G2 review: "It would be helpful to have a framework for implementing ISO 9001" (Alexander W., Managing Director, G2). If your selection project includes ISO 9001, you will need a second system for it.

And if you are building your compliance function entirely in house and want to award neither an external CISO nor a DPO mandate, you are paying at Kertos for part of an offering you will not draw on. The provider models for the external CISO are compared at providers for an external CISO mandate.

Frequently asked questions

What does moving from several single-framework tools to one platform cost?

The license price is the smaller item. Four cost blocks have to be planned for: the license, migration of the existing body of evidence, re-mapping the controls onto the new structure, and running both systems in parallel until the next audit. The parallel run is usually the largest of them, because both sets have to be maintained during that time. Plan the move for immediately after a passed audit rather than in the months before one. What Kertos costs depends on the number of frameworks and the extent of expert support; the prices are not public, and you can get an estimate through our contact page.

Can evidence from one framework be reused for another?

For the overlapping part yes, and that is the economic core of a multi-framework platform. An access log or a vendor contract can evidence an ISO 27001 control and a NIS2 requirement at the same time. ENISA does point out explicitly in its Technical Implementation Guidance that the mapping between the standards is not a measure of equivalency. So a reused record still has to satisfy the second framework's requirement in its own wording, and where the requirements diverge, a second record is needed.

How long does it take to add a second framework on an existing platform?

A defensible reference point for the first framework: AskUI reached ISO 27001 certification with Kertos in 8 to 10 weeks, without external consultants. For a second framework on an existing body of evidence, the build for the overlapping part falls away. Three factors set the remaining duration: how many requirements of the second framework have no counterpart in the first, whether an external examination is needed, and when the examining body has dates free. For ISO 27001, TISAX, SOC 2, and C5, that external date is regularly the longest single item.

Do we still need external expertise alongside the platform?

At two points this cannot be replaced by software. ISO 27001 requires, in clause 9.2, an internal audit by someone who did not build the area being audited. Miriam Mindt points out that in a company of around 40 people it is usually exactly the person who implemented the ISMS who holds the necessary qualification, which is why an external party suits the internal audit. And Article 37 GDPR requires, under certain conditions, the appointment of a data protection officer, a role only a person can take. Kertos supplies both roles as an external CISO and DPO mandate from its own team.

Across every certification Kertos has supported, the first-attempt pass rate is 100 percent, and companies report around 80 percent less manual compliance effort.