| Pill | EU Directive · Mandatory · Oct 2024 | ISO/IEC 27001:2022 | DIN SPEC 27076 · BSI-Aligned · KMU | CIR · Incident Response · Crisis Management | ISO/IEC 42001:2023 · AI Governance |
|---|
| In one line | Mandatory for essential and important entities across 18 sectors. Enforced EU-wide since October 2024 with significant administrative penalties for non-compliance — up to €10M or 2% of global turnover. | The global benchmark for ISMS certification. Assesses your organisation's maturity against Annex A controls and clause requirements — whether you are preparing for Stage 1, Stage 2, or continuous improvement. | Germany's pragmatic cybersecurity baseline for small and medium enterprises. Purpose-built for fast, resource-efficient assessments — structured around the BSI Cyber Security Check. No CISO required to complete. | A focused readiness check for organisations preparing for the inevitability of a cyber incident. Assesses strategy, planning, operational reaction capability, and communication — the four dimensions that determine whether an incident is contained or becomes a crisis. | The first certifiable AI management standard. Assesses governance structures, AI risk and impact assessment frameworks, and responsible AI practices for organisations developing or deploying AI systems. |
|---|
| Domains assessed | 5 | 5 | 6 | 4 | 5 |
|---|
| Total questions | 18 | 20 | 27 | 25 | 18 |
|---|
| Domain coverage | - Governance & Management
- Risk Management
- Incident Response
- Supply Chain Security
- Technical Controls
| - Context & Leadership
- Risk Assessment
- Asset & Access Control
- Operations & Incident Management
- Performance & Improvement
| - Organisation & Awareness
- Identity & Access Management
- Data Backup
- Patch & Change Management
- Malware Protection
- IT Systems & Network
| - Strategy
- Planning
- Reaction
- Communication
| - AI Governance & Leadership
- AI Risk & Impact Assessment
- Data & Model Governance
- Transparency & Human Oversight
- Operations & Continual Improvement
|
|---|
| Why it matters | - Governance & management accountability (Article 20)
- Risk management measures (Article 21)
- Incident detection & 24-hour reporting obligations
| - ISMS scope definition & context of the organisation
- Risk assessment aligned with ISO 27005
- Asset management & access control
| - Organisational measures & roles
- IT systems & endpoint protection
- Network & perimeter security
| - Cyber strategy & ransomware payment posture
- Incident response plan & rehearsal cadence
- Detection, containment & recovery capability
| - AI governance structure & leadership accountability
- AI risk assessment & impact analysis
- Data management & data quality controls
|
|---|
| At a glance | 18 QuestionsAssessment ~10 minDuration Essential & Important EntitiesScope | 20 QuestionsAssessment ~12 minDuration All OrganisationsScope | 27 QuestionsAssessment ~15 minDuration SMB / KMUScope | 25 QuestionsAssessment ~12 minDuration All OrganisationsScope | 18 QuestionsAssessment ~10 minDuration AI Developers & UsersScope |
|---|
| Framework page | Learn more → | Learn more → | Learn more → | Learn more → | Learn more → |
|---|
| | START NIS2 assessment | START ISO 27001 assessment | START DIN SPEC 27076 assessment | START Cyber Incident Readiness assessment | START ISO 42001 assessment |
|---|