Certification

certifiable management systems

independent audit passes or fails certification

• ISO-27001
• ISO-9001
• germany
  • BSI-IT-Grundschutz
  • KRITIS -> becomes NIS2
• netherlands
  • NEN-7510 -> healthcare, ISO 27001 + sector delta (legally required)

attestation reports

an auditors “opinion” over a period, not pass/fail

• SOC2-type2
• BSI-C5
• ISAE 3000

legal obligations

not certifyable, it’s law and you must comply

• NIS2
• Cyber Resilience Act
• DORA
• PCI-DSS

control catalogues / reference frameworks

you implement these through one of the instruments

• CSA-CCM