Laws, Frameworks, Standards, Controls: How They Actually Fit Together

Part of the pillar series Sovereignty You Can Actually Operate.

This is practical guidance for compliance teams, not legal advice. Current as of July 2026.

"Are we ISO compliant?" is one of the most common questions in a compliance program, and it contains a category error. You don't comply with ISO. ISO is a way to demonstrate that you comply with something else: the law. Getting this distinction right is the difference between a program that scales and one that spins.

The four-layer stack

Here is the mental model to keep. It has exactly four layers, and each answers a different question.

A law tells you what. A framework shows you how. A control is the doing. Evidence is the proof. Miss any layer and you have a gap: an obligation with no framework is guesswork; a framework with no controls is a binder; controls with no evidence are a claim.

Frameworks are not laws, and that's the point

Frameworks make laws implementable and auditable. Crucially, they differ in how they're assured, and buyers conflate these constantly:

• ISO standards are certifiable. An accredited third party audits you and issues a certificate (ISO/IEC 27001 for security, ISO/IEC 27701 for privacy, ISO/IEC 42001 for AI).
• NIST frameworks are voluntary and self-assessed. NIST CSF 2.0, the Privacy Framework, and the AI RMF are designed to be flexible and, importantly, mapping-friendly: NIST explicitly publishes "informative references" so one framework's controls map to another's.
• SOC 2 is an attestation. A licensed accountant issues a report on your controls against the Trust Services Criteria.

None of these is legal compliance. Each is a recognized way to demonstrate it. A regulator doesn't accept "we hold ISO 27001" as a defense to a GDPR breach, but a well-run ISO 27001 program is exactly the evidence that shows you met GDPR's "security of processing" obligation (Article 32).

Which frameworks map to which laws

You don't pick a framework in a vacuum; you pick the one that best demonstrates the laws that apply to you.

(Framework mappings are how you operationalize a law; they are not, by themselves, legal compliance. Sources: NIST, ISO.)

Start with the question everyone skips: does this even apply to me?

This is the mental model behind the whole compliance series. Before any of this, one step decides whether you're solving the right problem: scoping. In our reading of these five laws, the biggest compliance risk isn't ignorance of a law; it's misjudging how a law binds you. You fall under GDPR because you process EU personal data; under NIS2 because of your sector and size; under DORA because you're a regulated financial entity; under the CRA because you place a digital product on the EU market; under the AI Act because you provide or deploy AI. Different triggers, different scopes. "We cover cybersecurity" is not a compliance claim.

Where Soveryne fits

The two-layer nature of this problem maps cleanly onto two jobs.

The first is coverage intelligence: what applies to me, and what exactly does it require? That's Counsel: ask a plain-language question ("does GDPR Article 32 require encryption?") and get an answer drawn from the frameworks themselves (GDPR, NIS2, DORA, ISO/IEC, NIST) with every claim cited so you can verify it, not trust it.

The second is proof of implementation: show me the controls and the evidence. That's Command: enroll the frameworks that apply to you and it drafts the controls, maps each one to the framework requirements it satisfies, and tracks the evidence, so the four-layer stack (law → framework → control → evidence) is connected and inspectable rather than scattered across spreadsheets. Command even lets you compare two frameworks side by side to see exactly where they overlap.

Get the vocabulary right, and the tooling follows: Counsel answers what; Command proves how.

FAQ

What's the difference between a law and a framework? A law is a binding obligation (GDPR, NIS2). A framework or standard (ISO 27001, NIST CSF) is a structured, often certifiable method for meeting and demonstrating that obligation. Frameworks aren't laws; they help you comply with them.

Is ISO 27001 the same as being GDPR compliant? No. ISO 27001 certifies your information-security management system. It's strong evidence toward GDPR's security-of-processing requirement, but GDPR has obligations (rights, lawful basis, transfers) that ISO 27001 alone doesn't cover. ISO/IEC 27701 addresses the privacy side.

ISO vs NIST vs SOC 2: which should I use? ISO is certifiable and international; NIST is voluntary, flexible, and mapping-friendly; SOC 2 is a US-style attestation for customer assurance. Many organizations use several, mapped to a single control set to avoid duplicate work.

How do I know which laws apply to my organization? By scoping against each law's trigger: personal data (GDPR), sector + size (NIS2), financial-entity status (DORA), placing digital products on the EU market (CRA), providing/deploying AI (AI Act).

Know the layers, then connect them. Get cited answers on what a rule requires with Counsel, and map obligations to evidenced controls with Command.

Sources

• NIST Cybersecurity Framework 2.0 (informative references / mappings): https://www.nist.gov/cyberframework
• ISO, standards catalogue (27001, 27701, 42001): https://www.iso.org/
• NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
• GDPR, Article 32 (security of processing): https://eur-lex.europa.eu/eli/reg/2016/679/oj