Frameworks
Built on NIST. Mapped to the rest.
NURA’s control library starts from NIST SP 800-53 and maps each control to the requirements of the other frameworks you answer to. Do the work once and report it to each of them.
Frameworks NURA maps to.
NIST SP 800-53 Rev 5
The foundation. Required for US federal systems.
NIST Cybersecurity Framework 2.0
A common way to describe a security program to boards and partners.
ISO/IEC 27001:2022
The international standard enterprise buyers ask for.
SOC 2
The report US customers expect from software vendors.
PCI DSS v4.0
For anyone who stores, processes or transmits card data.
HIPAA Security Rule
For US health data and the vendors who handle it.
GDPR
For personal data of people in the EU.
CIS Controls v8
A prioritized starting set of safeguards.
CSA Cloud Controls Matrix v4
Security controls for cloud providers and their customers.
COBIT 2019
IT governance for boards and auditors.
NIST AI RMF 1.0
Managing risk in AI systems.
Reports export in OSCAL, the machine-readable format US government assessors use.
How the mapping works.
Implement on NIST
Your controls follow NIST SP 800-53, the most detailed catalog to build on.
Five controls are implemented on NIST SP 800-53; the NIST column fills.
NURA maps it
Each control is linked to the matching requirements in every other framework.
Each control is mapped across ISO 27001, SOC 2, PCI DSS, HIPAA and NIST CSF; 29 of 30 cells light up.
Collect once
One piece of evidence counts toward every requirement it satisfies.
One piece of evidence per control runs across its row and every mapped requirement turns green: five pieces of evidence answer 29 requirements.
Report per framework
Pick a framework and get its readiness report from current data.
Each framework column shows its total and a report button.
Example
One control, six frameworks.
ControlMulti-factor authentication for admin accounts
| Framework | Requirement |
|---|---|
| NIST SP 800-53 Rev 5 | IA-2(1)Multi-factor authentication to privileged accounts |
| ISO/IEC 27001:2022 | A.8.5Secure authentication |
| SOC 2 | CC6.1Logical access security |
| PCI DSS v4.0 | 8.4.1MFA for administrative access |
| HIPAA Security Rule | 164.312(d)Person or entity authentication |
| NIST CSF 2.0 | PR.AA-03Users and services are authenticated |
One control, one set of evidence, six frameworks answered.
NURA gets you ready. Your auditor signs off.
NURA prepares the evidence and the readiness reports. Certification and attestation still come from your auditor or assessor, and they can check every piece of evidence themselves.
See your frameworks in NURA.
Tell us which frameworks you answer to and we’ll show you how much of the work overlaps.