If you have already worked through ISO 27001 and then activate NIS2, you should not have to answer the same questions twice. Diri links the controls of every framework to a shared set of overarching concepts, such as access control or incident handling. Where a control in one framework and a control in another map to the same concept, the evidence you have for one can be reused for the other. This is cross-framework credit.
Credit is reusable evidence, not compliance. Evidence is offered, never applied automatically. Someone still has to confirm that it satisfies the control.
Only mappings where one control fully covers the other, and that have been reviewed, carry credit. Partial and related mappings are shown in the coverage view, but transfer no evidence.
When you activate a framework that shares controls with your existing work, Diri shows Reuse existing evidence, with how many controls overlap and how many items you would otherwise attach by hand.
The evidence is linked to the new controls, but they are not marked satisfied. Review each linked item against the new control's requirement before you rely on it.
A control that has reusable evidence shows a Cross-framework credit panel: "Already satisfied elsewhere — contributing evidence (confirm to satisfy here)".
In the control list, you can filter on Reusable evidence from … to see every control that has evidence waiting from a given framework. Select Clear filter to return to the full list.
Every credit is a claim: "your control in one framework also satisfies this requirement in another". Diri shows who makes that claim. The credit is shown as a chain of two steps: the source control maps to a concept, and the concept maps to this control. Each step has its own basis, and the chain is labelled with the weaker of the two.
| Badge | Meaning |
|---|---|
| Published source or Published by … | Both steps cite published literature written by the named body (for example a national authority's official crosswalk), not by Cyrigo. A citation makes the claim easier to defend, but never makes the control satisfied on its own. |
| Cyrigo assessed | At least one step rests on Cyrigo's own judgement rather than a published crosswalk. This is common: most frameworks have no official mapping to each other. The reasoning is shown so you can judge it on its merits. |
Under each step you see one of the following:
On the Frameworks page, select Cross-framework coverage. The page compares all your active frameworks:
Use Filters to narrow the table: Category, Only rows with reusable evidence, Show unmapped concepts and Fully mapped only. Use Columns to choose which frameworks to show.
You need at least two active frameworks to see overlap. If your active frameworks do not yet share any reviewed mappings, the page says so.
Select Mapping rationale on the coverage page for a printable account of why the controls in your frameworks are treated as related, and on whose authority: published crosswalks where they exist, Cyrigo's recorded reasoning where they do not. This is the document to give an auditor who asks why one control is used as evidence for another. It makes no claim about compliance; for that, use the framework's Audit Evidence Report.
Open the control and expand the credit chain with Show the reasoning behind this credit. It names either the publishing authority or Cyrigo, and shows the reasoning. For a printable version, use the mapping rationale report.
Because no published crosswalk covers that pair of controls. Most frameworks have no official mapping to each other. "Cyrigo assessed" is an honest label, not a weaker mapping, and the reasoning is shown so it can be judged.
No. Credit shows that evidence exists elsewhere. You decide whether it applies to this control.