Vendorapp › OpenVMO › Crosswalk
The OpenVMO crosswalk. One vendor programme, five frameworks.
Most startups are asked about their vendors by more than one framework: SOC 2 for US customers, ISO 27001 for European ones, and NIS2 or DORA as soon as they sell to regulated companies. The crosswalk shows where each OpenVMO domain meets the related requirements in SOC 2, ISO 27001:2022, NIS2, DORA and NIST CSF 2.0, so you can run one programme and point each auditor to the same evidence.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
The mapping
Each domain, and where the frameworks deal with it.
| OpenVMO domain | SOC 2 | ISO 27001:2022 | NIS2 | DORA | NIST CSF 2.0 |
|---|---|---|---|---|---|
| GOV: Governance and ownership | CC9.2, CC1.3, CC3.1 | A.5.19, A.5.2; clauses 5.2, 6.1, 9.3 | Art. 20; Art. 21(2)(d); CIR 2024/2690 Annex §5.1 | Art. 5; Art. 28(2); RTS 2024/1773 | GV.SC-01, GV.SC-02, GV.SC-03 |
| INV: Vendor inventory | CC9.2 | A.5.19, A.5.9 | Art. 21(3); CIR 2024/2690 Annex §5.2 | Art. 28(3); ITS 2024/2956 (register of information) | GV.SC-04 |
| INT: Intake and onboarding | CC9.2, CC6.1 | A.5.19, A.5.23 | CIR 2024/2690 Annex §5.1 | Art. 28(4) | GV.SC-06 |
| TIER: Risk tiering | CC9.2, CC3.2 | A.5.19, A.5.21 | Art. 21(3) | Art. 28(4); Art. 3(22) (critical or important function) | GV.SC-04 |
| DD: Due diligence | CC9.2, CC3.2 | A.5.19, A.5.21, A.5.23 | Art. 21(3) | Art. 28(4), Art. 28(5) | GV.SC-06 |
| CON: Contracts | CC9.2, CC2.3 | A.5.20, A.5.23 | CIR 2024/2690 Annex §5.1 | Art. 30 | GV.SC-05 |
| MON: Ongoing monitoring | CC9.2, CC4.1 | A.5.22 | CIR 2024/2690 Annex §5.1 | Art. 28(6); Art. 29 | GV.SC-07, GV.SC-09 |
| FP: Fourth parties and supply chain | CC9.2 (subservice organisations) | A.5.21 | Art. 21(3) | Art. 29; Art. 30(2)(a); RTS on subcontracting | GV.SC-07 |
| INC: Third-party incidents | CC7.3–CC7.5, CC9.2 | A.5.24–A.5.26 | Art. 21(2)(b); Art. 23 | Art. 17–19 | GV.SC-08 |
| EXIT: Offboarding and exit | CC9.2, CC6.2, CC6.5 | A.5.20, A.5.22, A.8.10 | CIR 2024/2690 Annex §5.1 | Art. 28(7), Art. 28(8) | GV.SC-10 |
| MET: Metrics and reporting | CC4.1, CC4.2 | Clauses 9.1, 9.3 | Art. 21(2)(f) | Art. 6(6); Art. 28(2) | GV.OV, GV.SC-09 |
The crosswalk CSV repeats this mapping for each of the 47 practices, so it can be imported into a spreadsheet or a compliance tool. It is CC0: use it however you like.
Reading it
What the references mean.
| Framework | What is referenced |
|---|---|
| SOC 2 | AICPA Trust Services Criteria (2017, revised points of focus 2022). CC9.2 is the vendor and business-partner criterion; others are cited where the same topic appears. |
| ISO/IEC 27001:2022 | Annex A controls A.5.19 to A.5.23 cover supplier relationships; clause numbers refer to the management-system requirements. |
| NIS2 | Directive (EU) 2022/2555, mainly Articles 20, 21 and 23, and the supply-chain section of Implementing Regulation (EU) 2024/2690. |
| DORA | Regulation (EU) 2022/2554, mainly Articles 28 to 30 on ICT third-party risk, with the register of information (ITS 2024/2956) and the policy standard (RTS 2024/1773). |
| NIST CSF 2.0 | The GV.SC (cybersecurity supply chain risk management) outcomes, GV.SC-01 to GV.SC-10. |
The crosswalk is informative, not legal advice. It shows where each framework deals with the same topic; it does not say that meeting an OpenVMO practice satisfies a legal requirement. It cites control and article numbers and does not reproduce copyrighted control text. Check the primary text for anything you rely on.
Using it
One programme, several audits.
- Map your evidence once, to OpenVMO practice IDs, rather than separately for each framework.
- When an auditor asks about CC9.2 or A.5.19, show the register, the tiering and the diligence records for the practices that map to it.
- For a DORA or NIS2 customer, use the same mapping to show where their requirements are already covered, and what the Level 3 practices add.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.