RSK-01Risk and Decisions
Risk assessment performed and repeated
Risks to objectives are identified and assessed on a defined cadence and on material change.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ● AIRMF ●
One objective. Many frameworks. Honest gaps.
DTCF normalises what an organization must achieve into 10 objectives across 10 families, then maps each to the frameworks practitioners face. Mappings are graded: fully addressed, partially addressed, or deliberately absent with the reason recorded. An empty cell is a finding about the framework, not a gap in your programme.
DTCF 2026.1 · published 10 Sep 2026 · CC BY 4.0 · free to use with attribution
10Objectives
312Graded mappings
49Deliberate absences
8Frameworks
All families Governance and Accountability 4 Risk and Decisions 4 Obligations and Compliance 3 Data and Privacy 4 Identity and Access 4 Secure Operations 5 Third Parties and Supply Chain 3 Resilience and Response 4 AI and Automated Decisions 3 Assurance and Evidence 5
Any framework SOC2 31 full · 5 partial · 3 none ISO27001 30 full · 6 partial · 3 none NISTCSF 31 full · 6 partial · 2 none PCIDSS 27 full · 7 partial · 5 none HIPAA 22 full · 10 partial · 7 none GDPR 11 full · 19 partial · 9 none EUAIACT 10 full · 16 partial · 13 none AIRMF 22 full · 10 partial · 7 none
RSK-02Risk and Decisions
Risk register with owners and treatment
Risks are recorded with inherent and residual judgement, an owner, a treatment decision and a review date.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ◐ HIPAA ● GDPR ○ EUAIACT ● AIRMF ●
OBL-03Obligations and Compliance
Training and awareness
People receive role-relevant training on joining and at a defined cadence, and completion is evidenced.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ● AIRMF ●
OPS-03Secure Operations
Logging and monitoring
Security-relevant events are logged, retained and reviewed, with alerts that reach a person who acts.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ● AIRMF ●
OPS-05Secure Operations
Secure development
Security requirements, review and testing are part of how software is built and released.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ○ GDPR ◐ EUAIACT ● AIRMF ◐
RES-02Resilience and Response
Breach notification within statutory time
Reportable incidents are assessed and notified to regulators and affected people within the applicable deadlines.
SOC2 ◐ ISO27001 ◐ NISTCSF ● PCIDSS ◐ HIPAA ● GDPR ● EUAIACT ● AIRMF ○
AIG-01AI and Automated Decisions
AI system inventory
AI and automated decision systems in use are inventoried with purpose, owner, data and risk classification.
SOC2 ○ ISO27001 ○ NISTCSF ◐ PCIDSS ○ HIPAA ○ GDPR ◐ EUAIACT ● AIRMF ●
AIG-02AI and Automated Decisions
AI risk assessed before deployment
AI systems are assessed for harm, bias, robustness and transparency before use, and the assessment is revisited on change.
SOC2 ○ ISO27001 ○ NISTCSF ◐ PCIDSS ○ HIPAA ○ GDPR ◐ EUAIACT ● AIRMF ●
AIG-03AI and Automated Decisions
Human oversight and disclosure
People affected by automated decisions are told, and a competent person can intervene.
SOC2 ○ ISO27001 ○ NISTCSF ○ PCIDSS ○ HIPAA ○ GDPR ● EUAIACT ● AIRMF ●
ASR-03Assurance and Evidence
Evidence is dated, attributable and retained
Evidence shows what was done, by whom and when, and is kept for the period the obligation requires.
SOC2 ● ISO27001 ● NISTCSF ◐ PCIDSS ● HIPAA ● GDPR ● EUAIACT ● AIRMF ●
How DTCF is governed
First edition. Objectives are normalised statements of what an organization must achieve. Mappings are graded: full, partial, or a recorded absence with the reason it is absent. An empty cell is a finding about the framework, not about the objective.
- authorAssociation of Digital Trust Practitioners Authors and maintains DTCF. The framework is published free under CC BY 4.0 and is not tied to any product.
- sponsoring contributorA sponsoring contributor A sponsoring contributor to the 2026.1 edition contributed mapping research and review. Sponsors do not own or control DTCF; like any vendor they may state conformance to it.
Framework names and references are the property of their publishers. DTCF is an independent mapping and is not endorsed by them. Corrections are welcome through the contact form and are published in the edition changelog.