GOV-02Governance and Accountability
Approved policy set
Policies covering the organization's obligations are approved, dated, owned and reviewed on a stated cycle.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ○ AIRMF ●
One objective. Many frameworks. Honest gaps.
DTCF normalises what an organization must achieve into 13 objectives across 10 families, then maps each to the frameworks practitioners face. Mappings are graded: fully addressed, partially addressed, or deliberately absent with the reason recorded. An empty cell is a finding about the framework, not a gap in your programme.
DTCF 2026.1 · published 10 Sep 2026 · CC BY 4.0 · free to use with attribution
13Objectives
312Graded mappings
49Deliberate absences
8Frameworks
All families Governance and Accountability 4 Risk and Decisions 4 Obligations and Compliance 3 Data and Privacy 4 Identity and Access 4 Secure Operations 5 Third Parties and Supply Chain 3 Resilience and Response 4 AI and Automated Decisions 3 Assurance and Evidence 5
Any framework SOC2 31 full · 5 partial · 3 none ISO27001 30 full · 6 partial · 3 none NISTCSF 31 full · 6 partial · 2 none PCIDSS 27 full · 7 partial · 5 none HIPAA 22 full · 10 partial · 7 none GDPR 11 full · 19 partial · 9 none EUAIACT 10 full · 16 partial · 13 none AIRMF 22 full · 10 partial · 7 none
RSK-03Risk and Decisions
Acceptances expire
Accepted risks and control exceptions carry an accountable executive, a compensating control and an expiry date.
SOC2 ◐ ISO27001 ◐ NISTCSF ◐ PCIDSS ◐ HIPAA ○ GDPR ○ EUAIACT ○ AIRMF ◐
DAT-03Data and Privacy
Deliberate data sharing
Data leaves the organization only through a decided channel, with a defined end and a record of what was shared.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ● EUAIACT ○ AIRMF ◐
DAT-04Data and Privacy
Complete disposal
Data is removed from primary systems, backups, caches, exports and third parties when it is no longer needed or on request.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ● EUAIACT ○ AIRMF ○
ACC-01Identity and Access
Joiners, movers, leavers
Access is provisioned on a documented request, changed when a role changes and removed promptly on departure.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ○ AIRMF ◐
ACC-02Identity and Access
Access reviewed on a cadence
Entitlements are reviewed by someone who can judge them, with revocations tracked to completion.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ○ AIRMF ○
ACC-03Identity and Access
Strong authentication
Authentication is proportionate to risk, with multi-factor authentication on administrative and remote access.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ◐ GDPR ◐ EUAIACT ○ AIRMF ○
ACC-04Identity and Access
Privileged access controlled
Administrative access is limited, separately approved, monitored and time-bound where possible.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ◐ GDPR ○ EUAIACT ○ AIRMF ○
OPS-04Secure Operations
Endpoint and device protection
Devices with access to organizational data are hardened, patched, encrypted and recoverable.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ● GDPR ◐ EUAIACT ○ AIRMF ○
RES-03Resilience and Response
Backups that restore
Backups exist, are protected from the same failure as production, and restoration is tested.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ◐ HIPAA ● GDPR ● EUAIACT ○ AIRMF ◐
RES-04Resilience and Response
Continuity and recovery objectives
Critical processes have recovery objectives, a continuity plan and a tested route back to service.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ○ HIPAA ● GDPR ◐ EUAIACT ○ AIRMF ◐
ASR-01Assurance and Evidence
Controls have owners
Every control has one accountable owner and named performers for its tasks.
SOC2 ● ISO27001 ● NISTCSF ● PCIDSS ● HIPAA ◐ GDPR ○ EUAIACT ○ AIRMF ●
ASR-02Assurance and Evidence
Populations are complete
Where a control is tested by sample, the population is defined and its completeness can be demonstrated.
SOC2 ◐ ISO27001 ◐ NISTCSF ○ PCIDSS ● HIPAA ○ GDPR ○ EUAIACT ○ AIRMF ○
How DTCF is governed
First edition. Objectives are normalised statements of what an organization must achieve. Mappings are graded: full, partial, or a recorded absence with the reason it is absent. An empty cell is a finding about the framework, not about the objective.
- authorAssociation of Digital Trust Practitioners Authors and maintains DTCF. The framework is published free under CC BY 4.0 and is not tied to any product.
- sponsoring contributorA sponsoring contributor A sponsoring contributor to the 2026.1 edition contributed mapping research and review. Sponsors do not own or control DTCF; like any vendor they may state conformance to it.
Framework names and references are the property of their publishers. DTCF is an independent mapping and is not endorsed by them. Corrections are welcome through the contact form and are published in the edition changelog.