Digital Trust Common Framework · Edition 2026.1
One control language for every framework you answer to.
SOC 2, ISO 27001, NIST, PCI, HIPAA, GDPR and the AI rules all ask for many of the same things in different words. DTCF writes each thing once, as an objective, and shows exactly where every framework asks for it, where it only partly does, and where it says nothing at all.
Free to use under CC BY 4.0, with attribution.
How to read DTCF
One objective, 8 answers.
Every DTCF objective works the same way. Here is one of the 39, exactly as the framework records it.
Strong authentication
Authentication is proportionate to risk, with multi-factor authentication on administrative and remote access.
Authentication configuration, MFA coverage report, exceptions.
Credential theft remains the most common entry point.
- SOC 2FullCC6.1
- ISO 27001FullA.8.5
- NIST CSFFullPR.AA-03
- PCI DSSFull8.4
- HIPAAPartial164.312(d) Person or entity authentication without specifying factors.
- GDPRPartialArt. 32 Through appropriate measures.
- EU AI ActAbsent Not addressed.
- NIST AI RMFAbsent Not addressed at control level.
Read it this way: build the control once against the objective, keep the evidence once, and cite the clause each auditor asks about. Where a framework is partial, the note says what it leaves out. Where it is absent, that is a finding about the framework, not a gap in your program.
The coverage map
All 39 objectives against all 8 frameworks.
Each square is one graded mapping. Hover for the clause, or the reason it is absent. Select an objective to open it.
What the map shows
Three things most programs learn the hard way.
SOC 2 and ISO 27001 overlap almost completely
Both fully address the same 30 objectives. A team with a clean SOC 2 already runs most of the controls ISO 27001 Annex A asks for. ISO also requires its management-system clauses, which DTCF does not map; that is where most of the remaining work sits.
Your security certification says nothing about your AI
SOC 2, ISO 27001 Annex A, PCI DSS and HIPAA address none of the 3 AI objectives. NIST CSF touches 2, only in part, through general asset and risk practices. The EU AI Act and NIST AI RMF fully cover all of them.
A common core every framework asks for
16 objectives are addressed, fully or in part, by all 8 frameworks, across governance and accountability, risk and decisions, obligations and compliance, data and privacy, secure operations and more. Get these right first.
Already certified?
See how far one framework takes you toward another.
Each number is how many DTCF objectives both frameworks fully address. Read across from what you have, down to what you are asked for next. The diagonal is each framework's own total.
Example: from PCI DSS (27 objectives) to SOC 2, 25 are already shared. From GDPR to the EU AI Act, only 3.
| SOC 2 | ISO 27001 | NIST CSF | PCI DSS | HIPAA | GDPR | EU AI Act | NIST AI RMF | |
|---|---|---|---|---|---|---|---|---|
| SOC 2 | 31 | 30 | 29 | 25 | 20 | 8 | 6 | 18 |
| ISO 27001 | 30 | 30 | 29 | 25 | 19 | 8 | 6 | 17 |
| NIST CSF | 29 | 29 | 31 | 24 | 19 | 8 | 6 | 17 |
| PCI DSS | 25 | 25 | 24 | 27 | 16 | 8 | 5 | 14 |
| HIPAA | 20 | 19 | 19 | 16 | 22 | 8 | 6 | 12 |
| GDPR | 8 | 8 | 8 | 8 | 8 | 11 | 3 | 5 |
| EU AI Act | 6 | 6 | 6 | 5 | 6 | 3 | 10 | 8 |
| NIST AI RMF | 18 | 17 | 17 | 14 | 12 | 5 | 8 | 22 |
The 8 frameworks
What each one covers, and what it leaves to you.
31 full · 5 partial · 3 absent
Complete onGovernance and Accountability, Obligations and Compliance, Identity and Access
Silent onAI and Automated Decisions
30 full · 6 partial · 3 absent
Complete onObligations and Compliance, Identity and Access, Secure Operations
Silent onAI and Automated Decisions
31 full · 6 partial · 2 absent
Complete onObligations and Compliance, Identity and Access, Secure Operations
27 full · 7 partial · 5 absent
Complete onData and Privacy, Identity and Access, Secure Operations
Silent onAI and Automated Decisions
22 full · 10 partial · 7 absent
Complete onGovernance and Accountability, Resilience and Response
Silent onAI and Automated Decisions
11 full · 19 partial · 9 absent
Complete onData and Privacy, Third Parties and Supply Chain
10 full · 16 partial · 13 absent
Complete onAI and Automated Decisions
Silent onIdentity and Access
22 full · 10 partial · 7 absent
Complete onGovernance and Accountability, Obligations and Compliance, AI and Automated Decisions
The 10 families
Everything a trust program has to achieve, in 10 parts.
Someone is accountable, decisions are recorded, and the program is directed rather than improvised.
GOV-01Accountable owner for digital trustGOV-02Approved policy setGOV-03Roles and responsibilities definedGOV-04Code of conduct and ethics affirmation
Uncertainty is identified, judged and treated, and acceptances expire.
RSK-01Risk assessment performed and repeatedRSK-02Risk register with owners and treatmentRSK-03Acceptances expireRSK-04Appetite and indicators
The obligations that apply are known, owned and demonstrably met.
Courses that teach itData is known, classified, minimized, shared deliberately and disposed of completely.
DAT-01Data inventory and classificationDAT-02Lawful, minimized processingDAT-03Deliberate data sharingDAT-04Complete disposal
Access is granted deliberately, reviewed and removed.
ACC-01Joiners, movers, leaversACC-02Access reviewed on a cadenceACC-03Strong authenticationACC-04Privileged access controlled
Change, configuration, logging, vulnerabilities and endpoints are managed.
OPS-01Change managementOPS-02Vulnerability managementOPS-03Logging and monitoringOPS-04Endpoint and device protectionOPS-05Secure development
Third parties are assessed, contracted, monitored and offboarded.
TPR-01Third-party inventoryTPR-02Due diligence proportionate to riskTPR-03Contractual terms and offboarding
Incidents are detected and handled; the organization can continue and recover.
RES-01Incident response plan and rolesRES-02Breach notification within statutory timeRES-03Backups that restoreRES-04Continuity and recovery objectives
AI systems are inventoried, assessed, governed and monitored.
AIG-01AI system inventoryAIG-02AI risk assessed before deploymentAIG-03Human oversight and disclosure
Controls are owned, tested, evidenced and reported honestly.
ASR-01Controls have ownersASR-02Populations are completeASR-03Evidence is dated, attributable and retainedASR-04Independent testing and reportingASR-05Findings are closed with evidence
Use it
Free, open and yours to build on.
Download the whole framework, with every mapping, clause and recorded absence, under CC BY 4.0. Use it to scope an audit, plan a second certification, or explain to a board why one control satisfies five requirements.
- Scope an auditSee which objectives a framework actually tests before the auditor arrives.
- Plan the next certificationStart from what you share and build only the difference.
- Map your own controlsTag each control to an objective once and report against any framework.
- Learn the workEach family links to the Academy courses that teach it.
How DTCF is governed
First edition. Objectives are normalized statements of what an organization must achieve. Mappings are graded: full, partial, or a recorded absence with the reason it is absent. An empty cell is a finding about the framework, not about the objective.
- authorAssociation of Digital Trust Practitioners Authors and maintains DTCF. The framework is published free under CC BY 4.0 and is not tied to any product.
- sponsoring contributorA sponsoring contributor A sponsoring contributor to the 2026.1 edition contributed mapping research and review. Sponsors do not own or control DTCF; like any vendor they may state conformance to it.
DTCF 2026.1, published September 10, 2026. Framework names and references are the property of their publishers. DTCF is an independent mapping and is not endorsed by them. Corrections are welcome through the contact form and are published in the edition changelog.