Frameworks
Activate the frameworks that apply to you
NOVA maps requirements from each framework onto a shared control set. Evidence collected once can support multiple frameworks where it genuinely satisfies the control.
Choosing a starting point
Not sure which framework to explore first?
Answer a few practical questions and receive preliminary framework suggestions based on the verified public catalogue.
Available now
Ready to activate
Service organisation reporting against the Trust Services Criteria, used widely in enterprise procurement.
The international standard for an information security management system, certified by an accredited body.
Eight prioritised mitigation strategies published by the Australian Cyber Security Centre, assessed by maturity level.
The management system standard for artificial intelligence, covering governance of AI systems across their lifecycle.
Available by configuration
Extend the programme to the requirements you govern
These frameworks are available by configuration when the relevant systems, records and evidence are supplied for review.
Regulatory privacy requirements for organisations handling personal data in the EU/EEA and related contexts.
Payment-card security readiness for environments that store, process or transmit cardholder data.
US healthcare privacy, security and breach-notification readiness for covered entities and business associates.
US defence-industrial cybersecurity readiness across CMMC practices, scope, evidence and assessment preparation.
Custom framework available
Bring requirements beyond the standard library
NOVA can structure additional customer, contractual, regulatory or internal requirements as a governed framework, with human-reviewed mappings and evidence decisions.
Global register
Frameworks by region
A regional view of the major compliance frameworks and regulatory regimes relevant to NOVA customers. Eredox is headquartered in Australia and its service scope is worldwide.
Global and cross border
Major frameworks and regimes encountered across every market. Confirm applicability for each customer engagement.
| Framework | Jurisdiction | Primary subject | NOVA relevance | Priority |
|---|---|---|---|---|
| ISO/IEC 27001:2022 | International | Information security management system requirements | Core product framework for governance, controls, evidence, risk treatment and certification readiness. | Core |
| ISO/IEC 27701 | International | Privacy information management extension to ISO 27001 | Supports privacy control mapping, processor and controller accountability and global privacy operations. | Core |
| ISO 22301 | International | Business continuity management | Supports continuity objectives, recovery plans, exercises and resilience evidence. | Core |
| NIST Cybersecurity Framework 2.0 | International / US origin | Cybersecurity risk governance and outcomes | Crosswalk framework for customers using NIST terminology. | Core |
| NIST SP 800-53 Rev 5 | International / US origin | Security and privacy controls | Detailed control library for implementation, inheritance and evidence mapping. | Core |
| NIST SP 800-30 Rev 1 | International / US origin | Information security risk assessment | Method for threat, vulnerability, likelihood, impact and risk assessment. | Core |
| CIS Controls v8.1 | International | Prioritised technical safeguards | Practical baseline for smaller customers and technical evidence collection. | Core |
| SOC 2 Trust Services Criteria | International / AICPA | Service organisation controls | Customer assurance and Trust Center evidence model. Not a government law. | Core |
| COBIT 2019 | International / ISACA | IT governance and management objectives | Governance crosswalk for enterprise and audit customers. | Reference |
| PCI DSS v4.0.1 | International / payment cards | Protection of payment card data | Sector-triggered where cardholder data is stored, processed or transmitted. | Sector |
| FATF Recommendations | International / AML CFT | Anti-money laundering and counter-terrorist financing | Anchor for AML and CTF content, risk assessment and customer due diligence. | Sector |
| CSA Cloud Controls Matrix v4 | International | Cloud security controls and shared responsibility | Cloud provider and SaaS assurance crosswalk. | Reference |
Cross-market or foundational. Prioritised in the catalogue, control library, crosswalks, evidence and reporting.
Triggered by sector or activity. Supported as an add-on with applicability assessment and sector evidence.
Voluntary or mapping aid. Used for crosswalks, procurement and assurance, never presented as certification.
This register is a product catalogue and discovery baseline, not a certification or legal opinion. Applicability depends on customer country, sector, data, service and contractual role.
Readiness
Illustrative readiness reporting
Illustrative interface concept. Values shown are examples, not customer data.
- Controls mapped across activated frameworks
- Evidence status shown by control and requirement
- Gaps surfaced before an external assessment
- Freshness expectations keep evidence current
Example readiness snapshot
Readiness
Readiness
Maturity coverage
Readiness
NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.
See NOVA against your own compliance obligations
Explore the governed Free access path, or walk through your framework, evidence and reporting requirements with us.
NOVA accelerates your launch preparation, but final decisions remain human.