Regulations the auditor pack maps to

The seven frameworks the Export for auditors pack can map a simulation to, which control each line answers, and what the pack does and does not claim.

The Export for auditors pack can include a mapping table. For each framework you tick, it prints the control, what that control asks for, and which section of the pack is the evidence. See Export for auditors.

This page is not legal advice, and it is not a claim of certification. A vishing test is evidence that supports a control. It never makes anyone compliant.

​

The seven frameworks

Framework	Full name	Who usually asks
NIS2	Directive (EU) 2022/2555 (NIS2)	EU essential and important entities, and their national regulators
DORA	Regulation (EU) 2022/2554 (Digital Operational Resilience Act)	EU financial entities and their supervisors
ISO 27001:2022	ISO/IEC 27001:2022, Annex A controls	Certification auditors and customers who ask for the certificate
PCI DSS 4.0	PCI DSS v4.0 and v4.0.1, Requirement 12.6	Qualified security assessors and acquiring banks
Cyber Essentials	UK Cyber Essentials (NCSC)	UK customers, public sector buyers and insurers
Cyber insurance	Cyber insurance application and renewal questions	Underwriters and brokers
Jersey (JFSC)	JFSC Codes of Practice and the Cyber Security (Jersey) Law 2026	The Jersey Financial Services Commission and the Jersey Cyber Security Centre

​

The pack sections

Number	Section
1	Scope and dates
2	Method
3	Who was tested
4	Results
5	Teaching delivered
6	Fixes and planned retest

​

What each framework maps to

NIS2

Control	What it asks for	Evidence
Article 21(2)(g)	Basic cyber hygiene practices and cybersecurity training	Section 5, Teaching delivered
Article 21(2)(f)	Policies and procedures to assess the effectiveness of risk-management measures	Section 4, Results

DORA

Control	What it asks for	Evidence
Article 13(6)	ICT security awareness programmes and resilience training as compulsory modules	Section 5, Teaching delivered
Article 24(1) and 24(2)	A sound and comprehensive resilience testing programme with a range of tests	Section 1, Scope and dates
Article 25(1)	Appropriate tests, including scenario-based tests and penetration testing	Section 2, Method

ISO 27001:2022

Control	What it asks for	Evidence
Annex A 6.3	Security awareness, education and training for each role, with regular updates	Section 5, Teaching delivered
Annex A 5.36	Compliance with policies and rules is reviewed, and non-compliance is found and corrected	Section 4, Results

PCI DSS 4.0

Control	What it asks for	Evidence
Requirement 12.6.3.1	Awareness training that covers phishing, related attacks and social engineering. Required from 31 March 2025	Section 5, Teaching delivered
Requirement 12.6.2	The awareness programme is reviewed at least once every 12 months	Section 6, Fixes and planned retest

Cyber Essentials

Control	What it asks for	Evidence
Not a control	Cyber Essentials covers five technical controls and does not test staff. Buyers and insurers who ask for the certificate often ask for social engineering testing alongside it	Section 1, Scope and dates

Cyber insurance

Control	What it asks for	Evidence
Simulations and their frequency	Whether you run social engineering simulations, how often, and what the results are	Section 1, Scope and dates
Reports and behavioural trends	Whether you can show the programme ran and how behaviour changed over time	Section 4, Results

Jersey (JFSC)

Control	What it asks for	Evidence
JFSC Codes of Practice: manage cyber risk	Understand and manage risks, including cyber-security risks	Section 4, Results
JFSC Codes of Practice: incident reporting	Report incidents that put client information at risk	Section 4, Results
Cyber Security (Jersey) Law 2026, Parts 4 to 6	Operators of essential services take proportionate measures and report significant incidents. Not yet in force when the table was checked	Section 1, Scope and dates
Cyber Security (Jersey) Law 2026: banks from 1 December 2026	Deposit-taking banks become operators of essential services on that date	Section 6, Fixes and planned retest

Every line in the pack carries the web address where its wording was checked.

​

Where to set your frameworks

The frameworks and the audit period are set once on the Fair testing page, so every pack uses the same list. See Fair testing.

Export for auditors

How to make the pack and what is in it.

Legal documents

The DPA and the other documents an auditor may ask for.