> ## Documentation Index > Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt > Use this file to discover all available pages before exploring further. # Regulations the auditor pack maps to > The seven frameworks the Export for auditors pack can map a simulation to, which control each line answers, and what the pack does and does not claim. The **Export for auditors** pack can include a mapping table. For each framework you tick, it prints the control, what that control asks for, and which section of the pack is the evidence. See [Export for auditors](https://docs.deepblocker.ai/vishing/results/auditor-pack.md). > [!WARNING] > > This page is not legal advice, and it is not a claim of certification. A vishing test is evidence that supports a control. It never makes anyone compliant. ## The seven frameworks | Framework | Full name | Who usually asks | | - | - | - | | **NIS2** | Directive (EU) 2022/2555 (NIS2) | EU essential and important entities, and their national regulators | | **DORA** | Regulation (EU) 2022/2554 (Digital Operational Resilience Act) | EU financial entities and their supervisors | | **ISO 27001:2022** | ISO/IEC 27001:2022, Annex A controls | Certification auditors and customers who ask for the certificate | | **PCI DSS 4.0** | PCI DSS v4.0 and v4.0.1, Requirement 12.6 | Qualified security assessors and acquiring banks | | **Cyber Essentials** | UK Cyber Essentials (NCSC) | UK customers, public sector buyers and insurers | | **Cyber insurance** | Cyber insurance application and renewal questions | Underwriters and brokers | | **Jersey (JFSC)** | JFSC Codes of Practice and the Cyber Security (Jersey) Law 2026 | The Jersey Financial Services Commission and the Jersey Cyber Security Centre | ## The pack sections | Number | Section | | - | - | | 1 | Scope and dates | | 2 | Method | | 3 | Who was tested | | 4 | Results | | 5 | Teaching delivered | | 6 | Fixes and planned retest | ## What each framework maps to > [accordion] NIS2 > > | Control | What it asks for | Evidence | > | - | - | - | > | Article 21(2)(g) | Basic cyber hygiene practices and cybersecurity training | Section 5, Teaching delivered | > | Article 21(2)(f) | Policies and procedures to assess the effectiveness of risk-management measures | Section 4, Results | > [accordion] DORA > > | Control | What it asks for | Evidence | > | - | - | - | > | Article 13(6) | ICT security awareness programmes and resilience training as compulsory modules | Section 5, Teaching delivered | > | Article 24(1) and 24(2) | A sound and comprehensive resilience testing programme with a range of tests | Section 1, Scope and dates | > | Article 25(1) | Appropriate tests, including scenario-based tests and penetration testing | Section 2, Method | > [accordion] ISO 27001:2022 > > | Control | What it asks for | Evidence | > | - | - | - | > | Annex A 6.3 | Security awareness, education and training for each role, with regular updates | Section 5, Teaching delivered | > | Annex A 5.36 | Compliance with policies and rules is reviewed, and non-compliance is found and corrected | Section 4, Results | > [accordion] PCI DSS 4.0 > > | Control | What it asks for | Evidence | > | - | - | - | > | Requirement 12.6.3.1 | Awareness training that covers phishing, related attacks and social engineering. Required from 31 March 2025 | Section 5, Teaching delivered | > | Requirement 12.6.2 | The awareness programme is reviewed at least once every 12 months | Section 6, Fixes and planned retest | > [accordion] Cyber Essentials > > | Control | What it asks for | Evidence | > | - | - | - | > | Not a control | Cyber Essentials covers five technical controls and does not test staff. Buyers and insurers who ask for the certificate often ask for social engineering testing alongside it | Section 1, Scope and dates | > [accordion] Cyber insurance > > | Control | What it asks for | Evidence | > | - | - | - | > | Simulations and their frequency | Whether you run social engineering simulations, how often, and what the results are | Section 1, Scope and dates | > | Reports and behavioural trends | Whether you can show the programme ran and how behaviour changed over time | Section 4, Results | > [accordion] Jersey (JFSC) > > | Control | What it asks for | Evidence | > | - | - | - | > | JFSC Codes of Practice: manage cyber risk | Understand and manage risks, including cyber-security risks | Section 4, Results | > | JFSC Codes of Practice: incident reporting | Report incidents that put client information at risk | Section 4, Results | > | Cyber Security (Jersey) Law 2026, Parts 4 to 6 | Operators of essential services take proportionate measures and report significant incidents. Not yet in force when the table was checked | Section 1, Scope and dates | > | Cyber Security (Jersey) Law 2026: banks from 1 December 2026 | Deposit-taking banks become operators of essential services on that date | Section 6, Fixes and planned retest | Every line in the pack carries the web address where its wording was checked. ## Where to set your frameworks The frameworks and the audit period are set once on the Fair testing page, so every pack uses the same list. See [Fair testing](https://docs.deepblocker.ai/vishing/fair-testing.md). > [card] [Export for auditors](https://docs.deepblocker.ai/vishing/results/auditor-pack.md) > > How to make the pack and what is in it. > [card] [Legal documents](https://docs.deepblocker.ai/trust/legal.md) > > The DPA and the other documents an auditor may ask for. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.