CRAFT - Control, Risk & Audit Framework Tool
From separate control frameworks in as many spreadsheets to one library in which BIO, ISO 27001, NIS2, DORA, GDPR and NEN 7510 resolve to the same shared controls, and in which you then actually test against them, from audit programme to report.
The challenge
Every framework its own language, its own spreadsheet
Organisations working with several frameworks (BIO, ISO 27001, NIS2, DORA, GDPR, NEN 7510) keep running into the same problem: each framework uses its own terminology, numbering and scope. Anyone who has to demonstrate that a single control satisfies ISO 27001, NIS2 and DORA at once starts by copying and pasting between Excel files. And anyone who then wants to audit against it builds the entire audit programme from scratch all over again.
Manual crosswalks age immediately
A manual comparison table between frameworks is out of date the moment a standard is revised. In CRAFT the comparison hangs off the library itself, so a revised standard carries through to every link attached to it.
Overlap between frameworks stays invisible
The same control is tested three times over because nobody sees the connection. The shared controls make that connection explicit, so you see what a single assessment has already covered.
Law and measure sit in separate documents
Legal articles and concrete controls live in separate documents, so nobody can show the trail from obligation to measure. CRAFT records that link and makes it traceable in both directions.
Without a library every project starts from zero
Every audit or assessment begins by assembling a control framework all over again. In CRAFT you select it from the library, including the links that are already in place.
International GRC suites do not know BIO or NEN
International GRC software does not know BIO, NEN 7510, Wpg or ENSIA, so those end up in a spreadsheet of their own anyway. In CRAFT they sit in the same library as ISO 27001 and DORA.
A framework alone does not get you there
Even with the framework in place, the real work happens outside the tool: audit programme, evidence, response and reporting in yet more files. In CRAFT that whole line continues in the same environment.
What CRAFT offers
Record once, account for it many times over
CRAFT brings frameworks, controls and legislation together in one managed library, and lets you work in it directly.
AI built in, not bolted on
The AI in CRAFT knows the framework you are working in and makes its suggestions within that framework rather than in general terms: wording, test questions, analyses. Always as a proposal: the auditor decides.
Dutch and European frameworks as standard
BIO, NEN 7510, Wpg, ENSIA, GDPR, DORA and the AI Act sit alongside ISO 27001 in the same library. No translation exercise from an international suite that does not know the Dutch playing field.
Shared controls as the bridge
Beneath the frameworks sits a layer of framework-neutral controls that every framework maps onto, complemented by cross-references between frameworks. This reveals which controls cover the same ground, so one assessment can serve several frameworks at once.
From law to control, and back
Legal articles are linked directly to the controls that give effect to them. At a glance you see which measure covers which legal obligation, and where a gap remains.
From standard to report in one environment
The framework is the starting point, not the finish line. Audit programme, assessment and evidence per control, response, findings and recommendations all live in the same tool. No export to Word halfway through the audit.
Data sovereignty, built in the EU
Your data sits on European servers, stored separately per organisation. No US cloud. AI output is always a proposal you assess yourself, never a black box.
How it works
Five steps
From choosing a framework to a finished report in five steps.
Choose your framework(s)
Select one or more frameworks from the library, for example ISO 27001 together with NIS2 and DORA, as the basis for an audit, assessment or review.
Automatic linking
CRAFT maps the selected controls onto the underlying shared controls and exposes the cross-references to other frameworks and to relevant legal articles.
Coverage and overlap in view
You immediately see which controls have already been tested elsewhere, where frameworks overlap and where a genuine gap remains, instead of walking through each framework separately.
Test and substantiate
For each control you record the assessment and the evidence, with a response step for the responsible owner. Anything already tested under another framework does not need doing twice.
Findings and report
Findings and recommendations follow from the assessment and come together in the report. Where applicable, apps such as the NIS2 Scanner or GRIP build on the same framework.
Who it is for
Two ways to use CRAFT
The same library, two starting points.
Do you work with several frameworks?
You have to satisfy BIO, ISO 27001, NIS2 and DORA at the same time. CRAFT shows where those frameworks overlap, what you have therefore already covered and where a genuine gap remains, so you test once instead of four times. If you would rather start with a single framework, the NIS2 Scanner is the quickest way in.
Do you carry out audits?
You start from a framework and simply want to continue: audit programme, testing with evidence, response, findings and recommendations. That all sits inside CRAFT itself. For the wider audit function (annual planning, follow-up of measures, file management) the Audit Suite connects to it.
The library in figures
Verified counts, not estimates
These are the current figures from the CRAFT control library.
51 frameworks
From BIO and ISO 27001 to DORA, NEN 7510, Wpg and the AI Act: 51 frameworks in one library.
2,228 controls
Every control searchable, by framework and by domain.
136 shared controls
The framework-neutral control set that all frameworks map onto.
212 law-to-control links
Direct references between legal articles (GDPR, NIS2, Wpg) and concrete controls.
2,242 cross-references
References between controls from different frameworks, always with the underlying controls attached so you can check every link yourself.
Across the suite
One library, several applications
CRAFT is not a standalone book of standards. The same library feeds the NIS2 Scanner for gap analysis, GRIP for the ENSIA framework and AQUA for the internal audit function's self-assessment. One maintained source, so no version differences between tools.
Looking specifically for evidence towards a QAIP or preparation for an External Quality Assessment of the internal audit function? That is the domain of AQUA, which builds on this same library.
From control framework to demonstrable control
CRAFT brings BIO, ISO 27001, NIS2, DORA, GDPR and dozens of other frameworks together in one library, and lets you test and report in it directly. Curious what that looks like for your organisation?