Add SOC 2, DORA or NIS2 without starting over
Scale-ups with ISO 27001 — certified, or finishing their first certification — often face a second framework soon after. US buyers want SOC 2; EU finance and ICT suppliers face DORA; regulated supply chains ask about NIS2. You should not rebuild the ISMS to answer them. Sentinel42 keeps one control library and maps each module onto the groundwork you already have.
See the shared control library and the module mappings on your own data. Book a demo.
No card for the trial · Hosted in London
One control library, many frameworks
Your ISO 27001 work — the clauses, the Annex A controls, the risk register, the policies and the evidence behind them — stays the centre of the system. It is the single place where decisions are made and recorded.
The SOC 2, DORA and NIS2 modules sit on that same library rather than beside it. Each module maps its requirements onto the controls you already operate, so you map once, reuse the evidence you have already gathered, and spend your time only on the genuine gaps. Nothing is duplicated; nothing is maintained twice.
Typical inheritance
Because the modules share one library, a large part of each framework is typically covered by the ISO 27001 groundwork already in place. The figures below are the typical platform mappings shown on the Modules page.
SOC 2
~65% typically inherited
DORA
~70% typically inherited
NIS2
~70% typically inherited
These are typical platform mappings, not a promise. Actual inheritance varies with your scope and your Statement of Applicability — the controls you have justified and operate determine what carries over. They are not a guarantee of coverage, and they are not a guarantee of certification.
What is still net-new
Inheritance shortens the work; it does not remove it. Each module surfaces what is still net-new so you do not pretend 100% reuse. In practice, the remaining work typically includes:
- SOC 2: the system description, the Trust Services Criteria not covered by your ISO 27001 controls, and the Type II observation window — the audit period over which your controls must demonstrably operate.
- DORA: the incident reporting clocks (initial notification within 24 hours, intermediate report within 72 hours, final report within one month), the register of information, and the ICT third-party specifics.
- NIS2: the management accountability records, any Article 21 measures not already covered by your ISMS, and the incident reporting timers.
Want to see how much of your existing ISMS a module would inherit? Book a demo.
Module pricing
Additional framework modules are £2,000 each per year, or any three for £5,000, on the Starter and Business plans. On Scale and Enterprise, the modules are included.
See the full module list on the Modules page and plan details on the Pricing page.
Who this is for
This path is for the scale-up that already has ISO 27001 — certified, or in the final stretch of a first certification — and now faces a second framework: SOC 2 because US enterprise buyers are asking for it, DORA because you supply EU financial services or ICT, or NIS2 because a regulated supply chain requires it.
If you do not have an ISMS yet, start with the first ISO 27001 instead — see the deal-blocked founder use case.
Map once, reuse the groundwork
One control library. SOC 2, DORA and NIS2 modules mapped onto your existing ISO 27001 work, with the genuine gaps surfaced for you to close.
- Modules reuse your clauses, controls, risks, policies and evidence
- Typical inheritance of ~65% for SOC 2 and ~70% for DORA and NIS2, varying with scope
- £2,000 each or any three for £5,000 on Starter and Business; included on Scale and Enterprise
Sentinel42 supports preparation and mapping; it does not guarantee certification or audit outcomes.