Side-by-side comparisons
Frameworks, tools and approaches put next to each other on the criteria that actually decide which one you need.
ISO 27001 vs ISO 27002: What Is the Difference?
ISO/IEC 27001 sets the requirements for the ISMS and is certifiable; ISO/IEC 27002 explains the 93 controls in Annex A and is not. Certification bodies audit against clauses 4 to 10 of ISO/IEC 27001 and the controls chosen in the Statement of Applicability.
ISO 27001 vs BSI IT-Grundschutz: Own Risk Analysis or BSI Modules
ISO/IEC 27001 requires controls to be derived from your own risk assessment; the BSI's IT-Grundschutz supplies them as ready-written modules. On the IT-Grundschutz route the BSI issues the ISO 27001 certificate; on the direct route a DAkkS-accredited body does.
DORA vs NIS2: Which Legal Act Applies to Us?
DORA governs the ICT resilience of financial entities, NIS2 the cybersecurity of entities by sector and size, in Germany through the BSIG. Where DORA regulates a matter itself, it takes precedence, but § 28(6) BSIG does not exempt financial entities from registration under § 33.
CRA vs NIS2: product duties or operator duties?
The Cyber Resilience Act regulates the product, NIS2 the entity. The reporting duties of Regulation (EU) 2024/2847 have applied since 11 September 2026; all other duties apply from 11 December 2027. Germany's BSI Act has transposed NIS2 since 6 December 2025.