ISO/IEC 27001
Prepared structure
Repository-derived scope, control mapping, risk and SoA workbook structure.
Still required
Approved ISMS, organizational scope, operating history, internal audit, management review and external body.
06 / Assurance
Preparing for assurance before making assurance claims
See Mentaview's evidence-led preparation for ISO 27001, ISO 42001, SOC 2, GDPR, NIS2, NIST CSF, CIS Controls and OWASP ASVS.
Current verdict: readiness program established. No certification, attestation or blanket legal-compliance claim is currently allowed.
Readiness inventory
The program turns unknowns into explicit work — never automatic passes.
8assurance routes
66dossier requirements
32draft records
34missing records
56pre-assessment blockers
28human actions to assign
Target routes
Different outcomes require different evidence and different words.
ISO/IEC 42001
Prepared structure
AIMS program, AI inventory and risk/impact workbook structure.
Still required
Approved AIMS, affected-party evidence, production monitoring, human oversight, audits and external body.
SOC 2
Prepared structure
System-description and control/population workbook structure.
Still required
Defined service organization, management assertion, operating period, criteria decision and CPA firm.
GDPR
Prepared structure
ROPA, DPIA, rights, breach and responsibility templates.
Still required
Confirmed roles and markets, counsel review, real data maps, contracts, transfers and operational exercises.
NIS2
Prepared structure
Applicability, Article 21 measures and incident-reporting exercise structure.
Still required
Entity facts, national-law analysis, management body, authority contacts and operating evidence.
NIST CSF 2.0
Prepared structure
Current/target profile and cross-framework mapping structure.
Still required
Executive-approved profile, production evidence, independent assessment and improvement-cycle history.
CIS Controls v8.1
Prepared structure
Implementation-group, asset population and safeguard workbook structure.
Still required
Approved IG, production populations, recurring measures and independent verification.
OWASP ASVS 5.0
Prepared structure
Application scope and requirement-mapping structure.
Still required
Level selection, complete tests, manual verification, penetration testing and exact signed release.
Evidence lifecycle
No record jumps from template to trust.
- 1Missing
- 2Draft
- 3Implemented
- 4Operating
- 5Verified
- 6Claim-approved
Operating and verified states require attributable evidence. Verification and not-applicable decisions require approval. A public claim additionally requires the exact release, independent outcome and claim gate.
A deliberate next step
Turn readiness structure into operating evidence.
Mentaview is seeking qualified security, privacy, AI-governance and independent-assessment partners for the next assurance phase.