Frameworks & the Shared-Control Model
The frameworks Aegis supports, and why doing the work once satisfies many of them at the same time.
Aegis is multi-framework by design. The frameworks below are not separate products bolted together, they run on one control library, so effort spent on one framework counts toward the others it overlaps with.
Supported frameworks
SOC 2 (Type I & II)
The Trust Services Criteria, security, availability, processing integrity, confidentiality and privacy, the report most B2B customers ask for first.
ISO 27001 & ISO 27002
The international standard for an information security management system, including the Annex A controls.
ISO 42001
The management-system standard for artificial intelligence, for teams putting AI governance on a formal footing.
NIST CSF & NIST AI RMF
The Cybersecurity Framework and the AI Risk Management Framework, widely used as a common language for security and AI risk.
EU AI Act
Obligations for providers and deployers of AI systems, mapped to controls you can actually implement and evidence.
GDPR & DPDP
The EU General Data Protection Regulation and India's Digital Personal Data Protection Act and Rules: consent, notices, children's data, rights and grievances, breach reporting to the Data Protection Board, and the security safeguards the Rules require.
HIPAA
The US healthcare data-protection rules, for teams handling protected health information.
PCI DSS
The Payment Card Industry Data Security Standard, for teams that touch cardholder data.
New frameworks are added centrally and become available to every organization. If a framework you need is not listed, tell us, the shared-control model means adding one mostly reuses controls that already exist.
The shared-control model
The reason multi-framework compliance is usually miserable is duplication: the same access-control practice gets re-documented and re-evidenced for SOC 2, again for ISO 27001, again for a NIST mapping. Aegis removes the duplication.
One control can map to requirements in many frameworks. A single "logical access is provisioned and reviewed" control might satisfy a SOC 2 Common Criteria, an ISO 27001 Annex A control and a NIST subcategory at once. You implement and evidence it once; Aegis credits it everywhere it maps.
The practical consequences:
- Adding a second framework is cheap. Much of it is already covered by controls you built for the first. Aegis shows you only the genuine delta.
- Evidence is collected once, counted everywhere. A configuration screenshot or an automated cloud test attached to a control flows to every framework that control serves.
- Coverage is always live. Each framework shows its own real-time completion percentage, derived from the shared controls beneath it.
How a framework is structured
Open any framework in Aegis and you see the same anatomy:
| Layer | What it is |
|---|---|
| Requirements | The framework's own clauses or criteria (for example a SOC 2 Common Criterion or an ISO Annex A control) |
| Controls | The practices you implement, each mapped to one or more requirements, often shared across frameworks |
| Tasks / Evidence | The concrete artifacts that prove a control is operating |
| Policies | The documented commitments that back the controls |
The framework page rolls these up into a compliance-progress figure and a control-status breakdown (complete vs in progress), so you always know where a given framework stands.
Controls, requirements and coverage
A framework's percentage is not a guess, it is the share of its mapped controls that are complete. Because controls are shared, driving one control to complete can move the needle on several frameworks at once. This is the core efficiency of running your whole program in Aegis rather than one framework per tool.
For how controls are managed day to day, see Controls. For how the proof behind them is gathered, see Evidence & Tasks.
Next steps
Controls
How the shared control library is managed and mapped.
Evidence & Tasks
The proof that makes a control real.
Policies
The documented commitments behind your controls.
Use Cases
Multi-framework scenarios in practice.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com