Multi-framework 2026: NIS 2, ISO 27001, CSRD, Sapin 2 — the overlap map your team has no time to draw
In short.
NIS 2, ISO 27001, CSRD, Sapin 2: four frameworks, four teams, four document bases. Silos wear compliance teams out because they force them to produce the same evidence several times. These frameworks overlap widely: but the overlap map still has to exist.
60% of the documentary evidence produced for NIS 2, ISO 27001, CSRD and Sapin 2 overlaps.
Yet most companies keep producing the same documents several times, for several audits, with several teams.
The problem: compliance in silos
Your compliance team has three people.
It manages six frameworks.
Last year, it:
- Responded to 4 external audits
- Produced 2 regulatory reports
- Prepared 3 certifications
- Handled several dozen customer and supplier questionnaires
And despite all these efforts, a large part of the work was started again from scratch.
Not for lack of skills.
Simply because nobody had time to map the overlaps between the different frameworks.
The reality
A single piece of documentary evidence often meets several requirements:
✅ An ISO 27001 access management policy also covers NIS 2
✅ A Sapin 2 supplier assessment feeds into the CSRD
✅ A NIS 2 incident management procedure meets several ISO 27001 controls
Why silos are killing compliance teams
In many organisations:
- One team manages ISO 27001
- A consultancy supports NIS 2
- The ESG manager leads the CSRD
- Legal leads Sapin 2
The result:
- Duplicated documents
- Inconsistent policies
- Longer audits
- Artificially high workload
The hidden risk
When two auditors ask the same question and get two different answers, the discrepancy becomes a compliance problem.
Even when both answers are technically correct.
Pooling evidence therefore means:
- Time saved
- Greater consistency
- Lower audit risk
NIS 2
Objective
Strengthen the cybersecurity of essential and important entities.
Main requirements
- Cyber risk management
- Incident management
- Business continuity
- Supplier security
- Access control
- Cryptography
Penalties
Up to €10M or 2% of worldwide turnover.
ISO 27001:2022
Objective
Set up an information security management system (ISMS).
Main requirements
- Security governance
- Risk management
- Organisational controls
- People controls
- Physical controls
- Technological controls
Certification
- Initial audit
- Annual audits
- Recertification every 3 years
CSRD
Objective
Standardise sustainability reporting.
Main requirements
- Governance
- Social
- Environment
- Supplier due diligence
- Anti-corruption policy
Key point
Companies already subject to Sapin 2 often hold a large share of the required evidence.
Sapin 2
Objective
Prevent corruption and influence peddling (Sapin 2 is the French anti-corruption law).
The 8 pillars
- Code of conduct
- Risk mapping
- Third-party assessment
- Accounting controls
- Training
- Whistleblowing system
- Disciplinary system
- Programme monitoring
Domain 1, Governance
Documents that can be pooled
- Framework policy
- Responsibility chart
- Management approval
- Annual reviews
💡 A single governance policy can cover all 4 frameworks.
Domain 2, Risk management
Documents that can be pooled
- Analysis methodology
- Risk register
- Treatment plans
- Annual reviews
💡 A single method can be used for cyber, corruption and ESG risks.
Domain 3, Supplier assessment
Documents that can be pooled
- Supplier questionnaire
- Contractual clauses
- Supplier scoring
- Remediation plans
💡 This is the domain with the greatest potential for pooling.
Domain 4, Training
Documents that can be pooled
- Training plan
- Attendance register
- Session history
- Coverage rate
💡 A single training register can serve all four frameworks.
Domain 5, Incident and whistleblowing management
Documents that can be pooled
- Reporting procedure
- Incident register
- Handling workflow
- Whistleblower policy
💡 The same system can meet Sapin 2, CSRD, NIS 2 and ISO 27001.
Domain 6, Business continuity
Documents that can be pooled
- BCP
- DRP
- Continuity tests
- Dependency mapping
💡 A single BCP/DRP covers NIS 2 and ISO 27001 at the same time.
Domain 7, Access management
Documents that can be pooled
- IAM policy
- Privilege management
- Segregation of duties
- Access rights reviews
💡 Segregation of duties meets both ISO 27001 and Sapin 2.
Domain 8, Reporting and traceability
Documents that can be pooled
- Compliance KPIs
- Annual reports
- Internal audits
- Decision registers
💡 The same data often feeds both CSRD and Sapin 2 reports.
1. The unified supplier questionnaire
The document with the best return on investment.
It covers, at the same time:
- NIS 2
- ISO 27001
- CSRD
- Sapin 2
2. The governance framework policy
A single document for all four frameworks.
3. The single training register
A single source of evidence for every audit.
4. The unified whistleblowing system
A single channel.
A single procedure.
Two frameworks covered immediately.
5. The harmonised risk map
A single method.
Several scopes.
Zero duplication.
The problem is not only creating the documents.
The problem is finding them.
In most companies:
- The CISO holds the cyber documents
- Legal holds the Sapin 2 documents
- The ESG manager holds the ESG documents
Nobody has the full picture.
With Optivalue.ai
- Document centralisation
- Cross-framework search
- Automatic answers to audit questionnaires
- Sources and evidence systematically cited
- Detection of document inconsistencies
- Flagging of expired documents
Result
Handling an audit questionnaire goes from several days to a few hours.
Action no. 1
Analyse your last 3 audits and identify the recurring questions.
Action no. 2
List your 5 documents with the highest pooling value.
Action no. 3
Centralise your documents before trying to rewrite them.
Conclusion
Companies do not suffer from a lack of documentation.
They suffer from a lack of pooling.
In 2026, high-performing compliance is no longer the kind that produces the most documents.
It is the kind that intelligently reuses the evidence already available.
Discover Optivalue.ai
Centralise your compliance documentation and answer your NIS 2, ISO 27001, CSRD and Sapin 2 audits from a single document base.
→ Request a personalised demonstration
Back to topOn the same topic