Nine new frameworks
Each one comes with a guided questionnaire control by control, how to assess and how to meet each control, expected evidence, a task plan and a report. They are self-assessments: Audexa gets you ready, but it does not certify or issue third-party reports.
- EU AI Act (93 controls), based on your role and type of AI systems
- SOC 2 (61 Trust Services Criteria), to arrive prepared for the CPA auditor
- ISO/IEC 27017:2026 (64), cloud security as a customer and as a provider
- ISO/IEC 27701:2025 (73), privacy management as controller or processor
- LOPDGDD and LSSI (48), what Spanish law adds to the GDPR, cookies included
- Cyber Resilience Act (67), based on your role and product class
- ISO 37301 / UNE 19601 (68), compliance and criminal compliance
- ISO 45001 (65) and ISO/IEC 20000-1 (75), occupational health and safety and IT service management
A renewed ENS, measure by measure
The ENS catalogue now follows Annex II of RD 311/2022: the 73 measures with their official codes and the 86 applicable reinforcements. You choose the category and only see what it requires: 72 questions for Basic, 129 for Medium and 170 for High.
- Your previous ENS audits look exactly as before
- In a new audit, the answers from your last ENS audit arrive proposed for review
- CCN-STIC guides and CCN tools as support for each measure
One question up front that tailors the questionnaire
ENS, SOC 2, ISO 27017, the EU AI Act, ISO 27701 and the CRA ask before you start: your category, the report categories, your role or the product class. You see how many questions your questionnaire will have and only answer what applies.
37 mapping sets
19 new sets arrive and the ENS sets with ISO 27001 (122 pairs) and NIS2 (77) are rebuilt. There are now 37 sets and 2,543 pairs, and when you choose a framework you see how much of it your existing work already covers. Only high coverage proposes a Yes in another audit, and a person always confirms it.
- SOC 2 with ISO 27001 (135) and NIST CSF 2.0 (111)
- EU AI Act with ISO 42001 (113) and GDPR (35)
- ISO 27701 with GDPR (92), ISO 27001 (58) and ISO 27018 (70)
- Integrated ISO 9001, ISO 14001 and ISO 45001 system
AI governance, ISO 27001 and policies
The AI governance legal catalogue adds the new prohibited practice in art. 5(1)(h), handles biometric categorisation under art. 50(3) separately and adds the obligations in arts. 4a, 25(2) and 25(4); uses already assessed are flagged for review. If you use the module, its registered obligations arrive proposed in the new EU AI Act questionnaire.
- ISO 27001 adds the Amd 1:2024 climate change amendment to controls 4.1 and 4.2
- 15 new templates (67 in total), covering compliance and crime prevention, code of ethics, anti-bribery, whistleblowing, internal investigations, product security and vulnerability disclosure, CE marking, cookies, commercial communications, processors, authority requests, occupational health and safety, contractor coordination, IT service management and service levels