Validation module
05 / 07Framework Alignment and Gap Analysis
Maps evidence from executed tests to the frameworks you are judged against, and names the gaps.
The problem
Questionnaires measure confidence, not control
Framework alignment is usually established by self-assessment: a control owner judges a clause satisfied and the judgement becomes the record. The assessment inherits every optimistic assumption in the organisation, and the gap between a clause marked compliant and a control that actually works is invisible until an incident or an audit opens it.
With NIS2 and DORA in force and the EU AI Act phasing in, the regulatory direction is away from attestation and towards demonstrated effectiveness. An evidence-free compliance position is becoming an exposure in itself.
How Veync tests it
Start from executed evidence, not from the questionnaire
Veync takes the verdicts the other modules produced and maps them onto the clauses you report against, so each clause is supported by an action that was actually executed. Where no evidence exists, the clause is marked untested rather than assumed satisfied — which is itself a finding worth having.
What this module covers
- Gaps backed by executed evidence
- Auditor-ready formatting
- Prioritised remediation
- Measured, not self-assessed
What you receive
An auditor-ready gap register
You receive a clause-level register in which every satisfied item links to its evidence, a control-to-clause map across the frameworks in scope, and a remediation plan sequenced by exposure rather than by ease.
A clause-level gap register
A control-to-clause map
A sequenced remediation plan
Standards
Evidence from this module maps to
NIS2 Directive (EU) 2022/2555
European Union
DORA Regulation (EU) 2022/2554
European Union
EU AI Act Regulation (EU) 2024/1689
European Union
ISO/IEC 27001 2022
ISO/IEC
SOC 2
AICPA
NIST CSF 2.0
NIST
PCI DSS v4.0.1
PCI Security Standards Council
Sector regulators
National and EU supervisors
Put this module to work
A validation briefing covers scope, the authorization you would sign, and the evidence this module would produce for your environment.
Named-vendor results and control-evasion evidence are shared under NDA, through the evidence annex.