Cracking the Code:

Understanding Harmonised Cyber Security Control Frameworks

The Challenge: A Fragmented Cybersecurity Landscape

Look at the global cybersecurity regulatory landscape, and it’s easy to feel overwhelmed. While well-intentioned, the proliferation of cybersecurity standards and regulations emanating from governments, regulators, and industry bodies has left compliance teams scrambling to keep up — often at great expense. This patchwork of frameworks presents several challenges:

1. Conflicting Perspectives and Focus Areas

Standards and regulations vary widely in their emphasis. Some prioritise operational resilience, like the EU’s DORA, NIS2, and the upcoming UK Cyber Security and Resilience Act. Others, such as ISO 27001 or NIST CSF v2, come from a more holistic perspective. Then, there are industry-specific standards like PCI/DSS, with a narrower focus on technical controls. While they all feature proven cybersecurity principles at their core, they all bring their own slightly different perspective, often resulting in duplicated compliance efforts.

2. Jurisdictional Complexity

Some regions have introduced multiple overlapping frameworks. In Saudi Arabia, for instance, organisations may need to comply with the NCA Essential Cybersecurity Controls (and its many offshoots — TCC, OTCC, OMSACC, etc.), SAMA’s Cybersecurity Framework, CMA’s Cybersecurity Guidelines, the PDPL.. and several others — each with different compliance expectations.

3. Terminology and Structure Differences

Standards can differ in structure, wording, and even intent. Some refer to one control from within another, making it hard to interpret individual requirements in isolation. Others are vague. Take ID.AM.07 of the NIST CSF (v.2) as an example: “Inventories of data and corresponding metadata for designated data types are maintained”. Only once you take a look at the related implementation examples do you realise that this is where a fundamental discipline – information classification – is buried. The control is anything but clear.

Some controls are direct and practical (e.g. “conduct penetration testing every six months”), while others are ambiguous or inconsistent, leading to varied interpretations – even within the same framework.

These documents are, after all, produced by humans, often via some form of committee process. Sometimes this is evident in the result. Just as there are “Friday afternoon” cars, we’ve encountered “Friday afternoon” standards.

4. Diverse Approaches to Audit and Enforcement

In Europe, regulators tend to take a pragmatic, qualitative approach to regulatory conformance. Legislation such as the EU’s DORA even formalises this flexibility, requiring that a risk-based approach be taken in scoping how compliance should be achieved (see Article 4: The Proportionality Principle). What matters here is that you apply a structured approach, can justify your decisions and can provide documented evidence that the process you followed was thorough and had inherent integrity.

Elsewhere, especially in regions with newer or stricter enforcement practices, regulatory compliance can be more literal, particularly where the person doing the auditing is less seasoned. This can result in anomalous outcomes. More so where the control being assessed is itself ambiguous. Take the following example:

“Re-classify data to the least level possible to achieve the service objective before sharing it with third parties using data masking or scrambling techniques.”

If you were to implement this control as written, you’d potentially end up downgrading data classification (and its potential level of protection) merely to meet the need for the data to be shared – which I’m sure isn’t the underlying intent. For a less experienced auditor who is not confident in probing the real substance of the control, this could prove to be problematic.

The Case for Harmonised Control Frameworks

Given the challenges, it’s no surprise that many organisations are adopting harmonised cyber security control frameworks to help cut through the complexity of compliance.

When they work well, harmonised control frameworks:

  • Eliminate duplication
  • Improve clarity
  • Increase efficiency
  • Support clear control ownership and control assurance
  • Simplify regulatory alignment

Sounds ideal, right? Well yes, the principle is sound. However, creating an effective harmonised control library isn’t simply a matter of combining all the requirements from multiple frameworks into one place. A genuinely practical harmonised framework must still account for regional nuances, regulatory quirks, and your organisation’s risk profile.

And that’s where things can get complex.

Getting Started: Questions You Must Answer

Before adopting a harmonised control framework, it is important that you define your objectives and identify any constraints. Start by answering these three questions:

Q1. Is your goal to achieve broad conformity or strict compliance?

This will determine the size and complexity of your framework.

  • If your aim is to demonstrate conformity with standards like ISO 27001, NIST CSF, DORA and NIS2, you might manage with a core set of ~200 well-written controls.
  • If you need to support detailed, line-by-line compliance – especially in regions with stricter enforcement (e.g., the Middle East) – your framework may need to scale to 600+ controls.

At CRMG, we’ve built both types. Our ‘conformity-focused’ library includes:

  • Clear, action-oriented controls
  • Mappings to major standards
  • Suggested evidence for audits
  • Maturity questions for each control.

This approach works well in most regions. But for stricter regulatory environments, we’ve developed more granular frameworks that align precisely with local expectations – especially in Saudi Arabia, where a strict (more literal) approach to regulatory compliance is applied.

Regardless of the approach you take, your control framework should:

  • Use direct, imperative language
  • Avoid cross-references (each control should standalone)
  • Reflect opportunities to merge multiple tightly aligned controls into one
  • Split complex, multi-part controls into separate traceable controls.

Q2. If compliance is your priority, which standard matters most?

When compliance is key, it’s helpful to triage your requirements into tiers.

  • Tier 1: Your most critical regulatory requirement — e.g., NCA ECC in Saudi
  • Tier 2/3: Other relevant standards where broad alignment is sufficient

Knowing your Tier 1 requirement helps streamline your framework and prevents over-engineering controls that aren’t mission-critical.

Q3. How are your audit and compliance teams structured?

Smaller organisations may prefer to group controls together to reflect a simpler approach to implementation. Larger or more decentralised teams may require granular controls with distinct owners and implementation paths.

Either way, a centralised approach to managing GRC is likely to be important. Spreadsheets alone often don’t scale effectively. That’s why we work flexibly — partnering with platform providers such as Diligent, and others in the UAE and beyond, to embed CRMG’s harmonised control libraries into their systems. We also support organisations who prefer to manage their control frameworks independently, enabling tagging, filtering, attestation, and reporting in a way that fits their needs.

Making It Work: The Joy of Tagging

Once your harmonised framework is in place, tagging becomes your secret weapon. Smart tagging transforms a control library into a living compliance tool.

Here’s how tagging can help:

  • Source Standards
    Tag each control with its source(s) — ISO, NIST, ECC, etc. — to maintain traceability and keep auditors happy.
  • Environment Type
    Does a control apply to all environments, critical systems, or a specific function (e.g. remote workers or the social media team)?
  • Frequency
    How often does a control need to be applied or reviewed? (quarterly pen tests, monthly privileged access reviews, etc.) Tagging by frequency supports scheduling activities.
  • Territorial Restrictions
    Some regulators apply strict territory-related restrictions, for example, the nationality of the CISO or in-country cloud data hosting requirements. Tag these as non-negotiables.
  • Risk Assessment Requirements
    Identify controls that trigger risk assessments — e.g., at the outset of new technology projects or before remote access to a new system is allowed.
  • Information Classification
    Specific controls may only apply to ‘highly confidential’ or ‘top secret’ data. Tag accordingly to align with your information classification scheme.
  • Control Ownership
    Clarify who owns each control (e.g. the relevant business owner) and who is responsible for its implementation via RACI tagging.

This level of filtering and categorisation allows you to assign ownership, monitor compliance and prepare for audits with far greater ease.

Meet Our Leadership Team.

At CRMG, our senior leadership team brings a rich history and deep expertise in cyber security. Spearheaded by consultants who are influential figures in the industry, our leaders are highly networked and well-established, with backgrounds in the ‘Big- Four’ firms.

LEARN MORE

Simon Rycroft

CO-FOUNDER AND CEO

Former Head of Consulting at the ISF. On a journey to bring accessible risk management to growing enterprises.

Nick Frost

CO-FOUNDER AND CHIEF PRODUCT OFFICER

Former Group Head of Information Risk, PwC. Motivated by the need to implement cyber risk principles for the real world!

Dan Rycroft

DELIVERY DIRECTOR

Former Head of Delivery, Cyber Security at DXC. Delivers risk-based cyber security programmes with maximum efficiency.

Matt Brett

DELIVERY LEAD – CYBER RISK SOLUTIONS

Former Portfolio Director, Tech Security & Risk, GSK. Specialises in implementing efficient, pragmatic cyber risk solutions.

Martin Tully

DELIVERY LEAD – GOVERNANCE AND COMPLIANCE

Twenty years’ experience in delivering fit-for-purpose cyber governance initiatives.

Louis Head

CONSULTANT – GOVERNANCE AND COMPLIANCE

An expert in everything ISMS-related, and how compliance works in practice.

Guy Asch

COMMERCIAL DIRECTOR

A seasoned Commercial Director, driving P&L business leadership through innovative strategies.

Ryan Hides

DELIVERY LEAD – THIRD PARTY RISK MANAGEMENT

Project Management and Six Sigma expertise. Specialises in turning effective third party risk management into a scalable reality.

Sarrah Ahmed

HEAD OF MARKETING

Bringing over 17+ years of marketing expertise, passionate about crafting innovative marketing campaigns.

Understanding the Proportionality Principle in DORA:

A Balancing Act for Financial Entities

If you’re familiar with the EU Digital Operational Resilience Act (DORA), you’ll know it is framed in prescriptive language. However, within its detailed mandates, it also includes principles like this:

“Financial entities shall use and maintain updated ICT systems, protocols, and tools that are appropriate to the magnitude of operations supporting the conduct of their activities, by the proportionality principle as referred to in Article 4.”

In essence, Article 4 instructs financial entities to implement DORA’s requirements in a way that takes into account their size, overall risk profile, scale, and the type of services and operations they conduct. That’s a lot of subjectivity to work with.

This isn’t new for those well-versed in cyber security risk management. We’ve been using risk profiling to shape our security programmes for years. The term criticality is second nature to us. We’ve developed methodologies to quantify business impact and are accustomed to the language of threats, vulnerabilities, and controls, ensuring that security measures are proportionate to the risks we calculate.

Applying the Right Level of Resources

One key challenge for organisations is understanding how much resource allocation is required to meet DORA’s requirements. Some organisations may assume they need to dedicate extensive resources to compliance when, under the proportionality principle, they may fall into a category that demands a more measured approach. The thresholds outlined in DORA ensure that smaller or less complex organisations are not overburdened but instead apply a level of security and resilience appropriate to their specific risk landscape.

Conversely, organisations must also avoid underestimating their obligations. While proportionality provides flexibility, it does not mean minimal compliance. Each entity must carefully assess its position within the regulatory framework and ensure that its resource allocation is justified, efficient, and aligned with its true risk exposure.

For Mature Governance and Risk Functions

The subjectivity in DORA’s proportionality principle should be manageable for financial entities with well-established governance and risk management approaches. Many larger organisations already have the methodologies in place to assess risks in a structured manner – and to implement controls that are aligned with their risk profiles. These organisations will naturally integrate DORA’s requirements into their risk frameworks without much friction.

For Less Mature Organisations: No Easy Escape

However, for less experienced organisations or those without robust risk governance structures, the proportionality principle might seem like a loophole for a ‘light-touch’ approach. Some may attempt to use Article 4 as a justification for minimal compliance, arguing that they are tailoring their strategy according to their size and risk profile. In the long run, this approach won’t hold up under scrutiny.

Why? Because any decisions made under the proportionality principle (Article 4) will require backing up with sound logic and evidence. And to provide that evidence, organisations must:

  • Conduct thorough risk assessments
  • Apply reasoned judgment about security decisions
  • Develop clear documentation detailing exactly how they arrived at their conclusions.

Without these elements, regulatory bodies will likely challenge whether an organisation genuinely applies DORA’s proportionality principle in good faith.

Best Endeavours vs. Reasonable Endeavours

A helpful way to think about DORA compliance is in terms of best endeavours versus reasonable endeavours, a concept often seen in legal compliance. Regulators won’t necessarily expect perfection, but they will expect an organisation to demonstrate that it has taken its obligations seriously. This means that even if some aspects of an organisation’s approach are later deemed to be flawed, they must show that they acted with diligence, applied the right level of resources based on their risk environment, and made informed decisions throughout the process.

Failing to provide evidence of effort and structured thinking will make it challenging to claim proportionality as a defence in the event of an audit. Organisations must ensure they can substantiate their decision-making processes, proving that they acted in good faith and aligned their approach to the risk profile they determined.

The Opportunity within DORA

DORA is more than just another regulatory requirement—it represents a real opportunity. If approached correctly, it can act as a catalyst for significant improvements in:

  • Operational resilience
  • Cyber security and risk governance
  • Risk management effectiveness
  • An organisation’s ability to withstand external scrutiny.

When treated with care and respect, the proportionality principle allows organisations to implement DORA efficiently and in accordance with their unique risk landscape. However, it should never be misinterpreted as an excuse to do the bare minimum.

Different Approaches for Different Organisations

How an organisation reacts to DORA will depend heavily on its nature and business model. Large multinational financial entities with complex infrastructures will inevitably need a more rigorous and layered approach than smaller, more niche firms. However, regardless of size, the fundamental expectation remains the same:

Assess criticality and risk. Document your decisions. Be prepared to justify them.

The proportionality principle within DORA offers flexibility, but with flexibility comes responsibility. Organisations that properly leverage this principle will find themselves in a stronger position—not just for compliance but overall operational resilience. Conversely, those who see it as an easy way out may face increased regulatory scrutiny.

DORA challenges financial entities to prove they have taken a structured, risk-based approach to ICT and cyber security resilience. Whether you are a large or small entity, you must navigate the subjectivity of proportionality with diligence, thus ensuring that your security measures are appropriate, evidence-based, and defensible in the face of evolving threats and regulatory oversight.

The Cyber Resilience Act: Implications for Businesses

Strong cyber security is crucial for companies across all industries as cyber attacks become more sophisticated and pervasive. In response to this growing issue, the EU is introducing the Cyber Resilience Act (CRA), a legal framework to improve cyber resilience across the EU’s digital ecosystem. Unlike other regulations that focus on specific sectors or types of services, the CRA applies to a broad range of digital products and services, ensuring that cyber security is integrated at every stage of the product’s lifecycle.

Understanding the Cyber Resilience Act

On September 15, 2022, the European Commission presented the Cyber Resilience Act, an ambitious effort to standardise cyber security regulations for digitally enabled products. The CRA aims to accomplish the following by establishing a uniform baseline for cyber resilience:

  1. Strengthen security for all digital products: Many digital products now available on the market lack proper security features, making them vulnerable to exploitation. For example, smart home devices such as connected thermostats or security cameras can be particularly susceptible to cyber attacks if not properly secured. To address this, the CRA requires secure development techniques, vulnerability management, and security standards at every stage of a product’s lifespan.
  2. Empowering customers and companies to make informed decisions: The cyber security aspects of digital products are often not prominently featured, making it difficult for consumers to assess their risks. The CRA helps both businesses and consumers make informed choices by requiring greater transparency regarding these products’ cyber security features.

The CRA sets mandatory cyber security standards for digital goods producers, distributors, and operators to accomplish these objectives.

Timeline and Important Compliance Checkpoints

Businesses should be aware of the following significant dates and milestones as the CRA moves through the EU legislative process:

  • Political Agreement: After several revisions and stakeholder engagements, the European Commission reached a political agreement on the CRA on December 1, 2023. This agreement shows broad support for the CRA’s goals.
  • Compliance Window: Following legislation, companies will have specific deadlines to comply:
    – 21 Months: To fulfil the CRA’s event and vulnerability reporting obligations.
    – 36 months: To ensure complete adherence to all CRA regulations, particularly those about EU certification, secure development procedures, and transparency.

Businesses may organise compliance activities using this staged timeframe, but early action is essential to prevent disruptions.

Implications for Businesses Across Sectors

The CRA impacts various businesses that deploy digital products, with software and hardware developers likely to be the most directly affected. The CRA’s provisions also extend beyond the European Union, meaning that non-EU companies that offer digital products or services within the EU market must also comply with the CRA’s requirements. This means that any business, regardless of its location, must ensure its products meet the CRA’s cyber security standards if they are to be used within the EU. The following summarises the potential effects of the CRA on different business types:

1. Vendors of digital services and technology providers

The CRA places strict standards on businesses that create software or offer digital services, including secure development, vulnerability management, and regular updates. Technology providers must prioritise vulnerability reporting and implement secure coding practices to reduce security risks across widely used platforms and applications.

2. Manufacturers of IoT devices and hardware

Security elements must be incorporated into the design and development stages for manufacturers of digitally integrated hardware, including Internet of Things (IoT) devices. These companies might be scrutinised, primarily if they produce “high-risk” goods affecting public safety, healthcare, or vital infrastructure. The CRA may also require hardware modifications to guarantee safe, future-proof goods that meet EU standards.

3. Distributors and Retailers of Digital Goods

Distributors and retailers contribute to cyber security by ensuring their goods meet CRA regulations. They must also enable traceability, keep up-to-date records of cyber security features, and inform customers about the security characteristics of their products.

4. Healthcare Providers and Critical Infrastructure

Cyber threats can target organisations that oversee vital infrastructure, including transportation, healthcare, and energy. The CRA establishes a requirement for strict incident response procedures and monitoring of real-time cyber security metrics for these industries.

5. SMEs (small and medium-sized enterprises)

Despite the CRA’s broad applicability, SMEs may encounter difficulties because of limited resources. The CRA encourages SMEs to implement basic security procedures that improve resilience without putting an undue financial burden on them.

How to Prepare for CRA Compliance

As the CRA and associated implementation guidance develops, businesses have an opportunity to take the initiative in aligning their operations, services and products with the requirements of the Act.

Ryan Hides outlines his top 5 key areas of focus for businesses to ensure they’re CRA-ready:

1. Risk Management and Assessment

Conduct thorough risk assessments to identify potential vulnerabilities in your systems and processes. Implement robust risk management strategies to mitigate identified risks and ensure continuous monitoring to adapt to new threats. The CRA requires that manufacturers incorporate security measures from the design and development phases to ensure products have fewer vulnerabilities

2. Data Protection and Privacy

Ensure that all data, especially personal and sensitive information, is adequately protected. Implement strong encryption methods, access controls, and regular audits to comply with data protection regulations and safeguard against breaches.

3. Incident Response Planning

Develop and maintain a comprehensive incident response plan. This should include clear procedures for detecting, reporting, and responding to cyber incidents. Regularly test and update the plan to ensure it remains effective against evolving threats.

4. Employee Training and Awareness

Invest in regular training programs to educate employees about cyber security best practices and the importance of compliance. Foster a culture of security awareness to reduce the risk of human error and insider threats.

5. Vendor and Third-Party Management

Evaluate and manage the cyber security practices of vendors and third-party partners. Ensure they comply with CRA standards and integrate their security measures into your overall cyber security framework to prevent supply chain vulnerabilities.

The outlook for cyber resilience and the CRA

The Cyber Resilience Act is a proactive step towards creating a more secure digital future for the EU. In addition to avoiding fines, CRA compliance helps businesses build consumer trust, improve brand reputation, and lower cyber risk.

Compliance with the CRA sets the foundation for a resilient future in which security is integral to every digital product and service offered within the EU.