Vailor Control Framework: one control, many frameworks

The Vailor Control Framework (VCF) is the control baseline of the Vailor platform. It is a bilingual catalogue of 232 security controls (227 active) in 19 domains, together with 217 pieces of evidence and 400 standard actions. Every control is mapped to the requirements of the integrated frameworks, so for any requirement you can see which controls answer it and what evidence to produce. The current version is 24.15.

Four frameworks are integrated, broken down into requirements: NIST CSF 2.0 (106 requirements), the ANSSI guideline for a healthy information system (42 measures, 132 requirements), ANSSI's Référentiel Cyber France (ReCyF) v2.5, a working document tied to the French transposition of NIS2, still in progress (152 requirements), and DORA, that is Regulation (EU) 2022/2554 and eight of its level 2 acts (431 requirements). That makes 821 requirements linked to the controls by 2,140 mappings. ISO/IEC 27001, the LPM and the AI Act are on the roadmap.

Each mapping holds three pieces of information. A relation type says how the control and the requirement overlap: equivalent, included in the control, broader than the control or partial overlap. A strength gives the weight of the link. A justification, written in French and English, explains what part of the requirement the control carries and, often, what it does not. An auditor or a CISO can read every link instead of having to trust a bare mapping table.

Because not every requirement in a text prescribes an arrangement. Of the 821 integrated requirements, 16 are mapped to no control: 15 in DORA and 1 in ReCyF. Each one has a written reason. For example, Article 4 of DORA is a rule of interpretation (proportionality) that is checked in how the other controls are calibrated, and one ReCyF measure grants an exemption from authentication for information published to the public. Most of the others are scope rules or obligations already carried by another requirement of the same text; a few are a lead-in, an internal cross-reference or a mere rule for filling in templates.

The difference is in level of detail and scope. The Secure Controls Framework is an open project that targets very broad worldwide coverage, with a large number of controls and texts. The VCF sits deliberately in the middle: more detailed than a list of topics, without aiming for that completeness. It is oriented towards Europe and France (NIS2 through ReCyF, DORA, ANSSI), with NIST CSF 2.0 as the international bridge.

No. A control catalogue does not make anyone compliant: compliance depends on what the organisation actually puts in place, and it is assessed by the competent authority or the auditor. The VCF gives that work a structure. It shows which controls answer which requirements, which evidence demonstrates them and which standard actions put them in place. It also avoids handling each text on its own when several of them ask for the same thing.

Yes. ISO/IEC 27001, the French military programming law (LPM) and the AI Act are planned. Beyond that roadmap, the Vailor team can add other frameworks by extending the VCF. Their requirements are then mapped to the same controls with the same method: relation type, strength, bilingual justification, and a written reason for any requirement left without a control. An internal information security policy (PSSI) is not tracked as a framework: it is uploaded as a document, and the AI uses it as a source.