Compliance documentation from your architecture.
Not from scratch.

Auto-map all 10 Trust Service Categories (Security, Availability, Processing Integrity, Confidentiality, Privacy) to your ArchiMate elements. Generate control narratives with evidence links ready for your auditor.

• CC1–CC9 Common Criteria (Security)
• Availability criteria (A1)
• Confidentiality criteria (C1)
• Processing Integrity (PI1)
• Privacy criteria (P1–P8)

The generated report is a self-assessment — you still need a licensed CPA firm for official certification. Archiet dramatically reduces the prep time and consulting cost.

Map your architecture to ISO 27001:2022 control domains. Archiet identifies which controls are covered by your existing elements, which have gaps, and generates a Statement of Applicability draft.

• A.5 Organisational controls
• A.6 People controls
• A.7 Physical controls
• A.8 Technological controls
• A.9 Access control

Core control mapping for ISO 27001:2022 across the Organizational, People, Physical, and Technological themes. Gap analysis with remediation guidance for each mapped control.

Map your data architecture to GDPR Articles 25 (privacy by design), 32 (security of processing), and 35 (DPIA). Archiet identifies personal data flows and storage locations from your blueprint elements.

• Article 25 — Privacy by Design
• Article 32 — Security of Processing
• Article 35 — Data Protection Impact Assessment
• Data flow mapping for personal data
• Third-party processor identification

Supports DPA submissions in the EU and UK. Not a legal opinion — consult a DPO for formal compliance.

For healthcare teams, Archiet maps your architecture to HIPAA Security Rule safeguards. Identify Protected Health Information (PHI) data flows, storage locations, and access control gaps across your technology and data layers.

• Administrative Safeguards (45 CFR 164.308)
• Physical Safeguards (45 CFR 164.310)
• Technical Safeguards (45 CFR 164.312)
• PHI data flow identification and scoping
• Access control and audit logging coverage

Required for any system handling Protected Health Information in the United States. Works alongside GDPR for EU patient data. Note: Archiet generates a readiness assessment — formal certification requires a qualified assessor.

For teams processing or storing payment card data, Archiet maps your architecture to PCI-DSS v4.0 requirements. Identify cardholder data environment scope, network segmentation gaps, and encryption coverage.

• Cardholder Data Environment (CDE) scoping
• Network segmentation verification
• Encryption at rest and in transit
• Access control and authentication controls
• Vulnerability management process coverage

Required for any system storing, processing, or transmitting payment card data. Particularly useful for teams integrating with payment processors to understand residual PCI scope.

For financial entities operating in the EU, Archiet maps your architecture to DORA's five pillars of digital operational resilience. Identify ICT risk management gaps, third-party dependency exposure, and incident response coverage from your blueprint.

• Article 6 — ICT Risk Management Framework
• Article 8 — ICT Asset Identification and Classification
• Article 18 — Business Continuity and Backup Policies
• Article 19 — Incident Response and Recovery Plans
• Article 28 — Third-party ICT Risk Management

Mandatory for banks, insurers, investment firms, and their critical ICT providers operating in the EU from January 2025. Archiet generates a readiness assessment against Articles 6, 8, 18, 19, 25, and 28.

For organisations in essential and important sectors across the EU, Archiet maps your architecture to NIS2 cybersecurity risk management obligations. Identify supply chain risk exposure, access control gaps, and incident reporting readiness from your blueprint.

• Article 21 — Cybersecurity risk management measures
• Supply chain security and third-party risk
• Access control and authentication controls
• Incident handling and reporting capabilities
• Business continuity and crisis management

Applies to medium and large organisations in essential sectors (energy, transport, health, digital infrastructure) and important sectors (postal, waste, chemicals, food, manufacturing). Member state transposition deadlines have passed — compliance is required now.