The control pool
The 257 questionnaire controls, how they split across four pillars, and how many each supplier profile answers.
How the pool is composed
Aranis assesses suppliers against a canonical pool of 257 controls organized into four pillars. One hundred and seven are native to NIST CSF 2.0 — mapped 1:1 to a framework subcategory. The other 150 are authored by Aranis and cover Privacy, Continuity, and AI, subjects the CSF does not reach in enough depth to assess a third party.
Pillar | P1 | P2 | P3 |
|---|---|---|---|
Cyber (NIST CSF 2.0) | 32 | 89 | 107 |
Privacy (LGPD) | 19 | 27 | 34 |
Continuity (ISO 22301) | 28 | 42 | 50 |
AI (AI & Model Risk) | 0 | 43 | 66 |
Total | 79 | 201 | 257 |
Profiles are cumulative: a P2 supplier answers the P1 pool plus its own, and P3 answers all three. That is why the columns grow left to right instead of partitioning the total. Note that the AI pillar starts at zero — a P1 supplier answers no AI controls at all.
Cyber — 107 NIST CSF 2.0 controls
They follow the framework's six functions: Govern (GV, 31 controls), Identify (ID, 21), Protect (PR, 22), Detect (DE, 11), Respond (RS, 14), and Recover (RC, 8). The identifier follows the FUNCTION.CATEGORY-NN format — for example DE.AE-02 or PR.AA-03.
Thirty-three of these carry a cross-coverage note: the answer also serves as evidence for an equivalent control in another pillar, so the supplier is not asked the same thing twice.
Privacy — 34 controls
These cover privacy matters with no direct CSF equivalent: data protection impact assessments, legal bases for processing, consent and revocation mechanisms, data subject rights, international transfers, and breach notification to the Brazilian data protection authority. The identifier follows the LGPD-section.item pattern (for example LGPD-1.3, LGPD-10.2).
A privacy control answered NO enters the calculation with a fixed synthetic CVSS of 7.5 rather than an NVD lookup. The fixed weight reflects the nature of the obligation: regulatory risk is defined by statute and does not depend on any specific technical vulnerability.
Continuity — 50 controls
These cover business continuity management per ISO 22301: business impact analysis, recovery time and recovery point objectives (RTO and RPO), operational continuity plans, tests and simulation exercises, and the continuity management system itself. The identifier follows the BCM-clause.item pattern (for example BCM-32.1).
AI — 66 controls
The newest pillar, tied to risk category RC11 (AI & Model Risk). It covers the supplier's development and operation of AI systems: bias, model opacity, misuse, and lifecycle governance. The identifier follows the ARCnn pattern. It does not apply to P1 suppliers.