Frameworks

The frameworks we support

ThemisIQ is built on one principle: collect your data once, comply everywhere. The same source data maps across the frameworks below, from California’s SB 253 to the EU’s CSRD and from IFRS S2 to the AI and cyber regimes, so you report under each without re-entering anything.

Climate and emissions

Built on the GHG Protocol and structured for the major climate-disclosure regimes.

GHG Protocol Corporate Standard
The global accounting standard for corporate greenhouse-gas inventories.
Your Scope 1, 2 and 3 inventory is built on the GHG Protocol Corporate Standard, audit-trail first.
GHG Protocol Scope 3 Standard
The corporate value-chain standard, covering the fifteen Scope 3 categories and the methods permitted for each.
Category 1 takes supplier-reported figures with their basis and assurance status recorded, so a verifier can see which figures are primary data and which are not.
California SB 253
Climate Corporate Data Accountability Act, mandatory Scope 1 and 2 disclosure, with Scope 3 following from 2027. California Health & Safety Code §38532 (SB 253). Reporting has not begun: first report proposed for 10 November 2026, not yet final.
An SB 253 emissions report from your GHG inventory, to use in preparing your filing.
California SB 261
Climate-Related Financial Risk Act, biennial climate risk reporting aligned to TCFD. California Health & Safety Code §38533 (SB 261). Enforcement paused: appeal pending, no new date.
A climate risk and resilience screening covering the strategy section SB 261 reports draw on, for use if its enforcement resumes.
IFRS S2
The ISSB global baseline for climate-related financial disclosures.
Climate disclosures structured to the IFRS S2 / ISSB requirements.
ESRS E1
The climate-change standard within the EU’s CSRD reporting framework.
ESRS E1 climate datapoints mapped directly from your GHG inventory.
CDP
The global environmental disclosure system used by investors and buyers.
Export-ready answers for CDP Climate, including the C6 emissions module.
TCFD
The Task Force recommendations now consolidated under the ISSB.
The TCFD strategy recommendations: risks, opportunities and resilience across scenarios. Governance, risk management, and metrics and targets are outside the module.
SBTi
Science Based Targets initiative: corporate emissions-reduction target setting.
Part of the GHG module, not a separate one: targets are set and tracked against the inventory you have already built, under the Corporate Net-Zero Standard.
GRI 305
The GRI emissions standard, reporting Scope 1, 2 and 3 by individual gas.
305-1, 305-2 and 305-3, split by CO2, CH4, N2O and HFCs.

Border carbon and trade

Emissions embedded in goods, declared at the border by the importer.

EU CBAM
Regulation (EU) 2023/956: the Carbon Border Adjustment Mechanism. Embedded emissions for goods entering the EU, declared by the importer, who needs the figures from the producer.
Installation-level direct and indirect emissions with an Annex IV summary and a verifier portal.
CBAM Annex IV
The reporting format for specific embedded emissions per good.
Generated from your installation data and exported to XLSX.
CBAM implementing regulations
The sector rules and default values behind iron and steel, and aluminium.
Per-country sector defaults and the boundary guidance applied to your installations. Cement, fertilisers and hydrogen are in active development.

Supply chain and due diligence

Value-chain emissions, supplier data and human-rights risk.

EU CS3D
The Corporate Sustainability Due Diligence Directive on value-chain human rights and environmental impacts. Directive (EU) 2024/1760 as amended by (EU) 2026/470. Since Directive (EU) 2026/470 there is a single scope tier: an EU company is caught only with more than 5,000 employees and more than EUR 1.5bn net worldwide turnover. Member States transpose by 26 July 2028 and obligations apply from 26 July 2029. Almost certainly your customer is in scope and you are not. What reaches you is their request.
Structured human rights and environmental questionnaires you answer once and reuse for every customer that asks, plus the same collection from your own suppliers.
ESRS S2
Workers in the value chain: the CSRD standard for upstream/downstream labour impacts.
Workers-in-the-value-chain disclosures from your supplier data.
EcoVadis
Business sustainability ratings used across supply chains.
Evidence and scoring organized for EcoVadis assessments.
Modern Slavery Act
The UK and Australian modern slavery laws: an annual statement on the steps taken to address modern slavery in operations and supply chains.
Supplier questionnaire responses and the evidence behind each answer.

Corporate sustainability reporting

Double materiality and the disclosure standards behind EU and global ESG reporting.

CSRD and ESRS
The EU Corporate Sustainability Reporting Directive and its European Sustainability Reporting Standards.
CSRD needs both halves: the Materiality Assessment covers the impact half, how your organisation affects people and the environment, and the Climate Risk Screening covers the financial half, how the climate affects you. Plus ESRS datapoints across the topical standards.
GRI Universal Standards
GRI 1, 2 and 3: the reporting principles, general disclosures and material-topic determination underlying every GRI report.
General disclosures and material-topic determination generated from your data. The GRI 400 social series is covered separately by People and Workforce.
ISO 14064-3
The international standard for validation and verification of greenhouse gas statements: what an assurance provider works to.
The assurance pack and the verifier portal are assembled for ISO 14064-3 engagements.

Thresholds and transactions

Whether a company is caught at all, tested against a target, a portfolio company or yourself.

UK SECR
Streamlined Energy and Carbon Reporting. Caught by a two-of-three test on turnover, balance sheet total and employees.
Checks each part of the size test on its own, converts currencies at a dated rate, and flags a company close to a limit rather than silently putting it in or out.
CSRD thresholds
Who is caught after the Omnibus amendments, and from which financial year.
Tested against a target or a portfolio company, with the result in an IC-ready pack.
Canada S-211
The Canadian forced and child labour reporting Act, reached by a stock-exchange listing or by size.
Forced Labour Reporting tests whether the Act applies and builds the annual report. Transactions applies the two-of-three size test to a target, with the near-threshold margin flagged on both sides.

People and workforce

Own-workforce metrics, pay equity and human-capital disclosure.

ESRS S1
Own workforce: the CSRD standard covering your direct employees.
Headcount, DEI, health & safety and pay metrics mapped to ESRS S1.
GRI 400 series
GRI social topic standards (401–410) on employment, labour and diversity.
Employment, labour-relations and diversity disclosures.
Pay Transparency
Emerging gender pay-gap and pay-data reporting requirements (EU Pay Transparency Directive, CA pay data).
Gender pay-gap analysis and California pay-data reporting support.
SASB Human Capital
The workforce disclosure topics within the SASB Standards, now maintained by the ISSB, which investors ask for by sector.
Sector-specific workforce metrics, from the same data the other workforce frameworks draw on.

AI governance

Risk classification, model inventory and AI management systems.

EU AI Act
The EU’s risk-based regulation of artificial-intelligence systems.
Risk classification and conformity-readiness across your AI systems.
NIST AI RMF
The NIST AI Risk Management Framework (Govern, Map, Measure, Manage).
Govern / Map / Measure / Manage applied across your model inventory.
ISO/IEC 42001
The international standard for AI management systems.
AI management-system controls and documentation.

Cyber governance

Security posture, ICT resilience and incident management.

NIST CSF
The NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover).
Posture tracking across all six CSF functions.
ISO/IEC 27001
The international standard for information-security management systems.
ISMS controls and a maintained Statement of Applicability.
NIS2
The EU directive raising cybersecurity requirements across essential sectors.
Risk-management measures and incident-reporting workflows.
DORA
The EU Digital Operational Resilience Act for financial entities.
ICT risk and operational-resilience controls for financial entities.
SEC Cybersecurity Rules
The US disclosure rules for material cybersecurity incidents and governance, for SEC registrants.
The 5 controls the rules reach, including the 8-K materiality assessment.

SB 253, the GHG Protocol, ESRS E1, CDP and GRI 305 all start from your Scope 1 and Scope 2 figures. Calculate your Scope 1 and Scope 2 emissions free → No account needed to start. Create a free account to keep your results.

Don’t see your framework?

A framework having no card above does not mean your data cannot answer it. Most of these ask for the same underlying figures: an inventory built to the GHG Protocol, a risk assessment under a named scenario, supplier data with its basis recorded. So a questionnaire nobody has written a card for is usually answerable from what you have already collected. That is what collect once, comply everywhere means in practice.

A card above means we have mapped it: the datapoints, the format and the export. Tell us what you report under and we will tell you whether your data already serves it. What we map next is driven by what customers are actually being asked for.

See what you need to reportTalk to us