One Control Set, Many Frameworks: How to Stop Doing Compliance Twice
Most companies end up with several frameworks at once, each with its own spreadsheet, owner, and evidence folder. Mapping them to one control set cuts that duplication, and it is the most effective thing a compliance program can do.
The problem
A SOC 2 auditor asks for an access review. Your ISO 27001 surveillance audit asks for the same review. Your PCI DSS assessor wants the same thing for the cardholder environment. Without a plan, three teams produce three versions of the same evidence, each slightly different, and each one is a finding waiting to happen.
A method that works
- Inventory your obligations. List every framework, contract clause, and regulation that applies, with its scope.
- Build one control set. Write controls in your own words, grouped by the work people actually do. Keep the list short enough to own.
- Map each requirement to a control. Each framework requirement should point to at least one control. Where a requirement has no control, you have a gap.
- Define one evidence source per control. Pick the system of record, such as an identity provider export or a ticketing report, and the frequency it is collected.
- Assign an owner and a cadence. Every control needs a person accountable for it and a schedule for review.
- Review gaps per framework. The mapping shows where a framework needs something the others do not, such as a DPIA under GDPR or a script inventory under PCI DSS.
A worked example: multi-factor authentication
One control, MFA for access to sensitive systems, can satisfy requirements across several frameworks. The mapping below is illustrative. Confirm each mapping against the exact requirement text and your scope.
| Framework | Requirement area |
|---|---|
| ISO/IEC 27001:2022 | Annex A 8.5, secure authentication |
| SOC 2 | CC6.1, logical access security |
| PCI DSS v4.0.1 | Requirement 8.4, MFA for access into the CDE |
| HIPAA Security Rule | Person or entity authentication, 45 CFR 164.312(d) |
| NIST SP 800-171 / CMMC | 3.5.3, MFA for local and network access |
| GDPR | Article 32, security of processing |
The evidence is the same for all of them: an identity provider report showing MFA enforced for the relevant population, plus a quarterly review of exceptions. Collect it once, and label it with each framework it supports.
What this does for your business
A single control set makes audits faster and cheaper, and it makes answers to customer questionnaires consistent. It also shows you where you are overinvesting in one framework while another has a real gap. Companies that adopt this approach usually find that the second and third framework cost a fraction of the first.
Do not start with the frameworks. Start with the controls you already run, then map the frameworks onto them. If a framework requires something you do not do, that is a decision to make, not a surprise at audit time.
Frequently asked questions
What is a control mapping?
A control mapping links each requirement in one or more frameworks to a control your organization operates. It shows where requirements overlap and where gaps exist.
Which framework should be the base for the control set?
Many organizations use ISO 27001 Annex A or NIST SP 800-53 as the base because they are comprehensive. The right choice depends on which frameworks you must meet.
How many controls should a unified set have?
There is no standard number. The goal is a set small enough for owners to operate and evidence, typically a few dozen to a couple of hundred, depending on scope.
Does mapping mean one audit covers all frameworks?
No. Each framework still has its own assessment, assessor, and report. Mapping reduces duplicated evidence work, not the audits themselves.
Related articles
Want this applied to your company?
A free 30-minute scoping call tells you which frameworks apply and what it would take.