One control. Several frameworks.
Most compliance work is done more than once because nobody mapped it. The overlap between security frameworks is large and predictable — here is how it works, and where the mapping quietly breaks.
The overlap is the whole point
Security frameworks are largely restatements of the same practices for different audiences and regulators. Access is reviewed. Changes are approved. Backups are tested. Incidents are recorded and someone is accountable. A team implementing a quarterly access review is satisfying an obligation that appears, in some wording, in nearly every framework in our catalog — all 48 built-in frameworks are ready today, with 4,346 controls across 6 domains.
This is why the second framework costs far less than the first, and the third less again. The expensive part is building the practice and generating evidence for it. Restating that evidence in another standard's vocabulary is comparatively cheap — once the mapping exists.
Where it breaks: versions
The most common failure we see is not a wrong mapping, it is a stale one.ISO 27001:2022 renumbered Annex A entirely — the 2013 revision's 114 controls across A.5 to A.18 became 93 controls across four themes, A.5 to A.8. Every crosswalk written against the old numbering silently stops resolving. If a mapping cites A.9.2.5 or A.12.3.1 for ISO 27001, it was written for a superseded revision, whatever the date on the document says.
The same problem exists elsewhere and gets less attention: NIST CSF 2.0 restructured its categories, and PCI DSS 4.0 reorganised requirements against 3.2.1. A crosswalk is a living artefact with a version on both sides, not a table you build once.
What actually gets reused, and what doesn't
- The control itself — the practice, the tooling, the people who run it. Almost always reusable.
- The evidence artefact — the exported access review, the change ticket, the test result. Usually reusable, sometimes needing a different period or format.
- The scope boundary — rarely identical. Two frameworks can want the same control over different system boundaries, and that difference is where audits go wrong.
- The audit — each certification is its own engagement with its own auditor. 19 of the 48 frameworks in our catalog are independently certifiable; the rest are regulatory or advisory regimes you demonstrate rather than certify against.
A note on mapping tables you find online
Published crosswalks are a reasonable starting point and a poor finishing one. They are usually version-anchored without saying so, they assume an implementation you may not have, and they cannot know your scope. Treat them as a hypothesis to verify, not an answer — particularly if you are presenting the result to an auditor who will check.
Frequently Asked Questions
If one control satisfies six frameworks, why does each audit still cost money?
Does adding a second framework double the work?
Can you just give us the mapping table?
How current are the framework versions?
Mapping more than one framework?
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.