Lesson 2.76: One control, many frameworks
Most organisations answer to more than one framework: NIST CSF 2.0 for the security strategy, ISO/IEC 27001 for certification, CIS Controls for the insurer, and customer questionnaires on top. Implementing each separately triples the work. A control map links each internal control once to every requirement it satisfies, so one piece of evidence serves several audits. In the lab you read Northwind's map, see which control carries the most requirements, find ISO controls that nothing covers, spot two controls that answer the same requirement, and catch a control with no ISO mapping.
16 min
You will learn to
- Explain why organisations map controls
- Read a control map in JSON
- Find requirements no control covers
- Find overlapping controls
- Keep one evidence set for several frameworks
Key terms
- Control map
- A table linking each internal control to the framework requirements it satisfies.
- Annex A
- ISO/IEC 27001:2022's list of 93 reference controls in four themes.
- Statement of Applicability (SoA)
- The ISO document listing which Annex A controls apply and why.
- Common control
- One implemented control that satisfies requirements in several frameworks.
- Coverage gap
- A required control that no internal control implements.
← Encryption in everyday life: at rest, in transit, and hashing · All lessons · Testing a control: sampling and evidence →