What is control mapping?
Control mapping is linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once. It is how a company with several frameworks avoids running several separate programmes.
How it works
Start from your own controls, then record which requirements in each framework every control helps meet. A quarterly access review, for example, supports the access rights control in ISO 27001 Annex A (5.18), the logical access criteria in SOC 2 (CC6) and the access control family of NIST SP 800-171.
The relationship runs both ways. One control can map to many requirements, and one requirement usually needs several controls. If you run ISO 27001, the Statement of Applicability already does part of this work, because it records how your controls compare with Annex A.
Where mappings go wrong
A mapping is a judgement. Auditors test against their own framework’s wording, and they do not accept a mapping as proof. A control that fully meets one requirement may only partly meet another, so record partial matches as partial and note what is missing.
- Too broad. Mapping one general policy to every governance requirement hides real gaps.
- Wrong edition. Mappings to ISO 27001:2013 control numbers need rework for the 2022 edition.
- Missing evidence. A mapping counts for nothing at audit if the control behind it has no evidence.
- Frequency mismatch. Where frameworks expect a task at different intervals, run the control at the stricter one.
Published mappings and your own
Framework owners publish mappings between their documents. NIST publishes informative references linking its frameworks to other standards, and the AICPA has published mappings from the Trust Services Criteria to other frameworks.
These are useful starting points, but they map requirement to requirement. You still need to map your own controls, because that is what the auditor tests and where the evidence sits.
Certifyi works at that control level: you map a control once and reuse the mapping across frameworks, with the evidence kept on the control the auditor will test.
Questions
Control mapping, answered
Does control mapping mean one audit covers several frameworks?
No. Each framework still has its own audit or assessment, by its own type of auditor. Mapping means the controls and evidence are shared, so each audit draws on the same work.
Should we map frameworks to each other or to our controls?
To your controls. Requirement-to-requirement mappings show where frameworks overlap, but only a control-level mapping shows what you actually run and where the evidence is.
How often should mappings be reviewed?
Whenever a framework publishes a new edition, when you add a framework and when a control changes. Checking them at each management review keeps them from drifting.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them