Most frameworks ask overlapping questions about access, change management, incident response and vendors. Mapping controls once across SOC 2, ISO 27001, NIS2 and DORA avoids running a separate programme for each.
Mappings should be kept as data rather than written into policies, because criteria get renumbered, as in the SOC 2 2027 draft.
Read more
Related terms
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Common criteria
- The common criteria are the SOC 2 Security criteria, numbered CC1 to CC9 in the 2017 version, which apply to every SOC 2 report.