QULDEXResources · Glossary
What is framework mapping? One control, many frameworks
What does framework mapping mean?
Most security and privacy frameworks ask for similar things in different words. Mapping records those overlaps so an organisation with several frameworks does not run a separate audit for each.
A mapping is a judgement, not a fact. Two requirements may overlap closely or only partly, so each link should be reviewed and the remaining gap recorded.
How closely can two requirements map?
Meeting one requirement meets the other.
The control meets part of the second requirement; a gap remains to be covered.
The second framework asks for something your control set does not address.
What does a mapped control look like?
One control mapped to three frameworks.
| Framework | Requirement the control supports |
|---|---|
| Your control | User access rights are reviewed every quarter by the system owner |
| ISO 27001 | Annex A 5.18, access rights |
| SOC 2 | CC6.2 and CC6.3, managing and modifying access |
| NIST CSF 2.0 | PR.AA, identity management, authentication and access control |
This is an illustration written for this page, not a customer record.
Where do official mappings come from?
| Source | What | What it provides |
|---|---|---|
| NIST CSF 2.0 | Informative references | Published mappings from CSF outcomes to other standards and control sets. |
| NIST OLIR | Programme | A catalogue of reference mappings between NIST documents and other frameworks. |
| SOC 2 | AICPA mappings | Mappings from the Trust Services Criteria to ISO 27001 and other frameworks. |
| ISO 27001 | ISO/IEC 27002 Annex B | Correspondence between the 2022 controls and the earlier edition. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What goes wrong with framework mapping?
Treating partial as full
A control is marked as meeting a requirement it only partly covers.
Instead: record the strength of each mapping and the gap.
Mapping once, never again
A standard is revised and the mapping is not updated.
Instead: review mappings when an edition changes.
Mapping without evidence
Controls are mapped but the evidence is still collected separately.
Instead: link the evidence to the control so it is reused too.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
Framework Mapping: common questions
Is framework mapping the same as a common controls framework?
They are closely related. A common controls framework is a single set of controls written to satisfy several standards. Mapping is the set of links that shows which requirements each control satisfies.
Will an auditor accept mapped evidence?
Usually, if the evidence meets that framework's own requirement and covers its audit period. The auditor decides whether the mapping holds.
How much work does mapping save?
It depends on how much your frameworks overlap. Measure it for your own control set; published percentages rarely transfer.
Sources
- NIST Cybersecurity Framework (CSF) 2.0
- NIST National Online Informative References Program (OLIR)
- ISO/IEC 27002:2022, Information security controls
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Test once, count it everywhere it applies
Controls, evidence, findings and corrective actions in one audit workspace.