<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-control-framework-mapping
description: >-
  Map security controls across multiple compliance frameworks (NIST CSF, ISO 27001, CIS Controls, SOC 2, PCI DSS) to eliminate duplicate efforts and demonstrate unified control coverage.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - control-mapping
  - nist-csf
  - iso-27001
  - cis-controls
  - soc2
  - cross-framework
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Control Framework Mapping

## Overview

Organizations subject to multiple frameworks waste effort implementing and evidencing duplicate controls. This technique builds cross-framework control mappings that implement once and satisfy many, reducing audit burden while improving coverage visibility.

Mode: `[MODE: ARCHITECT]` — Control framework mapping and rationalization.

## Prerequisites

| Requirement | Details |
|---|---|
| Framework documentation | NIST CSF 2.0, ISO 27001:2022, CIS v8 |
| Control inventory | Current implemented controls |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Cross-Framework Control Matrix

```
Example: Multi-Factor Authentication
├── NIST CSF 2.0: PR.AA-02 (Identities are proofed and bound)
├── ISO 27001:2022: A.8.5 (Secure authentication)
├── CIS Controls v8: 6.3 (Require MFA for externally-exposed apps)
├── SOC 2: CC6.1 (Logical access security)
├── PCI DSS v4.0: 8.4.2 (MFA for all access to CDE)
├── HIPAA: §164.312(d) (Person or entity authentication)
├── FedRAMP: IA-2(1) (MFA to privileged accounts)
└── CMMC: AC.L2-3.5.3 (Multifactor authentication)

Benefits:
├── Single control implementation → 8 framework requirements
├── One evidence artifact → multiple audit responses
├── Unified testing schedule
└── Clear gap identification across all frameworks
```

### 2. Mapping Methodology

```
Steps:
├── 1. Inventory all framework requirements
│   ├── Extract control objectives from each framework
│   ├── Normalize language and terminology
│   └── Identify control domains (access, crypto, logging...)
├── 2. Create common control catalog
│   ├── Group by security domain
│   ├── Define common control description
│   └── Map framework-specific requirements to common controls
├── 3. Assess coverage
│   ├── Identify controls covering multiple frameworks
│   ├── Find gaps (framework requirements without controls)
│   └── Prioritize implementation by coverage breadth
└── 4. Maintain mappings
    ├── Update when frameworks release new versions
    ├── Track control implementation status
    └── Generate compliance dashboards per framework
```

### 3. Gap Analysis

```
Coverage matrix output:
├── Common Control: "Encryption at Rest"
│   ├── NIST CSF: PR.DS-01 ✓ (implemented)
│   ├── ISO 27001: A.8.24 ✓ (implemented)
│   ├── PCI DSS: 3.5.1 ✓ (implemented)
│   ├── HIPAA: §164.312(a)(2)(iv) ✗ (partial)
│   └── Gap: HIPAA requires encryption of PHI at rest
│         with documented key management procedures
└── Action: Document key management process for HIPAA
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
