N100FN100F
Published on

One control, several frameworks

ISO 27001, NIST CSF, CIS, customer and regulatory requirements: each framework asks for its own thing, and almost all of them ask for the same thing in different words. Your own catalogue of controls, each mapped to every framework, saves doing the same work five times.

Service line Cybersecurity

Five frameworks, one organisation

A mid-sized company may have to answer at the same time to a certification (ISO/IEC 27001, for instance), to a reference framework (such as the NIST Cybersecurity Framework), to a list of technical controls (such as the CIS Controls), to its customers' security questionnaires and to its sector's regulation.

If each one is treated as a separate project, you end up with five spreadsheets, five audits and the same controls described in five different ways.

Your own catalogue at the centre

One control, several frameworksThree of your own controls connected to the equivalent requirements of four frameworks.SECURITY · FRAMEWORKSOne control, several frameworks ISO/IEC 27001 NIST CSF CIS Controls Customers Second factor onadministrative access4 frameworks Encryption of dataat rest and in transit4 frameworks Quarterly reviewof access3 frameworksEvidence is collected once per control,and serves every framework that requires it.Example mappingsN100F · n100f.com

The alternative is your own catalogue of controls, written in the organisation's language, and a table relating each control to each framework's requirements:

  • One control ('all administrative access requires a second factor') can satisfy requirements from three or four frameworks at once.
  • A new framework does not force you to start from scratch: it is mapped against the existing catalogue and only the gaps show up.
  • Evidence is collected once per control and serves every framework that requires it.

How it is built

  1. Start from a broad framework as the skeleton: usually the one required by the certification that matters most to the business.
  2. Write each control in your own language, concrete and checkable (to the same criteria as a standard you can actually comply with).
  3. Map the other frameworks against that catalogue.
  4. Review the map whenever a framework changes version.

What the framework does not decide

No framework says how much risk an organisation is willing to accept or what to protect first. That is decided at the strategic level (as we saw in what gets decided at each level) and reflected in the catalogue: which controls are mandatory for everything and which only for the most critical systems.

A well-mapped catalogue of controls is necessary, but not sufficient: each control has to be demonstrable.

How we apply it: Cybersecurity.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk