01 · Common control library
One library, mapped to everything it satisfies
One control, mapped to every framework requirement it satisfies, with the evidence that stands behind it. Your team works from 115 controls in 17 domains, not from a separate spreadsheet per framework.
- See at a glance which frameworks each control reaches, and the requirement IDs behind them.
- Filter by framework, domain, or what is still owed to an assessor.
- Status is calculated from the record, not written by a model, so it reads the same every time.
Why it matters
Maintain one set of controls, and stop re-answering the same question for each framework.
| Control ID | Control name | Mapped frameworks | Owner | Assessor asks |
|---|---|---|---|---|
| CTL-IAM-04 | Multi-factor authentication is enforced for production and regulated-data access | PCI DSSISO 27001NIST CSFSOC 2 | Rita Okonkwo | all on hand |
| CTL-CRY-02 | Data in transit is protected with strong cryptography | PCI DSSISO 27001GDPRSOC 2 | Noor Haddad | some missing |
| CTL-RSK-01 | Information security risk assessment methodology is defined and applied | ISO 27001NIST CSFGDPRSOC 2 | Dana Alcott | nothing yet |
| CTL-IAM-01 | Access is provisioned through an approved request and authorisation process | PCI DSSISO 27001NIST CSF | Rita Okonkwo | all on hand |
02 · Shared evidence
Upload once, and every framework moves
Evidence attaches to the control, so one document counts everywhere that control reaches. Adopt a new framework and you start with credit for the work you have already done.
- Every document shows where it counts, framework by framework.
- Shared where it is shared, specific where it is not: a document is also checked against a requirement's own wording.
- So a control can pass and a requirement can still say what is missing. Nothing is overclaimed for you.
Why it matters
The owner of a control is asked once, and each new framework starts ahead rather than from zero.
Where it counts
03 · Scoping
Measured against what actually applies
Your organisation answers once, for every programme. Each answer says what it changes, and change one later and every programme that depends on it is worked out again.
- Requirements that do not apply are marked, with the reason, and leave the total.
- Questions start pre-filled from discovery, as suggestions a person accepts.
- Each requirement explains itself in plain English: what the standard says, why it matters, what good looks like and what an assessor checks.
Why it matters
Your progress is measured against the right total, and nobody collects evidence for something that never applied.
Frameworks
The obligations you answer to, in one record
- SOC 2United States · AICPA
- ISO 27001International
- PCI DSSPayments · Global
- NIST CSF 2.0United States · NIST
- NIST SP 800-53United States · NIST
- GDPREuropean Union
- ISO 42001International
- EU AI ActEuropean Union
- PDPOHong Kong
- RegionalRegional requirements where you operate