A new regulatory framework arrives, and the instinct is to stand up a project for it: a new policy set, a new evidence exercise, a new certification timeline, run mostly independently of whatever the organization already does for the frameworks it already holds. Repeat that instinct enough times and the compliance function ends up maintaining several near-identical control sets under different names, each evidenced separately.Why Chasing Frameworks One at a Time FailsMost major frameworks — ISO 27001, SOC 2, regional data protection law, sector-specific regulation — overlap heavily on the underlying controls they actually require: access management, change control, incident response, vendor oversight. Treating each as its own project means testing and evidencing the same underlying control multiple times, in slightly different language, for slightly different auditors, none of whom benefit from the duplication.What Mapping Instead of Chasing Looks LikeOne control set, cross-mapped to every framework that references it: a single access-review control satisfies every framework's version of the same requirement, evidenced once.Gaps assessed against the union of requirements, not framework by framework: a new framework's requirements are checked against what already exists before anything new is built.New frameworks folded into the architecture, not bolted beside it: a new regulatory obligation extends the shared control set rather than starting a parallel one.One evidence calendar, not one per certification: so evidence collection happens on a schedule the whole programme shares rather than in staggered, overlapping audit cycles.“A compliance team maintaining five frameworks separately is not five times more compliant. It is doing the same work five times.”The Payoff CompoundsThe advantage of mapped architecture is not visible on the first framework — it shows up on the second and third, when a new regulatory obligation arrives and the honest answer to 'how much new work does this create' is mostly none, because the underlying controls were already built to be reused rather than to serve one certification at a time.Share this articleX (Twitter)LinkedInFacebookCopy Link
ComplianceAug 28, 2026Continuous Assurance Without the Audit-Season ScrambleMost compliance programmes run fine for eleven months and then spend the twelfth reconstructing evidence for controls that were supposed to be operating the whole time.
ISMSJul 31, 2026An ISMS Is a System, Not a BinderISO 27001 certifies an information security management system — an operating system for decisions, not the folder of policies produced to pass the audit that certifies it.
ISMSJun 5, 2026The Management Review Meeting Nobody Prepares ForISO 27001's management review clause asks leadership to actually govern the ISMS. In practice it is often a status update nobody expects to change anything.
