Blog
Blog
Analysis built on the crosswalk data, practical how-tos, and opinion from Paul Gillet. RSS feed
Analysis
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.
Analysis · 2026-09-29HIPAA Security Rule through the NIST CSF 2.0 lensA NIST CSF 2.0 programme maps to almost every HIPAA Security Rule requirement. What carries over, the two that don't, and what CSF adds beyond HIPAA.
Analysis · 2026-09-15Encryption requirements compared: what frameworks specify and what they leave to youHow ISO 27001, PCI DSS, CMMC, HIPAA, GDPR and NIS2 treat encryption at rest, in transit and key management, with the requirement IDs.
Analysis · 2026-08-18Incident response requirements compared across frameworksIncident response plans, testing and reporting deadlines compared across ISO 27001, SOC 2, PCI DSS, NIS2, GDPR, CMMC and HIPAA.
Analysis · 2026-08-04Physical security across frameworks: the topic cloud-first companies forgetPhysical security requirements compared across ISO 27001, PCI DSS, CMMC, HIPAA and SOC 2, and how cloud-first companies meet them.
Analysis · 2026-07-02Logging and log retention requirements comparedAudit logging and log retention compared across ISO 27001, PCI DSS, CIS, SOC 2, HIPAA, CMMC and NIST, including the few fixed retention periods.
Analysis · 2026-05-19How much of PCI DSS v4.0.1 does ISO 27001 actually cover?ISO 27001 maps to under a third of PCI DSS v4.0.1 requirements. Where the overlap is, why most of PCI is new work even for an ISMS, and how to plan for it.
Analysis · 2026-04-07GDPR's security articles mapped: the security half of a privacy lawGDPR is a privacy law, but Articles 5, 25, 28, 32 to 35 and 37 to 39 impose security duties. How they map to ISO 27001 and NIST, and what an ISMS leaves out.
Analysis · 2026-02-24Backup and recovery requirements compared across frameworksBackup frequency, protection and restore testing compared across ISO 27001, CIS, PCI DSS, HIPAA, SOC 2, NIS2, the Essential Eight and NIST.
Analysis · 2026-01-06CMMC Level 2 traced to SP 800-53: what NIST's Appendix D tells youEvery CMMC Level 2 practice traces to NIST SP 800-53 through SP 800-171 Appendix D. How the map works, Rev 5 changes and the one practice left over.
Analysis · 2025-11-25The security topics the fewest frameworks require, and why that mattersDNS, threat intelligence, API and web application security are the topics fewest frameworks require. Why, and why that's not permission to skip them.
Analysis · 2025-10-14What ISO 27001 covers in NIS2, point by pointISO 27001 maps to every point of the NIS2 Implementing Regulation, yet certification alone isn't NIS2 compliance. What carries over, what doesn't, and why.
Analysis · 2025-08-27Crosswalk or judgement? How much framework mapping rests on published evidenceWe labelled every framework mapping as published crosswalk or editorial judgement. How the split varies by framework, and why it matters to you.
Analysis · 2025-07-15The common core: security requirements every framework sharesFive security topics appear in all 11 major frameworks, from ISO 27001 and SOC 2 to NIS2 and the Essential Eight. What they are, and why to build them first.
Analysis · 2025-06-03The CIS Controls gap: why only 49 of 153 safeguards have a published crosswalkCIS's published mapping to NIST CSF 2.0 covers only 49 of 153 CIS Controls v8.1 safeguards. Why, and what it means for CIS mappings you rely on.
Analysis · 2025-04-17Vendor and supply-chain risk: who requires whatSupplier and supply-chain security requirements compared across ISO 27001, SOC 2, PCI DSS, NIS2, GDPR, HIPAA and NIST CSF 2.0.
Analysis · 2025-04-02SOC 2 criteria with no ISO 27001 equivalent, and why they existMost SOC 2 criteria map to ISO 27001, but Processing Integrity and most Privacy criteria don't. Which ones, why, and what to do if they're in scope.
Analysis · 2025-03-04NIST CSF 1.1 to 2.0: where the withdrawn subcategories wentNIST withdrew 79 CSF 1.1 subcategories in CSF 2.0, moving or merging them into others. The full table of where each went, and how to update old mappings.
Analysis · 2025-01-21NIST CSF 2.0's Govern function: which frameworks already cover it?CSF 2.0 added a Govern function for risk strategy, roles, policy, oversight and supply chain risk. Which frameworks already cover it, and the gaps.
Analysis · 2024-12-05Which security framework is the best starting point? We measured itWe measured how much of ten other frameworks each of 11 security frameworks covers. SP 800-53 and ISO 27001 lead, but who is asking decides.
Analysis · 2024-10-22Essential Eight vs ISO 27001: why most links are only "loosely related"ISO 27001 covers every Essential Eight strategy in principle, but most of ASD's controls are only loosely related to Annex A. What that means for you.How-to
How-to · 2026-09-01Preparing for a CMMC Level 2 assessment when you already run SP 800-53How organisations already running NIST SP 800-53 can prepare for a CMMC Level 2 assessment: CUI scope, the SSP, evidence reuse and pitfalls.
How-to · 2026-07-21How to read a crosswalk, and when not to trust oneWhat a framework crosswalk does and doesn't tell you: relationship types, direction, versions, granularity and authorship, with checks before you rely on one.
How-to · 2026-06-03From ISO 27001 to NIS2: a practical gap-closing planA step-by-step plan for an ISO 27001-certified organisation now under NIS2: scope, registration, management duties, reporting and deeper measures.
How-to · 2026-04-21Vendor due diligence: one process for many frameworksOne vendor due diligence process for ISO 27001, SOC 2, PCI DSS, GDPR, HIPAA and NIS2: tiering, assurance reports, contracts and monitoring.
How-to · 2026-03-10From gap report to project plan: owners, evidence and timelinesHow to turn a framework gap analysis into a project plan: workstreams, sequencing, estimates, owners, and evidence tracked through to audit.
How-to · 2026-01-21Change management evidence auditors acceptWhat change management evidence passes SOC 2 (CC8.1), ISO 27001 (A.8.32), PCI DSS and NIS2 audits, from pull requests to emergency changes.
How-to · 2025-12-09User access reviews that satisfy every auditorHow to run user access reviews that pass ISO 27001, SOC 2, PCI DSS, HIPAA and CMMC audits: scope, frequency, reviewers and evidence.
How-to · 2025-10-28How to run a gap analysis between two frameworks, and turn it into a trackerA practical method for a gap analysis between two security frameworks: scope, read each match, validate the links and turn it into a tracker.
How-to · 2025-09-11One risk assessment for ISO 27001, SOC 2 and HIPAAHow to run one information security risk assessment that satisfies ISO 27001, SOC 2 and the HIPAA Security Rule, and what each audit checks.
How-to · 2025-07-29Choosing your Essential Eight target maturity levelHow to choose an Essential Eight target maturity level: what each level defends against, who needs Level Two or Three, and how to progress.
How-to · 2025-06-17Writing a Statement of Applicability that survives the auditHow to write an ISO 27001:2022 Statement of Applicability: what it must contain, justifying exclusions, and common audit findings.
How-to · 2025-05-20Reporting to the board with NIST CSF 2.0 profilesHow to use NIST CSF 2.0 Current and Target Profiles to report cybersecurity to a board: what to show and how to link it to your frameworks.
How-to · 2025-05-01Scoping a first SOC 2 report without over-committingHow to scope a first SOC 2 report: which system, which Trust Services Criteria, carve-outs and user entity controls, and costly scope mistakes.
How-to · 2025-03-18Mapping one policy set to several frameworks without rewriting itHow to structure one set of security policies that satisfies ISO 27001, SOC 2, NIST, PCI DSS and NIS2, and what each framework requires in writing.
How-to · 2025-02-04Building an incident reporting procedure for the NIS2 24- and 72-hour deadlinesHow to build a NIS2 significant-incident reporting procedure: deciding significance, the 24-hour early warning, 72-hour notification and one-month final report.
How-to · 2024-12-24Evidence you can reuse across SOC 2, ISO 27001 and PCI DSSWhich audit evidence serves SOC 2, ISO 27001 and PCI DSS at once, what each auditor needs that the others don't, and how to collect it once.
How-to · 2024-11-06One control set for SOC 2 and ISO 27001: run both without doing everything twiceHow to run SOC 2 and ISO 27001 from a single control set: what overlaps, what each adds, how to structure controls and evidence, and how to line up the audits.Opinion
Opinion · 2026-06-17Why we label every mapping "crosswalk" or "editorial"Why ControlMapping marks every framework mapping as published crosswalk or editorial judgement, and why visible sourcing matters for compliance data.
Opinion · 2026-05-05The case for open, free compliance dataFramework mappings are mostly locked in paid tools and spreadsheets. Why compliance mapping data should be open, sourced and free to reuse.
Opinion · 2026-03-24What 20 years in cybersecurity taught me about auditsLessons from two decades of security audits: evidence beats narrative, scope decides everything, and controls fail when nobody owns them.
Opinion · 2026-02-05AI-written security policies: useful shortcut or audit risk?Generative AI can draft security policies in minutes. Where that helps, where it creates audit findings, and how to use it without empty policies.
Opinion · 2025-12-23Compliance isn't security, but crosswalks help with bothWhy passing audits doesn't make an organisation secure, where compliance and security align, and how framework mapping frees time for security.
Opinion · 2025-11-11Stop buying compliance tools before you've written the policiesWhy organisations that buy compliance or security tools before deciding how they'll operate often end up with shelfware, and the order of work that avoids it.
Opinion · 2025-09-25The problem with vendor crosswalks you can't checkCompliance platforms map one control to many frameworks with crosswalks nobody can inspect. Why that's a risk, and what to demand instead.
Opinion · 2025-08-12NIS2 management liability: will it change how boards behave?NIS2 makes management bodies approve, oversee and train for cybersecurity, with liability. Will that change board behaviour, and what boards should do.
Opinion · 2025-07-01Does a small company need ISO 27001?When ISO 27001 makes sense for a small company, when SOC 2 or a technical baseline should come first, and how to keep certification proportionate.
Opinion · 2025-02-18Framework fatigue: pick a hub framework and map everything else to itOrganisations answering to several security frameworks burn out running each separately. Why choosing one hub framework and mapping the rest to it works better.
Opinion · 2025-01-07Should organisations outside Australia use the Essential Eight?ASD's Essential Eight is an Australian baseline with universal advice. Why organisations elsewhere might adopt it, and how it fits beside ISO or NIST.
Opinion · 2024-11-20Why "are you SOC 2 certified?" is the wrong questionThere is no SOC 2 certification. What the question really asks, what a SOC 2 report shows and doesn't, and better questions to ask vendors.