Which security framework is the best starting point? We measured it
If you can only implement one framework first, pick the one that takes you furthest towards the others. We measured how far each one gets you.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
"Which framework should we start with?" is one of the first questions any security programme faces, and the usual answers are opinions. We wanted a number: if you implement framework X, how much of every other framework have you already addressed?
ControlMapping maps the requirements of eleven frameworks to each other, so we can measure it. For each framework, we took every other framework in turn and counted how many of its requirements have at least one mapping to the first, then averaged across the ten.
The ranking
| If you have | Average share of other frameworks mapped | Covers most of | Covers least of |
|---|---|---|---|
| 800-53 | 80% | CIS v8.1 (100%) | PCI DSS (30%) |
| ISO 27001 | 69% | CIS v8.1 (100%) | PCI DSS (30%) |
| PCI DSS | 66% | CIS v8.1 (95%) | 800-53 (28%) |
| SOC 2 | 64% | CIS v8.1 (98%) | 800-53 (26%) |
| NIST CSF 2.0 | 62% | CIS v8.1 (100%) | 800-53 (29%) |
| NIS2 | 61% | CIS v8.1 (94%) | 800-53 (25%) |
| CMMC | 58% | CIS v8.1 (93%) | PCI DSS (26%) |
| HIPAA | 50% | GDPR (92%) | PCI DSS (20%) |
| CIS v8.1 | 44% | NIS2 (69%) | 800-53 (21%) |
| GDPR | 37% | NIS2 (59%) | Essential Eight (12%) |
| Essential Eight | 24% | CIS v8.1 (50%) | 800-53 (9%) |
Share = requirements of the other framework with at least one mapping (crosswalk or editorial) to this one, averaged over the other 10. Computed live from the same data as the gap analysis.
Two frameworks stand out. NIST SP 800-53 maps to the largest share of everything else, which is no surprise: it is a catalogue of hundreds of controls written to cover nearly every security and privacy topic, and NIST publishes official mappings from it to CSF 2.0 and ISO 27001. ISO 27001 comes next, because Annex A covers the same ground at a higher level and the management-system clauses add governance that most frameworks touch.
At the other end, the Essential Eight maps to the least, by design. It is eight targeted mitigation strategies, not a full programme, so implementing it leaves most of any other framework untouched. GDPR is low for a similar reason: only its security articles are in scope.
Read the numbers carefully
Three things to keep in mind:
- Mapped is not met. A mapping means two requirements address the same subject. ISO 27001's vulnerability control and PCI DSS's quarterly scanning requirement are mapped, but meeting the first doesn't satisfy the second.
- Granular frameworks look easy to cover. Almost every framework appears to cover nearly all of the CIS Controls. CIS has 153 specific safeguards, so most frameworks touch each one at topic level, and most CIS links are our editorial judgement, because CIS's published crosswalk covers only 49 safeguards. Treat the CIS column as "touched", not "done".
- Specific frameworks look hard to cover. PCI DSS and SP 800-53 are the hardest for others to cover, because they contain many detailed requirements that broader frameworks don't spell out.
Who is asking decides
The measurement tells you which framework gives the broadest foundation. It doesn't tell you which one you need, and that usually settles the question:
- US enterprise customers ask for a SOC 2 report. If a deal depends on it, start there.
- International customers, tenders and regulators ask for ISO 27001 certification.
- US federal work means SP 800-53 (and FedRAMP for cloud); defence contracts mean CMMC Level 2.
- Card payments mean PCI DSS, whatever else you do.
- EU digital providers and critical sectors need NIS2.
- Nobody asking yet? ISO 27001 or NIST CSF 2.0 give the broadest base. CSF is free and lighter to start; ISO adds a certificate when you need one. SP 800-53 covers the most, but its size makes it a heavy first step for most private companies.
Then extend, don't restart
Whichever you start with, the second framework is cheaper than the first. Run a gap analysis from the framework you have to the one you need, and you get the requirement-by-requirement list of what carries over and what is new, with the evidence for each link. The comparisons cover the most common pairs in more depth, such as ISO 27001 vs SOC 2 and NIST CSF vs ISO 27001.
How we measured it
For each ordered pair of frameworks we used the same calculation as the gap analysis: a requirement counts as mapped when it is curated into the same ControlMapping topic as a requirement of the other framework, or linked to one directly by a published crosswalk or an editorial link with a stated reason. Requirements that only share a NIST CSF 2.0 outcome ("loosely related") don't count. The numbers above are computed live from the current data; see the methodology.
Questions
Which security framework covers the most of the others?
In ControlMapping's data, NIST SP 800-53 covers the largest share of the other frameworks' requirements on average, followed by ISO 27001. A mapping means the requirements address related outcomes, not that one satisfies the other.
Should a small company start with ISO 27001 or SOC 2?
Start with what your customers ask for. If nobody is asking yet, ISO 27001 or NIST CSF give the broadest foundation; SOC 2 is the fastest route to a report if a US deal depends on it.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.