Compliance isn't security, but crosswalks help with both

It's one of the oldest observations in the profession: compliance isn't security. Breach reports regularly feature organisations that held the right certificates and passed their audits. The observation is true, but the usual conclusion, that compliance is theatre, is wrong. Compliance and security overlap a great deal. The trouble is what happens at the edges, and how much time compliance consumes.

Where they align

Frameworks agree on the fundamentals because the fundamentals work. Every one of the eleven frameworks we map requires asset management, vulnerability management, backup and recovery, incident response and incident reporting (the common core). Most require MFA, logging, access reviews and supplier security. An organisation that genuinely does these things is much harder to breach than one that doesn't, certificate or not.

Where they diverge

• Scope. An audit covers a defined system. Attackers don't respect scope: the breach comes through the corporate laptop, the forgotten test server or the supplier outside the boundary.
• Point in time. Controls that operate on the audit sample may not operate everywhere, every day.
• Design versus effectiveness. A control can exist, be documented and be tested, and still not stop the attack it was meant for: MFA that can be phished, a scanner that doesn't see half the estate.
• What frameworks leave out. Several of the most exploited attack paths (APIs, web applications, DNS) are required by few frameworks, as our analysis of the topics frameworks miss shows.

The real cost: time

The bigger problem isn't that compliance is wrong; it's that it's expensive. An organisation with three or four frameworks can spend most of its security effort on mapping, evidence and audits, much of it duplicated. Every hour spent producing the same access review in three formats is an hour not spent on threat hunting, hardening or the attack surface no auditor looks at.

How crosswalks help both

This is where mapping earns its keep. If you know that one control satisfies ISO 27001, SOC 2, PCI DSS and NIS2 at once, you implement it once, evidence it once, and stop paying the compliance tax three times. The time you save is the time security needs. A good crosswalk also shows you where frameworks are silent, which is exactly where your own risk assessment has to lead.

Direction	Mapped	Loosely related	No mapping
Have ISO 27001 → need SOC 2	41 of 61 (67%)	0	20	report →
Have SOC 2 → need ISO 27001	98 of 123 (80%)	21	4	report →

Signs a programme has become compliance-only

• Security work is scheduled around audit dates, not threats.
• Controls exist only within audit scope; the rest of the estate is untouched.
• Metrics measure documents and completion rates, not outcomes like time to patch or time to detect.
• The team can say which framework requirement a control satisfies, but not which attack it stops.
• Findings are closed by changing documents rather than changing systems.

If several of these sound familiar, the fix isn't to drop compliance; it's to automate it and redirect the time saved.

Key takeaways

• Compliance and security share the fundamentals but diverge at the edges.
• The biggest cost of compliance is duplicated effort.
• Map once, automate evidence and spend the time saved on security.

What to do

1. Build one control set mapped to every framework you answer to, rather than one programme per framework.
2. Automate evidence wherever the system can produce it.
3. Spend the time saved on what audits don't see: attack-surface management, detection engineering, testing.
4. Measure security separately from compliance: incidents, time to patch, phishing resilience, recovery time.

Compliance is the floor, not the ceiling. Use crosswalks to get to the floor as cheaply as possible, then build up. The gap analysis and the coverage matrix are where to start.

Questions

Is a compliant organisation secure?

Not necessarily. Compliance shows that specific controls exist and operate within a defined scope; attackers target whatever is weakest, inside the scope or not.

Does compliance improve security at all?

Yes: frameworks enforce basics many organisations would otherwise skip, such as asset inventories, patching, access reviews and incident plans. The problem is when compliance becomes the whole programme.