https://controlmapping.org/blog/ Analysis, how-tos and opinion on security frameworks. en https://controlmapping.org/blog/apra-cps-234-iso-27001/ https://controlmapping.org/blog/apra-cps-234-iso-27001/ Tue, 27 Oct 2026 09:00:00 GMT An ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/cyber-essentials-vs-essential-eight/ https://controlmapping.org/blog/cyber-essentials-vs-essential-eight/ Tue, 27 Oct 2026 09:00:00 GMT The UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/dora-vs-nis2-what-carries-over/ https://controlmapping.org/blog/dora-vs-nis2-what-carries-over/ Tue, 27 Oct 2026 09:00:00 GMT DORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/mfa-requirements-compared/ https://controlmapping.org/blog/mfa-requirements-compared/ Tue, 13 Oct 2026 09:00:00 GMT Which frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/hipaa-security-rule-nist-csf/ https://controlmapping.org/blog/hipaa-security-rule-nist-csf/ Tue, 29 Sep 2026 09:00:00 GMT A NIST CSF 2.0 programme maps to almost every HIPAA Security Rule requirement. What carries over, the two that don't, and what CSF adds beyond HIPAA. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/encryption-requirements-compared/ https://controlmapping.org/blog/encryption-requirements-compared/ Tue, 15 Sep 2026 09:00:00 GMT How ISO 27001, PCI DSS, CMMC, HIPAA, GDPR and NIS2 treat encryption at rest, in transit and key management, with the requirement IDs. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/cmmc-level-2-assessment-800-53/ https://controlmapping.org/blog/cmmc-level-2-assessment-800-53/ Tue, 01 Sep 2026 09:00:00 GMT How organisations already running NIST SP 800-53 can prepare for a CMMC Level 2 assessment: CUI scope, the SSP, evidence reuse and pitfalls. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/incident-response-requirements-compared/ https://controlmapping.org/blog/incident-response-requirements-compared/ Tue, 18 Aug 2026 09:00:00 GMT Incident response plans, testing and reporting deadlines compared across ISO 27001, SOC 2, PCI DSS, NIS2, GDPR, CMMC and HIPAA. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/physical-security-requirements-compared/ https://controlmapping.org/blog/physical-security-requirements-compared/ Tue, 04 Aug 2026 09:00:00 GMT Physical security requirements compared across ISO 27001, PCI DSS, CMMC, HIPAA and SOC 2, and how cloud-first companies meet them. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/how-to-read-a-crosswalk/ https://controlmapping.org/blog/how-to-read-a-crosswalk/ Tue, 21 Jul 2026 09:00:00 GMT What a framework crosswalk does and doesn't tell you: relationship types, direction, versions, granularity and authorship, with checks before you rely on one. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/logging-retention-requirements-compared/ https://controlmapping.org/blog/logging-retention-requirements-compared/ Thu, 02 Jul 2026 09:00:00 GMT Audit logging and log retention compared across ISO 27001, PCI DSS, CIS, SOC 2, HIPAA, CMMC and NIST, including the few fixed retention periods. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/why-label-crosswalk-or-editorial/ https://controlmapping.org/blog/why-label-crosswalk-or-editorial/ Wed, 17 Jun 2026 09:00:00 GMT Why ControlMapping marks every framework mapping as published crosswalk or editorial judgement, and why visible sourcing matters for compliance data. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/iso-27001-to-nis2-plan/ https://controlmapping.org/blog/iso-27001-to-nis2-plan/ Wed, 03 Jun 2026 09:00:00 GMT A step-by-step plan for an ISO 27001-certified organisation now under NIS2: scope, registration, management duties, reporting and deeper measures. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/iso-27001-pci-dss-coverage/ https://controlmapping.org/blog/iso-27001-pci-dss-coverage/ Tue, 19 May 2026 09:00:00 GMT ISO 27001 maps to under a third of PCI DSS v4.0.1 requirements. Where the overlap is, why most of PCI is new work even for an ISMS, and how to plan for it. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/open-free-compliance-data/ https://controlmapping.org/blog/open-free-compliance-data/ Tue, 05 May 2026 09:00:00 GMT Framework mappings are mostly locked in paid tools and spreadsheets. Why compliance mapping data should be open, sourced and free to reuse. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/vendor-due-diligence-one-process/ https://controlmapping.org/blog/vendor-due-diligence-one-process/ Tue, 21 Apr 2026 09:00:00 GMT One vendor due diligence process for ISO 27001, SOC 2, PCI DSS, GDPR, HIPAA and NIS2: tiering, assurance reports, contracts and monitoring. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/gdpr-security-articles-mapped/ https://controlmapping.org/blog/gdpr-security-articles-mapped/ Tue, 07 Apr 2026 09:00:00 GMT GDPR is a privacy law, but Articles 5, 25, 28, 32 to 35 and 37 to 39 impose security duties. How they map to ISO 27001 and NIST, and what an ISMS leaves out. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/twenty-years-cybersecurity-audits/ https://controlmapping.org/blog/twenty-years-cybersecurity-audits/ Tue, 24 Mar 2026 09:00:00 GMT Lessons from two decades of security audits: evidence beats narrative, scope decides everything, and controls fail when nobody owns them. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/gap-report-to-project-plan/ https://controlmapping.org/blog/gap-report-to-project-plan/ Tue, 10 Mar 2026 09:00:00 GMT How to turn a framework gap analysis into a project plan: workstreams, sequencing, estimates, owners, and evidence tracked through to audit. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/backup-recovery-requirements-compared/ https://controlmapping.org/blog/backup-recovery-requirements-compared/ Tue, 24 Feb 2026 09:00:00 GMT Backup frequency, protection and restore testing compared across ISO 27001, CIS, PCI DSS, HIPAA, SOC 2, NIS2, the Essential Eight and NIST. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/ai-written-security-policies/ https://controlmapping.org/blog/ai-written-security-policies/ Thu, 05 Feb 2026 09:00:00 GMT Generative AI can draft security policies in minutes. Where that helps, where it creates audit findings, and how to use it without empty policies. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/change-management-evidence/ https://controlmapping.org/blog/change-management-evidence/ Wed, 21 Jan 2026 09:00:00 GMT What change management evidence passes SOC 2 (CC8.1), ISO 27001 (A.8.32), PCI DSS and NIS2 audits, from pull requests to emergency changes. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/cmmc-level-2-800-53-appendix-d/ https://controlmapping.org/blog/cmmc-level-2-800-53-appendix-d/ Tue, 06 Jan 2026 09:00:00 GMT Every CMMC Level 2 practice traces to NIST SP 800-53 through SP 800-171 Appendix D. How the map works, Rev 5 changes and the one practice left over. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/compliance-is-not-security/ https://controlmapping.org/blog/compliance-is-not-security/ Tue, 23 Dec 2025 09:00:00 GMT Why passing audits doesn't make an organisation secure, where compliance and security align, and how framework mapping frees time for security. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/user-access-reviews-auditors/ https://controlmapping.org/blog/user-access-reviews-auditors/ Tue, 09 Dec 2025 09:00:00 GMT How to run user access reviews that pass ISO 27001, SOC 2, PCI DSS, HIPAA and CMMC audits: scope, frequency, reviewers and evidence. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/security-topics-fewest-frameworks-require/ https://controlmapping.org/blog/security-topics-fewest-frameworks-require/ Tue, 25 Nov 2025 09:00:00 GMT DNS, threat intelligence, API and web application security are the topics fewest frameworks require. Why, and why that's not permission to skip them. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/stop-buying-tools-before-policies/ https://controlmapping.org/blog/stop-buying-tools-before-policies/ Tue, 11 Nov 2025 09:00:00 GMT Why organisations that buy compliance or security tools before deciding how they'll operate often end up with shelfware, and the order of work that avoids it. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/gap-analysis-to-tracker/ https://controlmapping.org/blog/gap-analysis-to-tracker/ Tue, 28 Oct 2025 09:00:00 GMT A practical method for a gap analysis between two security frameworks: scope, read each match, validate the links and turn it into a tracker. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/iso-27001-nis2-point-by-point/ https://controlmapping.org/blog/iso-27001-nis2-point-by-point/ Tue, 14 Oct 2025 09:00:00 GMT ISO 27001 maps to every point of the NIS2 Implementing Regulation, yet certification alone isn't NIS2 compliance. What carries over, what doesn't, and why. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/vendor-crosswalks-you-cant-check/ https://controlmapping.org/blog/vendor-crosswalks-you-cant-check/ Thu, 25 Sep 2025 09:00:00 GMT Compliance platforms map one control to many frameworks with crosswalks nobody can inspect. Why that's a risk, and what to demand instead. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/one-risk-assessment-iso-soc-2-hipaa/ https://controlmapping.org/blog/one-risk-assessment-iso-soc-2-hipaa/ Thu, 11 Sep 2025 09:00:00 GMT How to run one information security risk assessment that satisfies ISO 27001, SOC 2 and the HIPAA Security Rule, and what each audit checks. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/crosswalk-or-judgement-mapping-evidence/ https://controlmapping.org/blog/crosswalk-or-judgement-mapping-evidence/ Wed, 27 Aug 2025 09:00:00 GMT We labelled every framework mapping as published crosswalk or editorial judgement. How the split varies by framework, and why it matters to you. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/nis2-management-liability-boards/ https://controlmapping.org/blog/nis2-management-liability-boards/ Tue, 12 Aug 2025 09:00:00 GMT NIS2 makes management bodies approve, oversee and train for cybersecurity, with liability. Will that change board behaviour, and what boards should do. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/essential-eight-target-maturity-level/ https://controlmapping.org/blog/essential-eight-target-maturity-level/ Tue, 29 Jul 2025 09:00:00 GMT How to choose an Essential Eight target maturity level: what each level defends against, who needs Level Two or Three, and how to progress. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/security-requirements-every-framework-shares/ https://controlmapping.org/blog/security-requirements-every-framework-shares/ Tue, 15 Jul 2025 09:00:00 GMT Five security topics appear in all 11 major frameworks, from ISO 27001 and SOC 2 to NIS2 and the Essential Eight. What they are, and why to build them first. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/does-a-small-company-need-iso-27001/ https://controlmapping.org/blog/does-a-small-company-need-iso-27001/ Tue, 01 Jul 2025 09:00:00 GMT When ISO 27001 makes sense for a small company, when SOC 2 or a technical baseline should come first, and how to keep certification proportionate. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/statement-of-applicability-guide/ https://controlmapping.org/blog/statement-of-applicability-guide/ Tue, 17 Jun 2025 09:00:00 GMT How to write an ISO 27001:2022 Statement of Applicability: what it must contain, justifying exclusions, and common audit findings. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/cis-controls-crosswalk-gap/ https://controlmapping.org/blog/cis-controls-crosswalk-gap/ Tue, 03 Jun 2025 09:00:00 GMT CIS's published mapping to NIST CSF 2.0 covers only 49 of 153 CIS Controls v8.1 safeguards. Why, and what it means for CIS mappings you rely on. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/board-reporting-nist-csf-profiles/ https://controlmapping.org/blog/board-reporting-nist-csf-profiles/ Tue, 20 May 2025 09:00:00 GMT How to use NIST CSF 2.0 Current and Target Profiles to report cybersecurity to a board: what to show and how to link it to your frameworks. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/scoping-first-soc-2-report/ https://controlmapping.org/blog/scoping-first-soc-2-report/ Thu, 01 May 2025 09:00:00 GMT How to scope a first SOC 2 report: which system, which Trust Services Criteria, carve-outs and user entity controls, and costly scope mistakes. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/vendor-supply-chain-risk-requirements/ https://controlmapping.org/blog/vendor-supply-chain-risk-requirements/ Thu, 17 Apr 2025 09:00:00 GMT Supplier and supply-chain security requirements compared across ISO 27001, SOC 2, PCI DSS, NIS2, GDPR, HIPAA and NIST CSF 2.0. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/soc-2-criteria-no-iso-27001-equivalent/ https://controlmapping.org/blog/soc-2-criteria-no-iso-27001-equivalent/ Wed, 02 Apr 2025 09:00:00 GMT Most SOC 2 criteria map to ISO 27001, but Processing Integrity and most Privacy criteria don't. Which ones, why, and what to do if they're in scope. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/one-policy-set-many-frameworks/ https://controlmapping.org/blog/one-policy-set-many-frameworks/ Tue, 18 Mar 2025 09:00:00 GMT How to structure one set of security policies that satisfies ISO 27001, SOC 2, NIST, PCI DSS and NIS2, and what each framework requires in writing. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/csf-1-1-to-2-0-withdrawn-subcategories/ https://controlmapping.org/blog/csf-1-1-to-2-0-withdrawn-subcategories/ Tue, 04 Mar 2025 09:00:00 GMT NIST withdrew 79 CSF 1.1 subcategories in CSF 2.0, moving or merging them into others. The full table of where each went, and how to update old mappings. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/framework-fatigue-hub-framework/ https://controlmapping.org/blog/framework-fatigue-hub-framework/ Tue, 18 Feb 2025 09:00:00 GMT Organisations answering to several security frameworks burn out running each separately. Why choosing one hub framework and mapping the rest to it works better. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/nis2-incident-reporting-procedure/ https://controlmapping.org/blog/nis2-incident-reporting-procedure/ Tue, 04 Feb 2025 09:00:00 GMT How to build a NIS2 significant-incident reporting procedure: deciding significance, the 24-hour early warning, 72-hour notification and one-month final report. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/csf-2-govern-function-coverage/ https://controlmapping.org/blog/csf-2-govern-function-coverage/ Tue, 21 Jan 2025 09:00:00 GMT CSF 2.0 added a Govern function for risk strategy, roles, policy, oversight and supply chain risk. Which frameworks already cover it, and the gaps. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/essential-eight-outside-australia/ https://controlmapping.org/blog/essential-eight-outside-australia/ Tue, 07 Jan 2025 09:00:00 GMT ASD's Essential Eight is an Australian baseline with universal advice. Why organisations elsewhere might adopt it, and how it fits beside ISO or NIST. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/evidence-reuse-soc-2-iso-27001-pci-dss/ https://controlmapping.org/blog/evidence-reuse-soc-2-iso-27001-pci-dss/ Tue, 24 Dec 2024 09:00:00 GMT Which audit evidence serves SOC 2, ISO 27001 and PCI DSS at once, what each auditor needs that the others don't, and how to collect it once. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/best-security-framework-to-start-with/ https://controlmapping.org/blog/best-security-framework-to-start-with/ Thu, 05 Dec 2024 09:00:00 GMT We measured how much of ten other frameworks each of 11 security frameworks covers. SP 800-53 and ISO 27001 lead, but who is asking decides. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/soc-2-certified-wrong-question/ https://controlmapping.org/blog/soc-2-certified-wrong-question/ Wed, 20 Nov 2024 09:00:00 GMT There is no SOC 2 certification. What the question really asks, what a SOC 2 report shows and doesn't, and better questions to ask vendors. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/soc-2-iso-27001-one-control-set/ https://controlmapping.org/blog/soc-2-iso-27001-one-control-set/ Wed, 06 Nov 2024 09:00:00 GMT How to run SOC 2 and ISO 27001 from a single control set: what overlaps, what each adds, how to structure controls and evidence, and how to line up the audits. noreply@controlmapping.org (Paul Gillet) https://controlmapping.org/blog/essential-eight-vs-iso-27001/ https://controlmapping.org/blog/essential-eight-vs-iso-27001/ Tue, 22 Oct 2024 09:00:00 GMT ISO 27001 covers every Essential Eight strategy in principle, but most of ASD's controls are only loosely related to Annex A. What that means for you. noreply@controlmapping.org (Paul Gillet)