Assess once, answer many
The control library underneath fifty-six frameworks, and the provenance of every mapping
Two different joins decide whether a compliance programme is one programme or five, and most evaluations never separate them. This paper takes both apart, states the arithmetic each one produces, and prints the figure the vendor you are evaluating will not: how thin the connective tissue still is.
What this paper establishes
- One library of 349 controls in 23 domains, with 6,127 requirement rows pointing into it through 11,496 joins — so a control evidenced once answers roughly eighteen distinct requirements.
- Every mapping row carries its basis: 2,131 edges transcribed from an authority’s own published correspondence, 180 authored here, dated and labelled.
- Licensed standards carried lawfully as structure, reference numbers and our own assessor guidance — the position that keeps a customer’s programme clear of a publisher’s licence.
An organisation under four frameworks does not have four compliance programmes. It has one set of controls, looked at four times. Whether its platform understands that is the difference between evidencing a control once and evidencing it four times, and it shows up in the one place everybody feels it: how many times the same person is asked for the same document in a year.
Every vendor in this market says it maps frameworks to each other. The claim is almost always true and almost always smaller than it sounds, for two reasons. The first is that two completely different joins are both called mapping. The second is that no one says where a mapping came from.
Two joins, and the arithmetic each one produces
The first join runs sideways. It takes one framework’s requirement and connects it to another framework’s requirement: this clause of one standard corresponds to that control of another. This is a crosswalk, and it is what a reader means when they say the frameworks are mapped.
The second join runs downwards. It takes every framework’s requirements and points them at one library of controls the organisation operates. The framework stops being the spine and becomes a lens. The control is evidenced once, and every requirement pointing at it is answered by that evidence.
| Sideways: the crosswalk | Downwards: the library | |
|---|---|---|
| What it joins | One framework’s row to another framework’s row | Every framework’s row to one control the organisation operates |
| Size today | 2,311 edges across 12 framework pairs | 11,496 joins from 6,127 requirement rows |
| What it is good for | Answering “we were assessed under one standard, the customer asks under another” | Collecting evidence once and having it count everywhere it applies |
| Which one removes duplicate work | Useful when two authorities ask the same question | This one |
The downward join is the one that pays. The library holds 349 controls in 23 domains. 6,127 requirement rows point into it, through 11,496 joins. The arithmetic is worth doing slowly. 11,496 joins over 349 controls is about thirty-three requirement references per control. 6,127 distinct requirement rows over the same 349 controls is about eighteen distinct requirements sitting on each one.
Who says so: the column no competitor carries
A mapping is an assertion, and in front of an auditor the next question is always the same one. Who says this clause corresponds to that control? There are only two honest answers. Either an authority published the correspondence, or a person at the vendor decided it.
Conscious records which. Every edge in the crosswalk carries a basis. 2,131 of the 2,311 edges are transcribed from an authority’s own published mapping and are marked official. 180 are our reading, dated, and marked analytical wherever they are shown. The distinction is visible on the row, not buried in a methodology appendix.
| Source | What was transcribed | Edges |
|---|---|---|
| NIST, from its own catalogue | The SP 800-171 correspondence to SP 800-53 | 157 |
| NIST and CIS, via the OLIR catalogue | CSF 2.0 informative references their own authorities developed and lodged | 1,143 |
| NIST | Its own crosswalk from SP 800-53 to ISO/IEC 27001, carried as reference pairs only | 642 |
| NIST | Its own crosswalk from SP 800-53 to the HIPAA Security Rule | 189 |
| Conscious | Our own reading, dated and labelled analytical | 180 |
Put this to any vendor in an evaluation. Pick one mapping on screen and ask where it came from. A platform that cannot answer per row is asking an assessor to sign a rating whose basis the assessor cannot see, and that is the rating a regulator will ask about.
Depth, and the part that is not ours to ship
The catalogue holds 56 frameworks, all of them carrying assessable structure: 6,904 rows an assessor rates, 4,733 of them control rows.
16 of the 56 carry the authority’s own control text in full, which is 2,852 control rows in the authority’s own wording. Those sixteen are the seven Saudi NCA packs, six NIST publications, the German BSI C5 catalogue, the VDA ISA used for TISAX, and the Australian Essential Eight maturity model. Every one of them is published openly by its regulator, is a work of the United States Government, or is released under a licence that permits verbatim reproduction with attribution.
The licensed standards are the other story, and it is worth being blunt about it in a document a procurement team will read. ISO, SOC 2, PCI DSS, HITRUST, CIS, CSA, SWIFT and NERC are carried as structure and reference numbers with our own assessor guidance beside them. Their control text is not reproduced.
Say this in the deal where it matters rather than letting a buyer discover it in a demonstration. What an organisation needs from its platform is the structure, the reference numbers, the assessor guidance, the evidence and the record. The standard’s own text comes from the standards body, which is where the organisation has already bought it.
The statement of applicability, as a by-product
A statement of applicability is the document that proves a programme was scoped by decisions rather than by a template. In Conscious it is derived rather than written: every control in the framework, whether it is in scope, the reason where it is not, the current rating, who set it and when, and the evidence beneath. A control may only be excluded by a person, and the exclusion carries a reason. The model may not propose a not-applicable verdict at all.
That last constraint exists because not-applicable is the one rating that removes work from the programme. A machine permitted to propose it would be a machine permitted to shrink the scope of an audit.
A framework we have never seen
A group that operates in a sector with its own regulator always has an obligation no catalogue carries. Conscious takes the authority’s published document and builds a structured, assessable framework from it: domains, controls, reference numbers, and the questions an assessor answers. The result is the customer’s own framework, sitting beside the catalogue’s and assessed the same way.
The claim is bounded on purpose. It is not “all frameworks” and never “every regulation”. It is that the platform understands any framework a customer can hand it the document for, and that the honest measure of it is the refusal rate: what it could not read, said out loud, rather than a structure invented to fill the gap.
Depth where an assessor needs it
The two joins are built at different speeds on purpose. The downward join into the control library is dense, because it is the one that removes duplicate evidence requests from a control owner’s week: 11,496 joins from 6,127 requirement rows, across every framework and regime in the catalogue.
The sideways crosswalk is built from published correspondences first and our own reading second, which is slower than generating one and is the reason 2,131 of its 2,311 edges can name the authority that published them. An edge we could not source is absent rather than quietly authored, and that is a deliberate trade: a buyer can rely on what is there.
What to ask any vendor, including us
- Show me one mapping on screen and tell me its basis. Published by whom, transcribed when, or authored by you and dated?
- How many edges does your crosswalk hold, and across how many framework pairs? Divide it by your assessable rows and say the number out loud.
- Open a control and show me every requirement that points at it, across every framework and regime I am bound by.
- Do you reproduce ISO 27001’s control text? If yes, under what licence?
- Can a machine in your product mark a control not applicable?
- Hand it a regulator’s PDF we have not discussed. Show me what it produced, and what it refused to read.
Those six questions take fifteen minutes and they separate a control architecture from a content library with a progress bar on it. The companion paper to this one puts the same discipline to fifteen questions across the whole evaluation.
Sources
- 1Catalogue counts. Framework, row, control, join and crosswalk counts are measured from the code on 1 October 2026 and held to it by a test that fails the build when a published document disagrees with the catalogue.
- 2NIST. The SP 800-171 Rev 3 correspondence to SP 800-53 Rev 5 is published inside NIST’s own OSCAL catalogue. The CSF 2.0 informative references are lodged in NIST’s OLIR catalogue by the authorities that developed them. The crosswalks to ISO/IEC 27001:2022 and to the HIPAA Security Rule were developed by NIST and are carried as reference pairs only.
- 3Open licences. BSI C5:2026, the VDA ISA used for TISAX and the ASD Essential Eight maturity model are released under terms that permit verbatim reproduction with attribution. The Saudi NCA packs and the NIST publications are published openly by their authorities.
- 4Licensing position. ISO, SOC 2, PCI DSS, HITRUST, CIS, CSA, SWIFT and NERC material is carried as structure and reference numbers with Conscious’s own assessor guidance. Control text is not reproduced.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.