Conscious · agentic assuranceWhitepaper 05 · Original research

The obligation arithmetic

How much of a multi-jurisdiction compliance programme is the same work counted twice

This market publishes attitude surveys: the percentage of risk leaders who feel unprepared. It does not publish the structural number underneath them. This paper does. It measures 68 frameworks and privacy regimes against one library of 349 controls and reports, pair by pair, how much of the work is distinct.

Audience

Heads of compliance, internal audit, CISOs, analysts and journalists

Published

October 2026

Edition

First edition, October 2026

Series

The assurance papers

What this paper establishes

• A structural measurement, not a sentiment survey: 68 frameworks and privacy regimes measured against one library of 349 controls.
• Reproducible from the shipped catalogue by one command, with every figure published as a machine-readable record beside the paper.
• Deliberately conservative: only requirement rows already mapped into the library are counted, so every collapse figure understates rather than flatters.

consciousgrc.comOctober 2026

An organisation bound by six authorities does not do six times the work. No one in this industry disputes that. What no one publishes is the figure: how much is one time, how much is two, and which specific controls carry the weight.

The figure is measurable, provided you hold two things at once — every obligation’s own requirements, and one library of controls an organisation operates, with every requirement pointed at the controls that satisfy it. We hold both, so this paper reports the arithmetic rather than an opinion about it.

Finding one: two-thirds of controls are demanded by ten or more authorities

Take the 349 controls in the library and count, for each one, how many of the 68 mapped obligations demand it.

The practical reading is uncomfortable. If an organisation runs its programmes framework by framework, it is asking the same control owner for the same artefact up to ten times a year, each time under a different reference number, and each time recording the answer in a different place. None of those repetitions improves the control.

Finding two: the ten controls that carry the programme

The concentration is sharper than the bands suggest. These ten controls are demanded by more obligations than any others in the catalogue.

There is a planning conclusion in that table that has nothing to do with software. An organisation starting from nothing, with no platform at all, should implement those ten controls first and in that order, because each one discharges part of more obligations than anything else it could do instead.

Finding three: the pairs, and what a second framework costs

The headline question in a procurement meeting is usually framed as breadth: how many frameworks does the platform carry. The better question is marginal: if we already satisfy this one, how much new work is that one? Measured as shared controls, the answers vary enormously, and the variation is the finding.

Three readings follow, and the third is the one that keeps the method honest.

A regulator’s mandate and a customer’s standard are mostly the same controls

A Saudi entity assessed by its regulator under ECC-2:2024, and asked by its enterprise customers for ISO/IEC 27001, is being asked about the same control set twice: 96 per cent of what ECC demands is also what ISO demands. Running those as two programmes with two evidence collections is the single most common and most expensive structural mistake in the region.

Two privacy laws in the same group are nearly one control problem

GDPR and the DIFC Data Protection Law share 38 of the 39 controls the smaller of them demands: 97.4 per cent. GDPR and the Saudi PDPL share 85.3 per cent. The controls converge. What does not converge is everything in the previous paper in this series — transfer conditions, breach clocks, the deadline to answer a subject, whether registration is required. A group can therefore run one control programme and still owe six different legal answers, which is exactly why the two have to be modelled separately.

And sometimes a second obligation is new work

NIS2 and DORA, the pair most often spoken about as one European compliance burden, share only 60.7 per cent of the smaller set. An organisation that treated DORA as NIS2 with a financial-services label would under-scope it by a wide margin. A method that produced a high number for every pair would be a method measuring nothing; this one does not.

Finding four: a realistic portfolio collapses by two-fifths

Take a portfolio a multi-entity Gulf group carries: the Saudi ECC, ISO/IEC 27001, NIST CSF 2.0, GDPR, the Saudi PDPL and the DIFC Data Protection Law. Across those six, 443 mapped requirement rows resolve to 255 distinct controls.

Note what the collapse is not. It is not a claim that forty-two per cent of the effort disappears. Evidence still has to be collected, a person still has to rate each requirement, and two authorities can want different proof of the same control. What collapses is the control estate: the number of distinct things the organisation has to build, operate and keep working.

What this means for how a programme is organised

1. Build the control set, not the framework. A programme organised by framework pays the duplication in the table above every year, forever.
2. Start with the most-demanded controls. The ten in finding two discharge more obligation than any other ten available.
3. Treat privacy law separately from privacy controls. The controls converge; the clocks, transfer rules and rights do not.
4. Ask for marginal cost, not breadth. “We already do ISO. What does ECC add?” has a number, and the number is small.
5. Distrust any pair that scores high everywhere. NIS2 and DORA are the control case: if a vendor’s mapping says they are the same, the mapping is decorative.

Reproducing this

The measurement runs against the shipped catalogue and writes a machine-readable record of every figure in this paper, including the ones that did not make it into the prose. That file is published beside this document. A reader quoting a number here can take it from the record rather than from a sentence, and a reader who thinks the method is wrong can say precisely where.

Two honest caveats about what a reader may conclude. The mapping of each obligation into the library is authored and reviewed by people at Conscious, and a different team would draw some joins differently; the figures are a measurement of a considered mapping rather than a law of nature. And the library is a control set, not a universe: an obligation making a demand the library does not yet model will understate its own footprint here.