Organizations maintain mappings between the different control frameworks they adopt to:

Question

Options

• Ahelp identify controls with common assessment status.
• Bavoid duplication of work when assessing compliance.
• Chelp identify controls with different assessment status.
• Dstart a compliance assessment using latest assessment.

• A
  6% (2)
• B
  3% (1)
• C
  88% (30)
• D
  3% (1)

Explanation

When an organization uses multiple compliance frameworks (e.g., ISO 27001, NIST CSF, CSA CCM), maintaining a cross-reference map between them allows auditors and compliance teams to identify which controls have different assessment statuses across frameworks. A control that is assessed as compliant in one framework may not map cleanly or may have a different status in another - identifying these discrepancies (gaps) is the primary analytical value of maintaining mappings. While avoiding duplication of work (B) is a secondary benefit, the key analytical purpose is spotting controls with differing statuses to focus remediation efforts.

No community discussion yet for this question.