Map one control to three frameworks

Objectives

An auditor asks you to "map the MFA control to SOC 2, ISO and NIST". A colleague has already started and mapped everything to CC6.1 because, in his words, "CC6.1 covers all the access stuff".

Mappings are many-to-many and framework-specific. Add a mappings block that names each framework and its own control identifier: a SOC 2 trust services criterion, an ISO 27001 Annex A control, and a NIST 800-53 control id.

soc2:   CC6.1, CC6.6, CC7.2      (trust services criteria)
iso27001: A.5.15, A.5.17, A.8.5    (Annex A, 2022 numbering)
nist80053: AC-2, IA-2, AC-6        (control family + number)

Control under mapping: multi-factor authentication
enforced for all administrative console access.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   Your colleague collapsed three frameworks into one identifier because they all "cover access". That is the trap: a mapping that is technically real but answers none of the questions a mapping exists to answer.

   The test of a good mapping is reversibility: given a framework requirement, can you find the control that satisfies it?

2. Step 2

   Read the fixture as a format guide

   The fixture shows the shape of each framework's identifiers: criteria for one, an Annex A section number for another, a family prefix plus number for the third. It deliberately lists several plausible options per framework: it is a format reference, not an answer key.

   Note the control under mapping at the bottom. It narrows which option in each list is the right one.

3. Step 3

   Read the starter

   Only one key is unfinished: an empty list. Everything else is scaffolding. Your entire submission is what you put inside that list.

4. Step 4

   Shape the mappings block

   Each entry needs two keys, which framework, and that framework's own identifier. Ask: could a script group my controls by framework using this structure without string-matching prose?

   Three entries, one per framework, using the framework keys the checks name.

   Three mappings, one per frameworkFrameworks named soc2, iso27001 and nist80053

5. Step 5

   Pick the right identifier in each framework

   For each framework, ask what the control actually enforces: proving who the user is, at an administrative entry point. Then choose the option from the fixture that is specifically about authentication strength, not access management in general.

   For NIST especially, the family prefix carries the meaning: identification-and-authentication is a different family from access control.

   SOC 2 reference is a trust services criterionISO reference uses Annex A numberingNIST reference is an authentication control id

6. Step 6

   Run and read the failures

   If a per-framework check fails, you picked a real identifier from the wrong concept. Re-ask what the control enforces before changing the value.

Rules summary

• XP on pass

  30 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 8 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.