Map the same underlying safeguard across SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and 800-53.
45 min 240 XPSkills: Frameworks, Control mapping
Brief
Every organisation you will work in is subject to more than one framework, and each one describes the same handful of safeguards in its own dialect. SOC 2 calls it CC6.1. ISO 27001 calls it A.5.15. NIST CSF calls it PR.AA-03. All three are asking whether the right people, and only the right people, can reach the system.
The engineering move is to stop maintaining one control set per framework. You maintain one control catalog and map it outward. Frameworks become views over the same data, not separate programs with separate spreadsheets.
You do not implement frameworks. You implement controls, then map those controls to whichever framework is asking this quarter.
Four frameworks, four different products
The frameworks are not interchangeable, and confusing their outputs is the most common beginner error. SOC 2 is an attestation: a licensed CPA firm examines your controls against the Trust Services Criteria and issues an opinion in a report. There is no SOC 2 certificate, and anyone who shows you one is showing you a marketing graphic.
ISO 27001 is a certification: an accredited certification body audits your information security management system and issues a certificate on a three-year cycle with annual surveillance audits. NIST CSF is a voluntary outcome framework organised into functions: Identify, Protect, Detect, Respond, Recover, Govern. NIST 800-53 is a control catalog, the raw parts bin that federal baselines are assembled from.
Same subject matter, four very different deliverables. Only one of them is a certificate.
Type I, Type II and the shape of the period
A SOC 2 Type I says the controls were suitably designed as at a single date. A Type II says they also operated effectively across a period, usually six to twelve months. Buyers who ask for 'your SOC 2' almost always mean Type II, and a Type I handed over silently is a soft way of saying the program is young.
The report also contains a system description written by management: the section that draws the boundary around what was examined. Scope games happen there, not in the criteria. A perfectly clean opinion over a system description that excludes the product your customer actually uses is worth nothing to that customer.
The crosswalk, and why you build it once
A crosswalk is the mapping table between your internal control identifiers and the external framework references. Built once, it means adding a framework costs a mapping exercise rather than a second control program. Built never, it means every new customer questionnaire triggers weeks of manual archaeology.
For ISO 27001 the mapping has a formal artifact: the Statement of Applicability, which declares which Annex A controls apply, which are excluded, and why. It is the one document an ISO auditor will always open first.
One safeguard, four identifiers. The crosswalk is the asset; the framework references are just labels.
Inheritance, carve-outs and user controls
Almost every service depends on other services, such as hosting or payment providers. An assurance report handles these subservice organisations in one of two ways. The inclusive method tests the subservice provider's controls inside the report. The carve-out method excludes them; the report simply says it relies on that provider.
Reports also list complementary user entity controls (CUECs): things the customer must do for the vendor's controls to work, such as reviewing their own user list. If you skip a CUEC, the vendor's clean report does not cover you.
A clean vendor report covers only what it tested, and only if you do your part.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The certificate that isn't
Answer challenge+60 XP
Separate the deliverable from the marketing.
Incident brief
A prospect's procurement team emails: "Attach your SOC 2 certificate and your ISO attestation letter and we can close this week."
Your sales lead has already replied that both are on the way. Your compliance manager forwards you a PDF the design team produced last year: a dark blue page with your logo, the words SOC 2 CERTIFIED, and the audit firm's name at the bottom in small type.
The actual artifacts you hold are a report signed by a CPA firm covering 1 Jan to 31 Dec, and a certificate issued by an accredited body valid for three years with annual surveillance visits.
1.1SOC 2 does not certify anything. Name the class of deliverable a SOC 2 engagement actually produces. (one word)
1.2Which of the two standards in play here is the one that genuinely issues a certificate?
Task 2: Nine hundred controls, or ninety
Scenario sim+60 XP
Name the artifact, not the activity.
Incident brief
You inherit a compliance drive containing three spreadsheets: soc2_controls.xlsx (61 rows), iso_controls.xlsx (93 rows) and csf_controls.xlsx (108 rows). Reading them, roughly seventy underlying safeguards are described three times each, in three vocabularies, with three different owners and three different review dates.
The outgoing manager's handover note says: "Don't merge them. The auditors need to see their own framework's language, so each framework needs its own control set. The ISO auditor in particular will ask for the list of controls we decided are in scope, and that has to be an ISO-shaped document."
Half of that is wrong and half of it is a real ISO requirement wearing the wrong explanation.
Term bank, not all of these are right
crosswalkcontrol catalogstatement of applicabilityrisk registerannex agap assessment
2.1Name the mapping artifact that lets a single control catalog satisfy all three frameworks. (one word)
2.2Name the ISO 27001 document that declares which Annex A controls apply and why others are excluded.
Task 3: Clean opinion, wrong system
Scenario sim+60 XP
Two answers: the report flavour, and the section that hid the problem.
Incident brief
A customer accepts your report and renews. Six weeks later their security team escalates: the report you sent covers only the legacy hosted platform, not the newer multi-tenant SaaS they actually bought.
The report is genuinely clean. It also says, on the cover, "as of 30 September", a single date, not a range, and your CISO has been describing it in calls as "a full twelve-month audit".
Nothing in the report is false. The criteria were met. The boundary drawn around what was examined was written by your own management team.
Term bank, not all of these are right
type itype iisystem descriptionscope memomanagement assertiontrust services criteria
3.1The cover says 'as of 30 September'. Which SOC 2 report flavour is this, despite what the CISO said? (two words)
3.2Name the report section, authored by management, where the SaaS platform was excluded from the boundary.
Task 4: The clean report that covered nothing
Answer challenge+60 XP
Read the scope section before the opinion.
Incident brief
Procurement attaches a vendor's assurance report to the risk file: clean opinion, no exceptions. The vendor runs entirely on a third-party hosting provider.
Section 3 says: "The hosting provider's controls are excluded from the scope of this report." Section 4 lists six controls "the customer is expected to operate", including quarterly review of customer admin accounts.
Your team has never reviewed admin accounts on that platform. The procurement lead marks the vendor "fully assured, including hosting."
Sales needs an ISO 27001 certificate. Your VP says: "copy the SOC 2 scope, it's the same controls, just get the attestation done by July".
Two of the words in that sentence belong to a different framework. Write the scoping record for the ISO engagement: the right standard version, the right kind of engagement, the right evidence basis, the systems genuinely in scope, and the controls whose evidence can be reused.
What you know
Existing SOC 2 Type II scope (period 2026-01-01 → 2026-06-30):
prod-aws, okta, github, marketing-site
marketing-site: static brochure pages, no customer data, no auth,
included in SOC 2 only because it shares the AWS account.
The ISO risk assessment excludes it.
ISO 27001 published versions: 2013 (withdrawn), 2022 (current)
Engagement kinds: attestation | certification | readiness
Evidence bases: period | point_in_time
Controls with evidence already collected: IA-MFA-ADMIN,
CM-CHANGE-APPROVAL, EV-BACKUP-RESTORE
A consultant has delivered a crosswalk mapping your internal controls to SOC 2, ISO 27001:2022 and NIST 800-53. Procurement wants it accepted so the mapping can drive evidence reuse.
Some rows are right. Others cite a real reference from the wrong family, quote a superseded ISO numbering, or claim equivalence between controls that only sound alike. Accept the sound rows; reject the rest.
Verdicts are accept or reject. Every rejection needs one reason code from: wrong-family | superseded-numbering | not-equivalent.
Delivered crosswalk
X-1 MFA on production console -> SOC 2 CC6.6 | ISO A.5.17 | NIST IA-2
X-2 Encryption of backups at rest -> SOC 2 CC6.1 | ISO A.8.24 | NIST SC-28
X-3 Leaver access removal -> SOC 2 CC6.2 | ISO A.9.2.6 | NIST AC-2
X-4 Change approval before deploy -> SOC 2 CC8.1 | ISO A.8.32 | NIST CM-3
X-5 Vendor risk assessment -> SOC 2 CC9.2 | ISO A.5.19 | NIST IA-5
X-6 Security awareness training -> SOC 2 CC1.4 | ISO A.6.3 | NIST AT-2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · GRC Fundamentals
Control Design & Testing
Design vs. operating effectiveness, sampling, populations, and how to write a control that can actually be tested by a machine.
