thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Control Mapping

Linking controls to multiple framework or regulatory requirements to enable test-once, comply-many approaches.

Definition

Organizations map a common control set to frameworks such as ISO/IEC 27001, NIST SP 800-53, PCI DSS, SOC 2, and HIPAA. NIST's OLIR program, the Secure Controls Framework, and the CSA CCM provide published mappings. Mapping reduces duplicated testing and audit fatigue.

Example

One MFA control maps to PCI DSS 8.4, ISO 27001 A.8.5, and NIST 800-53 IA-2(1).

Exam tip

Mapping supports efficiency but each framework's specific wording must still be satisfied.

Related terms