What is control cross-mapping?
A control is something you do, such as reviewing access every quarter. Many frameworks ask for the same control in different words. Cross-mapping links one control to every framework requirement it satisfies, so evidence collected once counts for each.
Platforms describe this in their own terms. Scytale states control cross-mapping across 80+ frameworks. Sprinto describes a common control framework: set controls once and reuse them. Scrut describes a Unified Control Framework.
Why does mapping change when you switch?
Each platform keeps its own control library and its own mapping. Your control "quarterly access review" might map to different requirement references, or be split into two controls, in the new platform. Nothing about your actual practice changes, but the paperwork does.
How do you check the new mapping?
- Export your control list from the old platform with its framework references.
- Match each control to the closest control in the new platform's library.
- List any requirement that has no matched control, and any new control the platform suggests.
- Decide for each gap whether it is a real gap in practice or a difference in wording.
What about adding a framework at the same time?
Many switches happen because a second framework is coming, often ISO 27001 after SOC 2. ISO/IEC 27001:2022 is the current edition (Edition 3, published October 2022). If you add it during a switch, map your SOC 2 controls first, then add the ISO-specific requirements, so you do not build two parallel control sets.
Check that the new platform names the framework you need. On our review pages each vendor's framework list is shown as named or not named on the pages we read.
Who should own the mapping?
One person, with the auditor's view in mind. If your new vendor provides a named expert, ask them to review the mapping with you; if it works through partners, ask who reviews it and when.
How do you record the mapping decisions?
Keep a short mapping log: the old control, the new control it maps to, any requirement left uncovered and the decision taken. Date each entry. The log answers the auditor's question about why a control looks different this period, and it saves the next person from redoing the same analysis.