How much do compliance frameworks actually overlap?

The data set

Keel maintains a library of canonical security controls, each pre-mapped ("crosswalked") to the specific clauses it satisfies. This report analyzes the 201 of those controls that satisfy at least one of 10 frameworks: ISO 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, ISO 9001, ESG Essentials, NIST 800-171, CIS Controls, GDPR. Across those 201 controls there are 460 control-to-framework mappings into that set, which means the average control does real work in 2.3 frameworks at once. The control library is published as an open dataset (CC BY 4.0) on our open source page.

Overlap is the rule, not the exception

The average control maps to 2.3 frameworks, and 25 of the 201 controls (12%) satisfy five or more frameworks at once. At the very top, 2 controls map to 9 of the 10 frameworks in the set: Third-party / vendor risk management, Security awareness training. Governance fundamentals are shared almost everywhere; only a handful of controls are truly framework-specific.

Controls carrying the most frameworks

Where the overlap is largest: SOC 2 and ISO 27001

The clearest way to see the reuse is pairwise: of the controls that satisfy one framework, how many also satisfy another? Of the 6 pairs in the table below, SOC 2 into ISO 27001 is the largest: of the 50 controls that map to SOC 2, 32 (64%) also satisfy ISO 27001. Read the other way, those same 32 controls are 38% of what ISO 27001 draws on, so this is a head start rather than a finished framework. What the overlap buys is real, though: for every control on both sides of that line the remaining work is mapping and evidence, not standing up a new control.

How many controls each framework needs

Coverage in this library, ordered by breadth. Larger frameworks such as ISO 27001 and SOC 2 draw on the most controls; targeted regimes such as GDPR touch fewer, because much of their text is legal rather than technical.

What this means for sequencing

The practical lesson is to build controls once and map them many times. Because the average control serves 2.3 frameworks, the marginal cost of a second framework is dominated by mapping and evidence, not by standing up new controls. That is why a crosswalk-native approach matters: the same encryption, access-review, and incident-response controls you implement for SOC 2 are the ones an ISO 27001, PCI DSS, or HIPAA assessor will ask about next.

• Start with the high-reuse core. The 25 controls that satisfy five or more frameworks are the highest-leverage place to begin.
• Pick your second framework by overlap. Of the pairs measured here, SOC 2 into ISO 27001 is the smallest additional lift; a regime like GDPR shares less because it is largely legal.
• Map, do not rebuild. Treat the second framework as a mapping exercise over existing evidence. (Explore the mappings in the crosswalk explorer.)

Methodology and limitations