Frameworks & controls
Adopt frameworks and map controls across them
Requirements overlap from one framework to the next, yet most teams still run each framework as a separate project. In Certifyi you map a control once and reuse the mapping across ISO 27001, HIPAA, PCI DSS and the other frameworks you adopt.
In short
Adopting a framework in Certifyi gives you its control set. Where a requirement repeats, map a control once and reuse the mapping, so a control that serves ISO 27001 is documented once for HIPAA, PCI DSS or any other framework that shares the requirement.
International and regional frameworks
Each framework comes with its controls and guidance on what each control asks for, so adopting one gives you a working project to start from.
Regional standards that matter in particular markets sit alongside the international ones.
- International standards. ISO 27001, ISO 42001, HIPAA, PCI DSS and NIST CSF.
- European regulations. GDPR, NIS 2, DORA and the EU AI Act.
- US defence. CMMC (Cybersecurity Maturity Model Certification).
- Regional standards. NRB IT Guidelines (Nepal), CBUAE, NCA ECC (Saudi Arabia), the DPDP Act (India), PDPA (Thailand) and PDPL (Saudi Arabia).
Map one control to every framework that needs it
An access control policy can be mapped to ISO 27001 Annex A 5.15, PCI DSS Requirement 7.2.1 and the HIPAA access control standard at 164.312(a)(1). Without a common control set, teams document that policy three times, collect the same evidence three times and chase the same fix three times.
In Certifyi the policy is one control with three mappings, and its evidence is linked to the control rather than to each framework, so it is collected once.
- Control library
- Your master list of controls. Each control has an owner, a description, implementation guidance and links to the evidence that supports it.
- Mapping
- One control connected to requirements in several frameworks. The mapping shows on the control itself and in each frameworkâs list of controls.
- Gaps
- Controls a framework you have adopted requires that have no evidence yet. Because controls are shared, adding evidence to one can close the same gap in several frameworks.
Set the Statement of Applicability per control
ISO 27001 requires a Statement of Applicability that lists every Annex A control, says whether it is included or excluded, and justifies each decision. Auditors read it closely, and a version kept in a spreadsheet soon falls out of step with the controls.
In Certifyi you set applicability per control and keep the justification with the control, ready to export for your auditor. The rows below are an example.
| Control | Status | Justification |
|---|---|---|
| A.5.1 Policies for information security | Included | Information security policy approved and published |
| A.5.2 Information security roles and responsibilities | Included | Roles agreed by the management team and reviewed each year |
| A.8.1 User endpoint devices | Included | All laptops enrolled in device management |
| A.8.12 Data leakage prevention | Excluded | No DLP tooling in scope; residual risk accepted by the CISO |
Mapping controls so the mapping holds up
A shared control only saves work if an auditor accepts the mapping.
-
Read the requirement text
Two requirements with similar titles can ask for different things. Map on what the text says.
-
Meet the strictest frequency
One framework may want a quarterly review where another accepts a yearly one. The shared control has to meet the quarterly one.
-
Keep one owner
A shared control with two owners tends to end up with none.
Related modules
The other modules refer back to your controls. Risks relate to controls, evidence comes in from integrations and audit findings point to control gaps.
How Certifyi helps
From separate spreadsheets to one control library
What changes when you manage frameworks and controls in Certifyi instead of in spreadsheets.
-
Adopt a framework
Pick a framework from the catalogue, review its controls, mark what applies and start work.
-
Map controls once
Map a control once and reuse the mapping wherever the requirement appears again. The evidence hangs off the control, so one piece of evidence serves every framework mapped to it.
-
Set the SoA per control
Record applicability and justification on each control, then export the Statement of Applicability for your auditor.
Questions
Framework and control questions
Which frameworks are in the catalogue?
The catalogue includes ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, NIST CSF, NIS 2, DORA, the EU AI Act and CMMC, with regional standards such as the NRB IT Guidelines, CBUAE, NCA ECC, the DPDP Act, PDPA and PDPL. If you answer to a framework that is not listed, ask us about it.
Can I map one control to several frameworks?
Yes. Map a control once and reuse the mapping for every framework that shares the requirement. Read the requirement text first, because two requirements with similar titles do not always ask for the same thing.
Does adopting a framework in Certifyi mean we are certified?
No. Adopting a framework lets you map controls, collect evidence and track readiness. Certification is issued by independent accredited bodies.
Document each control once
Book a demo, tell us which frameworks you answer to, and we will map one of your controls across them with its evidence attached once.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them