Cross-compliance mapping: how to unify ISO 27001, NIST CSF, SOC 2, and GDPR in one matrix

Organizations that maintain two or three certifications — ISO 27001 plus SOC 2, or NIST 800-53 plus CMMC — eventually face the same question: which controls overlap, and where are we doing duplicate work? The answer usually lives in a spreadsheet that someone built over several months, linked to a specific person’s institutional knowledge, and that nobody fully trusts after the first framework update.

This article looks at how the Cross-Compliance Matrix skill in Rakenne addresses that problem: what it produces, how the workflow compares to traditional approaches, and where human judgment remains essential.

The traditional approach — and where it breaks down

Multi-framework mapping typically follows one of three paths:

Path 1: The consultant’s spreadsheet. A senior GRC professional builds a mapping in Excel over weeks or months, drawing on experience and published crosswalks (NIST publishes CSF-to-800-53 informative references; ISO provides mapping guides). The result is valuable but fragile: tied to one person, hard to maintain when frameworks update, and difficult to validate for completeness.

Path 2: Custom RAG pipelines. Technical practitioners build retrieval-augmented generation systems to query across framework documents. One veteran consultant described building four separate RAGs — one for policies, one for a blueprint, one for cross-compliance mapping, and one for standards — a 4–5 month infrastructure effort just to get precise answers like “give me which controls are related to some NIST controls, and give me policy clauses where they are covered.”

Path 3: Generic AI prompting. Teams ask ChatGPT or similar tools to map controls. The results look plausible but suffer from a well-documented problem: version hallucination. Models routinely mix ISO 27001:2013 controls (114 controls across 14 domains, A.5–A.18) with the current 2022 version (93 controls across 4 themes, A.5–A.8). As one practitioner noted: “All models hallucinate annex A controls and often mistake :2013 controls instead of using :2022.”

Each path has the same underlying issue: the mapping logic lives in someone’s head or in a custom system, and there’s no programmatic way to validate that every control has been accounted for.

How the Cross-Compliance Matrix skill works

The skill takes a different approach: curated, version-pinned reference files contain the authoritative pairwise mappings, and the agent follows a structured workflow to produce three auditor-ready output documents. The reference files — not the model’s general knowledge — are the source of truth.

The six-phase workflow

The key difference from generic prompting: the agent must read the reference files first and is instructed not to generate mappings from memory. Each reference file specifies the exact framework version (ISO 27001:2022, NIST CSF 2.0, GDPR EU 2016/679) and uses framework-native control IDs.

Side-by-side: traditional vs. skill workflow

What the skill does not replace: your understanding of the client’s business, your interpretation of “partial” vs. “full” coverage for their specific context, and your professional judgment about what matters for their next audit.

What the conversation looks like

Here’s a realistic exchange from a session mapping ISO 27001, SOC 2, and GDPR:

You: We’re ISO 27001 certified and starting SOC 2 Type II. Our EU customers also need GDPR evidence. Can you map all three?

Agent: I’ll build a unified matrix for ISO 27001:2022, SOC 2 TSC, and GDPR.

Loading reference files:

• references/framework-metadata.md — control counts and ID patterns
• references/iso27001-to-soc2-tsc.md — 93 Annex A controls mapped to TSC criteria
• references/iso27001-to-gdpr.md — 93 Annex A controls mapped to GDPR articles

Checking workspace for existing assessments… Found output/Gap-Assessment-Report.md from a prior ISO 27001 gap assessment. I’ll use your implementation status to enrich the matrix.

You: Go ahead.

Agent: Matrix complete — 93 rows, each with SOC 2 and GDPR mappings plus your current implementation status.

Coverage:

• SOC 2 TSC: 78 Full, 12 Partial, 3 No Mapping (90.3%)
• GDPR: 58 Full, 30 Partial, 5 No Mapping (78.5%)

Now running gap analysis. Top finding: A.5.34 (Privacy and PII protection) maps to both SOC 2 Privacy criteria (P1.1, P2.1) and GDPR Art. 5, 6, 7, 9 — strengthening this single control closes gaps across both target frameworks simultaneously. That’s the highest cross-framework benefit score in your matrix.

The conversation continues through gap analysis and validation. The agent runs check_cross_compliance_coverage at the end to produce a programmatic pass/fail:

Cross-Compliance Matrix — Coverage Report

Frameworks detected: 3

--- Per-Framework Coverage ---
  ISO 27001:2022               93 /    93  (100%)
  SOC 2 TSC                    47 /    50  (94%)
  GDPR                         19 /    21  (90.5%)

PASS — Matrix covers all detected frameworks.

What the output looks like

The skill produces three documents. Here are excerpts from each.

Cross-Compliance Matrix (excerpt)

Each row uses framework-native IDs (A.8.10, CC6.5, Art. 17) — not narrative descriptions. An auditor can trace any mapping back to the specific control or article. A consultant can edit a single row without rewriting the surrounding matrix.

Gap Report (excerpt)

The gap report ranks by cross-framework benefit (how many frameworks does fixing this gap satisfy?) multiplied by regulatory severity (GDPR mandatory fines vs. SOC 2 voluntary). This surfaces the highest-value remediations first: implementing A.8.10 (information deletion) is a low-effort fix that closes gaps across both SOC 2 and GDPR at once.

Executive Summary (excerpt)

Top recommendation: Implement data subject rights procedures (GDPR Art. 15–22). No direct ISO 27001 control exists for this — it is a standalone GDPR obligation that requires a dedicated implementation regardless of other framework coverage.

What the validation tool actually checks

The check_cross_compliance_coverage tool is not an opinion — it’s a programmatic check that:

1. Detects frameworks from the matrix table headers
2. Extracts control IDs using framework-specific regex patterns anchored to table rows (e.g., A.N.N for ISO 27001, CCN.N for SOC 2)
3. Counts found vs. expected per framework (93 for ISO 27001, 50 for SOC 2 TSC, 21 for GDPR key articles)
4. Flags incomplete rows — any table row with an empty cell for a selected framework

The tool reports PASS when all frameworks are covered, or WARN with specific missing control IDs and incomplete row numbers. This is the kind of completeness check that would take hours to do manually on a 93-row matrix across three frameworks.

When this skill is most (and least) useful

Most useful when:

• Your organization holds or pursues 2+ certifications and needs to show unified compliance
• You’re a consultant running multi-framework engagements and want a repeatable, validated starting point
• You need to demonstrate to an auditor that controls satisfy requirements across frameworks simultaneously
• You’re prioritizing remediation and want to fix the fewest controls to close the most gaps

Less useful when:

• You only work with a single framework (use the dedicated per-framework skills instead)
• You need deeply customized mappings that diverge from published crosswalks (the reference files are the source of truth; custom mappings require editing them)
• You need real-time integration with GRC platforms like ServiceNow or OneTrust (this produces documents, not API integrations)

Try it

The Cross-Compliance Matrix skill is available in the skill library . Start by selecting ISO 27001 + one target framework — the simplest pair — and review the output before scaling to 3–5 frameworks. If you’ve already run per-framework gap assessments in Rakenne (ISO 27001, SOC 2, NIST 800-53, or GDPR), the skill automatically reads those outputs to enrich the matrix with your current implementation status.

Start a free trial with the ISO 27001 workspace

Summary. Multi-framework compliance mapping is one of those tasks that practitioners know is valuable but rarely get right in a sustainable way — the spreadsheet drifts, the RAG pipeline breaks, the generic AI hallucinates control versions. The Cross-Compliance Matrix skill addresses this with version-pinned reference files, a structured six-phase workflow, and programmatic validation. Your role stays where it belongs: interpreting coverage for your specific context, validating priorities against business reality, and signing off on what goes to the auditor.