ISO 27001, SOC 2 & NIST CSF Crosswalk: Control Mapping Guide

The Three Spreadsheets Problem

Priya Nair keeps three browser tabs open more or less permanently. Tab one is the ISO 27001 Statement of Applicability for Lumenpath Analytics, the 400-person SaaS company where she's VP of Security & Compliance. Tab two is the SOC 2 control matrix her Type II auditor uses every year. Tab three — the newest, messiest one — is a NIST CSF 2.0 tracker she started six weeks ago in a hurry, because a regional bank evaluating Lumenpath's fraud-analytics platform for a three-year, $2.4 million contract sent back a vendor security questionnaire with a single non-negotiable line: "Vendor must demonstrate alignment to NIST CSF 2.0 functions, mapped to existing certifications, within 10 business days."

Lumenpath already had the receipts. It held a clean ISO/IEC 27001:2022 certificate and a SOC 2 Type II report with zero exceptions. But "we have two certifications" wasn't the question. The bank's procurement team wanted to see, function by function, how Lumenpath's actual controls lined up with GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER — and they wanted it in a format their own risk committee could read without translating ISO clause numbers in their heads.

Priya's first instinct was to build tab three from scratch, control by control, cross-referencing two other documents that were themselves maintained by different people on different update cycles. Her access-control lead owned the ISO evidence. Her SOC 2 auditor's liaison owned the control matrix. Nobody owned a NIST view, because nobody had ever needed one before. Three weeks in, with the deal clock ticking, she stopped trying to build a third parallel system and instead built one crosswalk table that let a single control — say, multi-factor authentication for privileged accounts — show up correctly as ISO Annex A control 8.2 and 8.5, as SOC 2 CC6.1 and CC6.2, and as NIST CSF PR.AA at the same time. The crosswalk didn't just answer the bank's question in nine days. It became the artifact Lumenpath now updates once, quarterly, instead of maintaining three drifting spreadsheets that quietly disagreed with each other by the second audit cycle.

This is the article that crosswalk is built from. It's a practitioner-level mapping — not an official equivalence table published by ISO, the AICPA, or NIST — between ISO 27001 Annex A's 93 controls, SOC 2's Trust Services Criteria, and NIST CSF 2.0's six functions. Used correctly, it turns three audit programs into one control set with three reporting outputs. Used carelessly, it becomes a false-confidence document that tells an auditor "we've got this covered" when you haven't actually looked at the gap.

Who This Is For

This guide is for compliance, security, and GRC leaders who already run — or are about to run — more than one of these three frameworks at once: the SaaS company juggling a customer-mandated SOC 2 report alongside EU-market ISO 27001 certification; the critical-infrastructure-adjacent vendor whose federal or large-enterprise customers now ask for NIST CSF 2.0 alignment on top of existing certifications; the internal auditor trying to stop three teams from independently gathering evidence for what is functionally the same control. You'll walk away with cluster-level and representative control-level crosswalk tables across all four ISO Annex A themes, a clear picture of what each framework covers that the other two don't, a short list of mapping mistakes that cause audit findings, and a repeatable method for running one control set that feeds three different outputs.

Why Bother Crosswalking at All

The honest case for a crosswalk isn't philosophical — it's a spreadsheet-hours argument. Every control that exists in more than one framework, if managed separately, gets implemented once but documented, evidenced, and audited multiple times. Multiply that by 90-plus ISO controls, roughly 30 SOC 2 Common Criteria points of focus, and six NIST CSF functions with more than 20 categories underneath them, and you get duplicated policy documents, duplicated evidence folders, duplicated auditor interviews, and — the part finance actually notices — duplicated consulting and audit fees for control sets that are, underneath the different vocabulary, the same access review or the same vulnerability scan cadence.

A crosswalk collapses that duplication into a single control library with multiple "tags." You implement and evidence encryption-in-transit once; the crosswalk tells you that single piece of evidence also satisfies ISO 27001 control 8.24, SOC 2 criterion CC6.1, and NIST CSF's PR.DS-related protect activities. You're not doing three security programs — you're doing one security program that happens to produce three different reports for three different audiences: a certification body, an audit firm, and (increasingly) a customer procurement team that speaks NIST CSF natively because that's the language federal guidance and critical-infrastructure sector regulators use.

This is also the natural companion to two other pieces in this series: the framework overview in ISO 27001 vs Other Security Frameworks: NIST, SOC 2, and PCI DSS Compared, and the decision-oriented ISO 27001 vs SOC 2: Which One Do You Need?. Those two answer "which framework, and why." This one answers "I already need two or three — how do I stop running them as three unrelated projects?" It sits alongside Running ISO 27001 and SOC 2 Together: A Shared Control Framework, which covers the program-management side of dual certification; this article is the control-level reference you pull up while you're actually building that shared framework.

The Cost of Three Separate Programs vs. One Unified Program

Numbers make the efficiency case concrete, so here's an illustrative breakdown — figures drawn from the pattern I've seen repeat across mid-market clients running two or three of these frameworks, not a published benchmark. Treat the dollar amounts as directional, not a quote you can hand to your CFO unmodified.

The efficiency case is real, but it's not the only reason this matters. Look at the third row again: a multi-week acceleration on a customer RFP response is frequently the difference between winning and losing a deal that's already gone through months of technical evaluation — which is exactly the position Priya Nair was in in the cold open, and exactly why the strategic close of this guide argues a crosswalk is a sales asset as much as an audit shortcut.

The Three Frameworks, in Brief

Before the crosswalk tables make sense, you need the shape of each framework, because they're not built the same way and the differences matter more than the similarities. If any of the terminology below is unfamiliar, the ISO 27001 Terminology and Glossary is worth keeping open in a second tab.

ISO/IEC 27001:2022 is a certifiable management-system standard. Clauses 4–10 define the Information Security Management System (ISMS) — context, leadership, planning, support, operation, performance evaluation, improvement — and Annex A supplies a reference set of 93 controls across four themes (Organizational, People, Physical, Technological) that the organization selects from and documents in a Statement of Applicability. Certification is issued by an accredited body after a two-stage audit and is reassessed via annual surveillance audits over a three-year cycle.

SOC 2 is not a certification; it's an attestation. If you need the fuller picture of how the SOC 2 Trust Services Criteria are structured before diving into the crosswalk tables, that's worth a detour first. An independent CPA firm examines your controls against the AICPA's Trust Services Criteria and issues a report — Type I (design, at a point in time) or Type II (design and operating effectiveness, over a 3–12 month window). The Security category (Common Criteria, CC1–CC9) is mandatory; Availability, Processing Integrity, Confidentiality, and Privacy are optional add-on categories you select based on what your service commitments actually promise customers.

NIST CSF 2.0, published in February 2024 — see our NIST CSF 2.0 functions and categories explained for the standalone deep dive — is a voluntary risk-management framework, not a certifiable standard and not an attestation. There's no NIST CSF "certificate" to earn. It organizes cybersecurity outcomes into six functions — GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER — with GOVERN added in the 2.0 revision specifically to elevate cybersecurity governance, risk strategy, and supply-chain risk to the same level as the operational functions. Organizations self-assess against CSF using informative references and organizational profiles; some regulators and large enterprise customers now request a CSF-mapped narrative as part of vendor risk reviews, which is exactly the situation Priya Nair found herself in.

How to Read a Crosswalk (Read This Before the Tables)

Every table below maps ISO Annex A controls to NIST CSF 2.0 functions/categories and SOC 2 Trust Services Criteria. Before you copy any of it into a customer-facing document or an audit workpaper, understand four caveats that practitioners routinely skip and regret skipping.

First, these are practitioner crosswalks, not official equivalence tables. No standards body has published a binding "ISO control X equals SOC 2 criterion Y equals CSF subcategory Z" translation. Third-party crosswalks — including this one, and including the ones published by consulting firms, GRC platforms, and the Secure Controls Framework — are informed judgment calls about where control intent overlaps. They're extremely useful for planning and efficiency. They are not something an auditor is obligated to accept, and they don't substitute for that auditor's own testing.

Second, mapping is rarely 1:1. A single ISO control frequently supports multiple CSF subcategories and multiple SOC 2 criteria, and the reverse is just as common — one SOC 2 criterion (say, CC6.1, logical access) draws on evidence from half a dozen ISO controls (5.15 through 5.18, 8.2, 8.5). Where this guide shows one row per control, read it as "primary alignment," not "exclusive alignment."

Third, breadth isn't depth. Two frameworks both "covering" access control doesn't mean they demand identical evidence. ISO 27001 wants documented access control policy and risk-based justification tied to your ISMS; SOC 2 wants operating-effectiveness testing over a review period showing the access reviews actually happened on schedule; NIST CSF wants you to describe your access-management outcomes and maturity within an organizational profile. Same territory, different proof.

Fourth, and most important: a crosswalk tells you where to look for overlapping evidence, not what to skip. Treat every "this satisfies both" row as a hypothesis to confirm with your actual auditor or certification body, not a shortcut to take unverified into a Stage 2 audit or a Type II examination.

"The crosswalk isn't the compliance program. It's the index card that tells you which drawer the evidence is in. I've watched teams treat a mapping spreadsheet as proof of coverage and get blindsided in a SOC 2 walkthrough because the mapped control existed on paper but nobody could produce the quarter's access review." — Marcus Webb, CISO, Northfield Insurance Group

NIST CSF 2.0: Functions and Categories at a Glance

Since the crosswalk tables reference CSF functions and categories throughout, here's the reference layer. NIST CSF 2.0 organizes outcomes into six functions, each broken into categories (subcategories exist below these but aren't needed for a theme-level crosswalk).

SOC 2 Trust Services Criteria at a Glance

With those two reference tables in hand, the theme-by-theme crosswalks below will make sense without you flipping back and forth.

Crosswalk: Organizational Controls (Annex A 5.1–5.37)

The Organizational theme is the largest of the four — 37 controls — and it's also where the three frameworks overlap most heavily, because governance, access, supplier risk, and incident management are core to all three. The cluster table below groups the 37 controls into logical families and maps each family to its primary CSF function and SOC 2 criteria.

For deeper reading on the full theme, see ISO 27001 Annex A Organizational Controls: Complete Overview (5.1–5.37).

Representative Individual Control Mappings — Organizational

Cluster-level mapping is useful for planning; individual-control mapping is what your evidence library actually needs. Here are six representative examples pulled to control-ID granularity.

"The single biggest efficiency win in our crosswalk was realizing 5.15 through 5.18 and CC6.1 through CC6.3 are basically the same access-review evidence with different cover pages. We used to run two separate quarterly access certifications. Now we run one and route the output to both auditors." — Priya Nair, VP of Security & Compliance, Lumenpath Analytics

Crosswalk: People Controls (Annex A 6.1–6.8)

The People theme is small — eight controls — but it's a good illustration of where SOC 2's Common Criteria are genuinely thinner than ISO's people-focused coverage. Because there are only eight controls, we map them individually rather than by cluster. Background reading: ISO 27001 People Controls Overview: Controls 6.1–6.8 Explained.

Note the gap: ISO 27001 gives you eight standalone controls dedicated entirely to personnel security. SOC 2's Common Criteria fold most personnel expectations into CC1 (Control Environment) and CC6 (Access Controls) rather than treating "people" as its own category — which means an ISO-certified organization documenting to CC1.4 alone is likely under-evidencing what its ISO program already does.

Crosswalk: Physical Controls (Annex A 7.1–7.14)

Physical controls are where NIST CSF is noticeably thinner than the other two — CSF 2.0 treats physical security mostly as a subset of Platform Security and Technology Infrastructure Resilience rather than a dedicated function, reflecting its origin as a framework written for critical-infrastructure cybersecurity rather than facilities security. All 14 controls, mapped individually. Background: ISO 27001 Physical Controls Overview: Controls 7.1–7.14 Explained.

"Physical controls are the theme where I tell clients not to force a NIST CSF equivalence just because a spreadsheet template has a column for it. CSF genuinely doesn't dedicate the same real estate to badge readers and cabling closets that ISO does. Map it honestly as 'partial' rather than inventing a subcategory that isn't really there." — Aisha Bello, Founder & Principal Consultant, Meridian Risk Partners

Crosswalk: Technological Controls (Annex A 8.1–8.34)

Technological is the largest theme (34 controls) and the one where SOC 2 and NIST CSF both have the deepest, most mature coverage — this is the territory of access management, vulnerability management, logging, network security, cryptography, and secure development that every one of these frameworks was fundamentally built to address. Cluster view first, covering all 34 controls in eleven families; individual representative rows follow. Background: ISO 27001 Technological Controls Overview: Controls 8.1–8.34 Explained.

Representative Individual Control Mappings — Technological

"Technological is the theme where I stop clients from over-engineering the crosswalk. Network security controls, logging, vulnerability management — these things map so cleanly across all three frameworks that you genuinely can run one tool, one dashboard, one evidence pipeline, and just relabel the export for whichever auditor is asking." — Tomás Rivera, Senior Compliance Manager, BrightAxis Payments

Visualizing the Overlap

The diagram is deliberately not a literal Venn diagram — with 93 ISO controls, nine SOC 2 Common Criteria points plus four optional categories, and six CSF functions, a true three-circle overlap would be unreadable. Instead it shows the practical workflow: ISO's four themes feed a small number of unified control clusters, and those clusters map outward into both SOC 2 criteria and CSF functions simultaneously. That middle layer — "Unified Control Set" — is the thing you actually want to build and maintain. It's also, not coincidentally, close to what a mature GRC platform's control library looks like once you've mapped it against all three frameworks.

Mapping SOC 2's Optional Categories: Availability, Confidentiality, Privacy, Processing Integrity

The theme-by-theme tables above mostly reference SOC 2's mandatory Security (Common Criteria) category, because that's the category every SOC 2 report includes and the one with the deepest ISO and CSF overlap. But the four optional Trust Services Categories deserve their own pass, because they map to specific, identifiable slices of ISO's control set rather than spreading evenly across all four themes — and because whether they're relevant to your crosswalk depends entirely on which categories you've actually selected for your SOC 2 report.

This is a case where the crosswalk actively prevents a specific, common overclaiming mistake: an organization with ISO control 5.34 (Privacy and protection of PII) fully implemented will sometimes assume that automatically extends to a SOC 2 Privacy category claim — but if Privacy was never selected as an in-scope TSC category for that SOC 2 engagement, there's no SOC 2 assurance covering it at all, regardless of how mature the ISO control is. Always check TSC category selection before drawing the crosswalk line.

Coverage Gaps: What Each Framework Has That the Others Don't

A crosswalk that only shows overlap is misleading. Just as important is naming what one framework covers that has no clean equivalent elsewhere — because these gaps are exactly where teams get caught assuming "we're ISO certified, so we're covered" when a specific SOC 2 or CSF expectation was never actually addressed.

Read the table as a checklist: if your customer or regulator cares about any row in the right-hand column, having the other two frameworks in place does not close that gap. Priya Nair's bank prospect, for instance, wanted the CSF GOVERN narrative specifically — something her ISO certificate and SOC 2 report implied but never stated in CSF's own vocabulary. That's the gap the crosswalk exists to bridge, not eliminate.

Using the Crosswalk to Run One Control Set

The point of all this mapping isn't a reference document you consult once during an RFP response — it's a way to restructure how your team actually implements and evidences controls. Here's the model that works in practice, framed as a single unified control with three downstream outputs.

Build your control library this way — one implementation, three tagged outputs — and the audit-prep workload stops scaling linearly with the number of frameworks you carry. The team still has three deliverables at the end (a certificate, a report, and a profile/narrative), but they're drawing from the same evidence folder instead of three separate ones.

"We stopped asking 'what does ISO need' and 'what does SOC 2 need' as two different questions. We ask 'what does this control need to prove, once, well enough that we can hand the same evidence to three different reviewers.' That single reframe cut our audit-prep calendar by about a third." — Dana Ilves, Director of GRC, Corvid Health Systems

This is also where the four Annex A theme overviews in this series earn their keep as reference material while you build the unified library: ISO 27001 Annex A Organizational Controls: Complete Overview (5.1–5.37), ISO 27001 People Controls Overview: Controls 6.1–6.8 Explained, ISO 27001 Physical Controls Overview: Controls 7.1–7.14 Explained, and ISO 27001 Technological Controls Overview: Controls 8.1–8.34 Explained. Your Statement of Applicability is the natural starting inventory for this exercise — if you haven't built one yet, ISO 27001 Statement of Applicability (SoA): How to Create One walks through it.

Building Your Own Crosswalk: A Step-by-Step Method

The tables in this guide give you a starting reference, but a crosswalk that's actually useful to your organization has to be built (or at least verified) against your own control implementation, not copied wholesale from an article. Here's the sequence that works, drawn from how Lumenpath, Corvid, and a handful of other clients I've worked with actually built theirs.

Step 4 is where most homegrown crosswalks fall apart, and it's worth dwelling on. It's tempting to treat the mapping exercise as a desk exercise — compare control language, decide it's "close enough," move on. But a mapped row is only as good as the evidence behind it, and the BrightAxis case study earlier in this guide exists specifically because that verification step got skipped under deadline pressure.

Tooling: Do You Need a GRC Platform to Do This?

Not necessarily, at least not at first. A well-maintained spreadsheet with clear ownership, version control, and a quarterly review cadence is a perfectly credible crosswalk for an organization managing two or three frameworks across a few hundred controls. Where the spreadsheet approach breaks down is scale and drift: once you're tracking evidence freshness across 90-plus ISO controls, nine SOC 2 Common Criteria points plus optional categories, and six CSF functions, manually updating cross-references every time a control owner changes or a piece of evidence expires becomes its own part-time job.

GRC platforms that support multi-framework control libraries — where one control record can carry tags for ISO, SOC 2, and NIST CSF simultaneously, with a single evidence attachment satisfying all three — solve that scaling problem directly, and it's the direction most organizations running more than two frameworks eventually move toward. The caveat from earlier still applies at full force here, though: a platform's pre-built crosswalk content is generic. It reflects how the vendor's team interprets typical control overlap, not your specific implementation. Treat platform-generated mappings the same way you'd treat this article's tables — a strong starting point that needs verification against your actual evidence before you present it to an auditor or a customer. If you're evaluating whether a platform investment makes sense for your organization's size and framework count, ISO 27001 Software and GRC Tools: Do You Need One? walks through that decision in more depth.

When a Formal Crosswalk Isn't Worth Building Yet

Not every organization running two frameworks needs the full exercise described in this guide, and I'd rather say that plainly than let every reader assume they need a 93-control mapping spreadsheet by next quarter. If you're a 20-person startup with SOC 2 Type I in progress and ISO 27001 still a year or two away, a formal crosswalk is premature — build your control set with reuse in mind (label things clearly, keep evidence centralized) but don't invest in a maintained mapping document until you're actually running both assessments concurrently. Similarly, if NIST CSF alignment is a one-time ask from a single prospect rather than a recurring customer expectation, a lightweight narrative response referencing your existing ISO and SOC 2 evidence is usually more proportionate than building and maintaining a permanent CSF profile. Save the full crosswalk investment for the point where you're running two or more of these assessments on a recurring, overlapping basis — that's where the duplicated-effort math actually justifies the up-front mapping work.

Common Mapping Mistakes

I've reviewed a lot of homegrown crosswalks over the years — some built by internal GRC teams, some inherited from consultants, some exported wholesale from a GRC platform without anyone checking whether the platform's mapping matched the organization's actual scope. The same handful of mistakes shows up again and again.

"The mistake I see most in vendor questionnaires is a company claiming NIST CSF alignment because a GRC tool auto-generated a mapping from their ISO SoA. Nobody on their team could actually walk me through the GOVERN function outcomes. That's not alignment — that's a spreadsheet export." — Sam Okafor, Internal Audit Lead, Portside Logistics

Case Studies

Case Study 1: Lumenpath Analytics — Winning the $2.4M Deal in 9 Days

Picking back up where the cold open left off: Priya Nair's team built the unified crosswalk under real time pressure. Their approach was pragmatic rather than exhaustive — they didn't map all 93 ISO controls to CSF subcategories in nine days; they mapped the roughly 40 controls most relevant to the bank's actual concerns (access management, incident response, encryption, vendor risk, and business continuity) and clearly labeled the rest as "aligned at the framework level, detailed mapping available on request." That honesty mattered: the bank's risk committee had seen vendors overclaim before and specifically flagged Lumenpath's response as more credible for scoping what it hadn't yet finished. The deal closed on schedule. More durably, the crosswalk table became a living document — Priya's team now updates it quarterly instead of rebuilding a NIST view from scratch for the next customer who asks. Estimated ongoing savings: roughly $95,000 a year in reduced duplicate audit-prep hours across the ISO and SOC 2 cycles, once evidence collection was consolidated behind the unified control set described earlier in this guide.

Case Study 2: Corvid Health Systems — Three Frameworks, One Evidence Pipeline

Corvid Health Systems, a healthcare analytics SaaS vendor, already held ISO 27001 certification and a SOC 2 Type II report when a federal-contractor customer's subcontract terms required a documented NIST CSF 2.0 profile as part of pass-through cybersecurity obligations. Dana Ilves, Corvid's Director of GRC, had watched three prior audit cycles run as three semi-independent projects, each with its own evidence-collection sprint scheduled in the weeks before the relevant deadline — a pattern that consistently produced overtime hours and reviewer fatigue heading into the SOC 2 Type II fieldwork. Corvid built a control library modeled on the "unified control, three outputs" approach, prioritizing the highest-overlap clusters first: access management, logging and monitoring, and incident response. Within two audit cycles, evidence-collection time for the overlapping controls dropped by roughly 35%, and the NIST CSF profile — previously nonexistent — was produced as a byproduct of already-scheduled ISO and SOC 2 evidence gathering rather than a fourth separate project.

Case Study 3: BrightAxis Payments — A Cautionary Tale on Overclaiming

Not every crosswalk story ends cleanly. BrightAxis Payments, a payments-adjacent fintech, had a consultant build a crosswalk spreadsheet ahead of a SOC 2 Type II renewal, mapping ISO controls to SOC 2 criteria at a granularity the consultant hadn't actually verified against BrightAxis's real evidence. Several rows claimed that ISO evidence for supplier risk management (5.19–5.23) fully satisfied SOC 2's CC9.2, when in practice BrightAxis's ISO supplier reviews covered a narrower vendor population than its SOC 2 system boundary required. The SOC 2 auditor's sample testing caught the gap during fieldwork, resulting in a qualified finding on vendor risk management that delayed the Type II report by several weeks and required a remediation letter to two enterprise customers who'd been waiting on the report to complete their own vendor-risk renewals. Tomás Rivera, BrightAxis's Senior Compliance Manager at the time, now requires every crosswalk row to be spot-checked against actual evidence before it's presented externally — the lesson that shaped the mapping-mistakes table earlier in this guide.

Quick Reference: Where to Find X Across All Three Frameworks

Auditors, procurement teams, and internal stakeholders tend to ask the same handful of questions regardless of which framework they're most comfortable with. This reverse-lookup table is the one worth printing and keeping next to your desk during audit season — it answers "where does control topic X live" across all three frameworks in one glance, without needing to trace back through the theme-by-theme tables above.

Audit Cadence and Evidence Windows Compared

One thing a control-level crosswalk can't show on its own is when each framework wants to see evidence, and that difference drives a lot of the scheduling friction teams run into. Understanding the cadence mismatch up front prevents the common mistake of assuming that because a control is "mapped," its evidence-collection timing automatically lines up too.

If your ISO surveillance audit, your SOC 2 Type II review window, and your internal CSF profile refresh are all on different calendars — which they usually are when built independently — the unified control set described earlier becomes even more valuable, because at least the underlying evidence stream is continuous rather than bursty around three separate deadlines.

The Strategic Close: A Crosswalk Is a Sales Asset, Not Just an Audit Shortcut

It's easy to frame a crosswalk purely as an internal efficiency play — fewer duplicated evidence requests, fewer overtime hours before an audit. That's real, and it's the case Priya Nair, Dana Ilves, and Tomás Rivera all made in this guide. But the sharper framing, the one worth taking to your leadership team, is that a well-maintained crosswalk is a sales enablement asset. Enterprise procurement teams increasingly run vendor risk reviews that speak the language of whichever framework their own risk committee reports against — sometimes ISO, sometimes SOC 2, sometimes, as with Lumenpath's bank prospect, NIST CSF specifically because that's what their own regulator expects them to reference. A company that can answer "show me your NIST CSF alignment" in nine days instead of six weeks isn't just running a tighter compliance program — it's removing a deal-velocity bottleneck that competitors carrying only one certification can't match.

That's the pitch worth making internally when you ask for the time to build this properly: the crosswalk isn't overhead on top of your ISO and SOC 2 programs. It's the artifact that turns two (or three) certifications into a single, fast, credible answer to whatever framework the next big customer happens to ask about.

If you're building this crosswalk for the first time, don't start from a blank spreadsheet. Our ISO 27001 vs SOC 2 vs NIST CSF Comparison Guide eBook walks through the same theme-by-theme mapping approach used in this article in a format built for internal stakeholder review, and the Annex A — All 93 Controls at a Glance cheat sheet is the fastest way to inventory your ISO control set before you start tagging it against SOC 2 and CSF. If you haven't yet identified where your existing controls actually stand relative to all three frameworks, run them through our ISO 27001 Gap Analysis Tool before you build the crosswalk — mapping controls you haven't actually implemented just produces a more convincing-looking version of the same gap. And if ISO 27001 certification itself is still ahead of you, The Complete ISO 27001 Implementation Guide eBook and our Statement of Applicability (SoA) Template give you the foundation this entire crosswalk exercise builds on top of.