Research

How much do compliance frameworks actually overlap?

Teams treat each framework as a fresh project. It usually is not. We measured the overlap using our own open control library: 95 of its common controls map to the 10 frameworks in this study. The short version is that once you have done one framework, most of the next one is already sitting in your evidence.

The data set

Keel maintains a library of canonical security controls, each pre-mapped ("crosswalked") to the specific clauses it satisfies. This report analyzes the 95 of those controls that satisfy at least one of 10 frameworks: ISO 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, ISO 9001, ESG Essentials, NIST 800-171, CIS Controls, GDPR. Across those 95 controls there are 245 control-to-framework mappings into that set, which means the average control does real work in 2.6 frameworks at once. The control library is published as an open dataset (CC BY 4.0) on our open source page.

Overlap is the rule, not the exception

The average control maps to 2.6 frameworks, and 21 of the 95 controls (22%) satisfy five or more frameworks at once. At the very top, 2 controls map to 9 of the 10 frameworks in the set: Third-party / vendor risk management, Security awareness training. Governance fundamentals are shared almost everywhere; only a handful of controls are truly framework-specific.

Controls carrying the most frameworks

Controls carrying the most frameworks
Control	Frameworks satisfied
Third-party / vendor risk management	9
Security awareness training	9
Access control policy	8
User provisioning & deprovisioning	8
Multi-factor authentication	8
Encryption in transit & at rest	8
Logging & monitoring	8
Incident response	8

If you have SOC 2, ISO 27001 is mostly done

The clearest way to see the reuse is pairwise: of the controls that satisfy one framework, how many also satisfy another? Reading the table below: of the 27 controls that map to SOC 2, 25 (93%) also satisfy ISO 27001. The two frameworks are near-mirror images at the control level; the remaining work is mapping and evidence, not new controls.

Pairwise control overlap between frameworks
If you have...	...how much of this is already covered	Shared controls
SOC 2	ISO 27001	25 of 27 (93%)
SOC 2	PCI DSS	18 of 27 (67%)
SOC 2	NIST CSF	15 of 27 (56%)
SOC 2	HIPAA	19 of 27 (70%)
ISO 27001	HIPAA	24 of 47 (51%)
PCI DSS	HIPAA	16 of 21 (76%)

Percentages are of the first framework’s control count. Overlap is not symmetric: a smaller framework can be almost fully contained in a larger one while covering less of it in return.

How many controls each framework needs

Coverage in this library, ordered by breadth. Larger frameworks such as ISO 27001 and SOC 2 draw on the most controls; targeted regimes such as GDPR touch fewer, because much of their text is legal rather than technical.

Controls per framework in this library
Framework	Controls in this library
ISO 27001	47 of 95
ESG Essentials	36 of 95
HIPAA	31 of 95
SOC 2	27 of 95
GDPR	22 of 95
PCI DSS	21 of 95
CIS Controls	18 of 95
NIST CSF	16 of 95
ISO 9001	15 of 95
NIST 800-171	12 of 95

What this means for sequencing

The practical lesson is to build controls once and map them many times. Because the average control serves 2.6 frameworks, the marginal cost of a second framework is dominated by mapping and evidence, not by standing up new controls. That is why a crosswalk-native approach matters: the same encryption, access-review, and incident-response controls you implement for SOC 2 are the ones an ISO 27001, PCI DSS, or HIPAA assessor will ask about next.

Start with the high-reuse core. The 21 controls that satisfy five or more frameworks are the highest-leverage place to begin.
Pick your second framework by overlap. From SOC 2, ISO 27001 is the smallest additional lift; a regime like GDPR shares less because it is largely legal.
Map, do not rebuild. Treat the second framework as a mapping exercise over existing evidence. (Explore the mappings in the crosswalk explorer.)

Methodology and limitations

Figures are computed at build time from Keel’s canonical starter control library, scoped to the 95 controls that map to the frameworks in this study; that library is published as the open compliance-crosswalks dataset (CC BY 4.0). "Overlap" counts a control as covering a framework when the control is crosswalked to at least one clause of that framework. This measures control-level reuse, not clause-for-clause equivalence: satisfying a framework in practice still requires the specific evidence and scoping each assessor expects, and no crosswalk removes the need for an audit. The library covers common security, privacy, quality, and ESG frameworks and grows as more are authored; it is not the complete text of any standard. This is general information, not audit or legal advice.

Comply once, prove everywhere

Keel is the crosswalk-native, AI GRC platform for SMBs: implement a control once and Keel maps it to every framework it satisfies. Start free.

Start free Get the open dataset