Collect once, comply everywhere: the framework crosswalk explained

Most compliance frameworks ask for the same controls in different words. A crosswalk maps one control library to every framework at once, so a second audit isn't a second project. Here's how it works.

By The Keel team · July 28, 2026 · 6 min read

You finish SOC 2. Sales lands a European prospect who wants ISO 27001. It feels like starting over, and it shouldn't, because 60–80% of the controls overlap. The reason it feels like a second project is that most teams re-collect the same evidence under a new framework's labels. A crosswalk fixes that.

What a crosswalk actually is

A crosswalk is a mapping from one control to every framework requirement it satisfies. Implement multi-factor authentication once, and that single control maps to:

SOC 2: Logical & Physical Access (CC6)
ISO 27001: Annex A access-control requirements
PCI DSS: the requirement to secure access to cardholder data
HIPAA: the corresponding access-control safeguard

Same control. One implementation. One piece of evidence. Four frameworks satisfied.

Why the overlap is so large

Frameworks are written by different bodies for different audiences, but they're all trying to answer the same question: is this organization managing its risks responsibly? So they converge on the same fundamentals: access control, encryption, logging, backups, vendor management, incident response, training. The wording differs; the underlying control doesn't. Once you see compliance as a set of controls rather than a set of framework checklists, the duplication becomes obvious, and avoidable.

Collect evidence once

The real time sink in any audit is evidence: the screenshots, exports, and logs that prove a control is operating. Tie a piece of evidence to a control, not to a framework, and the crosswalk does the rest. That one artifact now proves every requirement the control maps to. No re-uploading the same access-review export under three different audit folders.

Watch your readiness, per framework, in real time

When your program is a crosswalked control library, "how ready are we?" stops being a guess. Your readiness score is simply the share of in-scope requirements covered by at least one implemented control, and it updates as you work, for every framework at once. Adding a framework becomes a matter of seeing which few requirements aren't already covered, rather than rebuilding from scratch.

How Keel helps

This is the engine at the center of Keel. The controls & crosswalk feature maintains one library mapped across SOC 2, ISO 27001, PCI DSS, HIPAA, and more. Evidence attaches to a control once and counts everywhere. And a one-click starter control set gives you a working, pre-mapped program instead of a blank grid.

The payoff: your second framework, and your fifth, is a fraction of the work of your first.

Start free and map one control library across every framework you need.

Put this into practice with Keel

Keel gives growing teams a self-serve path to SOC 2, ISO 27001, and more, controls, evidence, policies, access reviews, and a trust center on one graph.

Start free See the product

Keep reading

Leaving your GRC tool? Take your evidence files, not just links
Most GRC exports hand you a spreadsheet of records and a pile of links that break the day you cancel. Real portability means leaving with the actual files. Here is how keel-migrate does it, and why we built the exit in the open.
How to keep customers informed during a security incident (without a public status page)
A public status page tells the whole internet your business is having a bad day. But affected customers still need the truth, fast. Here is a better model: a private, per-recipient status page that only the people you notify can open.
GRC for developers: an open API, an MCP server, and no lock-in
Most compliance platforms treat your data as theirs. Keel ships a REST API, outbound webhooks, and a Model Context Protocol server, plus an open-source importer, so your GRC program is programmable and portable. Here is what that unlocks.

This article is general information, not legal or audit advice. Framework names (SOC 2, ISO 27001, PCI DSS, etc.) are referenced factually; Keel is not affiliated with or endorsed by their owners.