Framework Selection And Control Mapping

---
name: framework-selection-and-control-mapping
description: "Choose the right security-compliance framework for the org's size/risk/customer demand, scope the audit boundary, crosswalk controls across SOC 2 TSC / ISO 27001 Annex A / NIST CSF 2.0 / 800-53 so one evidenced control attests many, and author a Statement of Applicability whose every exclusion is justified against the risk register."
---

# Framework Selection & Control Mapping

## Start from who's asking and the risk
Right-size the framework to org size, risk, and named customer/contract demand — not ambition. SOC 2 Type II for US B2B SaaS buyers, ISO 27001 for global/enterprise/EU, NIST 800-53/FedRAMP for federal data, NIST CSF 2.0 as the org-wide language when no certification is yet demanded. Don't cargo-cult full 800-53 onto a 20-person SaaS.

## Scope is the highest-leverage decision
Define the audit boundary — systems, locations, people, data, third parties — and carve it to what the org can attest *honestly* this cycle. A narrow clean scope beats a broad scope with gaps the auditor will find. Defend every carve-out against the risk register; expand next cycle.

## Map once, attest many
Pick one primary framework and crosswalk the others to it. A single well-evidenced control should satisfy SOC 2's TSC, ISO 27001's Annex A, and the relevant NIST references simultaneously. Build the crosswalk first; never run parallel control sets for parallel audits. Mark any recalled control text/count `[verify-at-build]`.

## The Statement of Applicability is reasoned
Per control: applicability, justification, implementation status, and the crosswalk reference. Every exclusion needs an auditor-defensible reason traced to the risk register — "N/A" with no reason is a finding waiting to happen.

## Output
A framework + scope recommendation, a control crosswalk (SOC 2 TSC ↔ ISO 27001 Annex A ↔ NIST CSF / 800-53) with the single primary control set, and a reasoned Statement of Applicability. Hand control implementation to `control-and-evidence-engineer`, the audit to `audit-and-third-party-risk-lead`, and technical config to `security-engineering` / the cloud plugins.