Control Mapping Reference
Framework-to-Code Mapping Patterns
Mapping Process
- Identify requirement -> specific framework section (e.g., PCI-DSS Req 3.4)
- Locate implementation -> code, config, infrastructure, or process
- Assess status -> Implemented / Partial / Missing / N/A
- Document evidence -> file:line, config path, screenshot, or policy reference
- Assign owner -> team or individual responsible for control operation
Common Code-Level Controls
| Regulatory Requirement | Code Pattern | Where to Check |
|---|---|---|
| Encryption at rest | AES-256, KMS integration, DB encryption config | DB config, storage config, KMS policies |
| Encryption in transit | TLS 1.2+, certificate pinning | Server config, HTTP client config, load balancer |
| Access control | RBAC/ABAC middleware, permission checks | Auth middleware, route guards, API interceptors |
| Audit logging | Structured audit events, immutable log store | Logger config, audit middleware, event handlers |
| Input validation | Schema validation, sanitization | Request validators, form handlers, API schemas |
| Session management | Token expiry, secure cookie flags | Auth config, session middleware |
| Password policy | Complexity requirements, bcrypt/argon2 hashing | Auth service, user model, password validator |
| MFA | TOTP, WebAuthn, SMS (deprecated) | Auth flow, login handlers |
| Data retention | TTL policies, cron deletion jobs | DB schemas, cron configs, lifecycle policies |
| Backup/recovery | Automated backups, tested restore procedures | Backup scripts, DR runbooks |
Cross-Framework Control Alignment
Many controls satisfy multiple frameworks simultaneously:
| Control Area | SOC2 | PCI-DSS v4.0 | HIPAA | ISO 27001:2022 |
|---|---|---|---|---|
| Access control | CC6.1-6.3 | Req 7, 8 | §164.312(a) | A.5.15, A.8.5 |
| Encryption at rest | CC6.7 | Req 3.4-3.5 | §164.312(a)(2)(iv) | A.8.24 |
| Encryption in transit | CC6.7 | Req 4.1 | §164.312(e)(1) | A.8.24 |
| Audit logging | CC7.2 | Req 10 | §164.312(b) | A.8.15, A.8.16 |
| Change management | CC8.1 | Req 6.5 | §164.308(a)(5)(ii)(C) | A.8.25, A.8.32 |
| Vulnerability management | CC7.1 | Req 6.3, 11 | §164.308(a)(1)(ii)(B) | A.8.8 |
| Incident response | CC7.3-7.5 | Req 12.10 | §164.308(a)(6) | A.5.24-5.28 |
| Risk assessment | CC3.1-3.4 | Req 12.2 | §164.308(a)(1)(ii)(A) | A.5.1, Clause 6 |
| Security awareness | CC1.4 | Req 12.6 | §164.308(a)(5) | A.6.3 |
| Data classification | CC6.7 | Req 3.2 | §164.308(a)(1)(ii)(A) | A.5.12, A.5.13 |
Efficiency Tip
When implementing controls that span multiple frameworks, prioritize the strictest requirement. For example:
- MFA: PCI-DSS v4.0 Req 8.3.6 requires MFA for all CDE access (strictest) -> satisfies SOC2 CC6.1 and ISO 27001 A.8.5
- Log retention: PCI-DSS Req 10.7 requires 12 months (3 months immediately available) -> typically satisfies SOC2 and ISO 27001
Control Assessment Template
## Control Assessment: [Control ID]
**Framework:** [SOC2 CC6.1 / PCI-DSS Req 3.4 / etc.]
**Requirement:** [Description of what the control requires]
**Status:** [Implemented | Partial | Missing | N/A]
### Evidence
- **Location:** [file:line / config path / infrastructure component]
- **Description:** [What was observed]
- **Last verified:** [YYYY-MM-DD]
### Gaps (if Partial or Missing)
- [ ] Gap 1: [description]
- [ ] Gap 2: [description]
### Remediation
- **Priority:** [Critical | High | Medium | Low]
- **Owner:** [team/individual]
- **Implementation pattern:** [reference to code pattern]
- **Target date:** [YYYY-MM-DD]
### Cross-framework coverage
- Also satisfies: [list other framework requirements]Scoping Guidance
Questions to Determine Scope
- What data do you handle? (cardholder data, ePHI, PII, confidential business data)
- Where does it flow? (ingestion -> processing -> storage -> sharing -> deletion)
- Who has access? (users, admins, third parties, automated systems)
- What infrastructure? (cloud provider, regions, services, network topology)
- What third parties? (subprocessors, SaaS vendors, payment processors)
Scope Reduction Strategies
| Strategy | Applicable to | How |
|---|---|---|
| Tokenization | PCI-DSS | Replace PAN with tokens; CDE scope limited to tokenization service |
| Segmentation | PCI-DSS, SOC2 | Network isolation of in-scope systems from general environment |
| Third-party delegation | PCI-DSS | Use payment processor's hosted payment page (iframe/redirect) |
| Data minimization | All | Don't collect/store data you don't need |
| BAA-eligible services | HIPAA | Use only cloud services covered under BAA |