What are shared controls in compliance?
Glossary
The short answer |
|---|
Shared controls are security controls that are implemented once and mapped to the matching requirements of several compliance frameworks at the same time. For example, enforcing multi-factor authentication can satisfy access requirements in SOC 2, ISO 27001, PCI DSS and HIPAA. The control is operated once, its evidence is collected once, and that evidence is reused for every mapped framework. |
How do shared controls work?
Define a control library: write each control once in plain language, such as all employee laptops have full-disk encryption.
Map to frameworks: link each control to every framework requirement it addresses, using crosswalks.
Collect evidence once: gather proof that the control is operating, ideally automatically.
Report per framework: present the same evidence under each framework’s structure for its auditor.
Track gaps: note requirements that are unique to one framework and need extra controls.
Example: one control mapped to many frameworks
Framework | Requirement that MFA helps satisfy |
|---|---|
SOC 2 | CC6.1, logical access security |
ISO 27001:2022 | Annex A 8.5, secure authentication |
PCI DSS v4.0 | Requirement 8.4, multi-factor authentication |
HIPAA Security Rule | 164.312(d), person or entity authentication |
Why do shared controls matter for startups?
Startups rarely stop at one framework. A US customer asks for SOC 2, a European one asks for ISO 27001 or GDPR evidence, and a healthcare prospect asks about HIPAA. Without shared controls, each framework becomes a separate project with its own spreadsheets and duplicate evidence. With them, a second framework means covering the gaps, not starting again.
How NexusVoid handles it
Aegis, NexusVoid’s compliance automation product, is built on shared controls: one control, many frameworks. It covers SOC 2, ISO 27001, DPDP, GDPR, HIPAA, PCI DSS, NIST CSF, NIST AI RMF and the EU AI Act, with evidence collected automatically from cloud, GitHub, identity and devices and reused across every mapped framework.
Related terms
Compliance automation
Continuous compliance
SOC 2 Type 1 vs Type 2
Security questionnaire
Trust center
Frequently asked questions
What is a control crosswalk?
A crosswalk is a mapping table that shows which requirements in one framework correspond to requirements in another. For example, it might show that a SOC 2 logical access criterion and an ISO 27001 Annex A authentication control cover similar ground. NIST runs the Online Informative References (OLIR) program to publish standardized mappings of this kind against NIST frameworks.
Does a shared control fully satisfy every mapped framework?
Not always. Frameworks overlap heavily but not perfectly. One may require a specific review frequency, documentation or scope that another does not. A good shared-control setup records these differences, so the control meets the strictest version of the requirement and any framework-specific extras are tracked separately rather than assumed.
How much work do shared controls save?
It depends on which frameworks you combine. Frameworks built around similar security practices, such as SOC 2 and ISO 27001, overlap a lot, so the second one mostly means filling gaps and adding framework-specific documentation. Frameworks with narrow scope, such as PCI DSS for card data, add more unique requirements. The savings come from collecting each piece of evidence once.
Do auditors accept evidence from shared controls?
Yes, as long as the evidence meets each framework’s requirements for scope and period. Auditors care that the control operated and that the evidence is reliable, not which tool organized it. Keep clear records of what each piece of evidence demonstrates and for which period, so each auditor can see it applies to their framework.
Adding a second framework and dreading the duplicate work? Book a call at /contact and we will show you where your controls already overlap.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.