Multi framework compliance: how to map once and comply with ISO 27001, SOC 2, DPDP and GDPR

Companies rarely need just one framework for long. A customer asks for SOC 2, a European client wants ISO 27001, the DPDP Act applies regardless, and a GDPR clause shows up in the next contract. The usual response is to treat each one as a project. Four projects, four folders, often four consultants.

My position: running frameworks as separate programs is the most expensive mistake in compliance, and it is almost always avoidable. Build one set of controls, collect evidence once, and map it to every framework that asks.

I've run ISO 27001 and SOC 2 programs side by side and added DPDP and GDPR on top for the same companies. The overlap is large enough that duplicated work is a choice.

Where they overlap

Access management. ISO 27001 Annex A control 5.18 covers access rights. SOC 2 criteria CC6.2 and CC6.3 cover granting, modifying and removing access. DPDP Rule 6 lists access control among the reasonable security safeguards. GDPR Article 32 requires appropriate technical and organisational measures. One quarterly access review, done properly, is evidence for all four.

Incident management. ISO 27001 controls 5.24 to 5.26 cover planning, assessment and response. SOC 2 CC7.3 to CC7.5 cover evaluating, responding to and recovering from incidents. DPDP Rule 7 and GDPR Article 33 cover breach notification. One incident process can serve all of them.

The same holds for vendor management, change management, logging, encryption, risk assessment, training and backups. Most operational controls appear in every major framework, phrased differently.

Where they differ

Scope. SOC 2 covers the systems behind a service. ISO 27001 covers whatever your ISMS scope says. DPDP and GDPR cover personal data wherever it goes, including spreadsheets in HR.

Deadlines. A personal data breach needs a detailed report to the DPDP Board within 72 hours. GDPR gives you 72 hours to notify a supervisory authority when there's risk to people. CERT-In expects reportable cyber incidents within six hours. The EU Cyber Resilience Act wants an early warning within 24 hours for actively exploited vulnerabilities in products.

Specific obligations. DPDP's parental consent for under 18s, GDPR's EU representative and transfer rules, SOC 2's system description. These have no equivalent elsewhere and need their own tracking.

If your incident response plan has a single line saying "notify authorities as required", you've written the one sentence that guarantees confusion at 2 AM.

Tools that help

Public crosswalks save time. The Secure Controls Framework maps hundreds of laws and standards to a common control set. NIST's Online Informative References catalogue maps standards to NIST frameworks. OSCAL, NIST's open format for control data, lets tools exchange mappings, and it's one of the most requested features on open source GRC trackers for that reason.

Most commercial platforms now advertise cross framework mapping. The test is whether one piece of evidence attached to one control shows up as satisfied under every framework, or whether you end up uploading it four times. Steppe was built around the first model: frameworks are views on one control set, which is also how I'd want a consultant to think.

The compliance industry has historically billed frameworks one at a time, which is a good reason to be suspicious when it tells you the overlap is small.

Build each control once, and make every framework you add after the first one cheaper than the last.