One Control, Many Frameworks:Why a Control Registry Is the Only Way Out of Compliance Sprawl

Adam spent 20 minutes looking for a $36 receipt. His finance team sent three Slack messages. Someone made a sticky note.

Ramp would have matched it automatically the moment he swiped. Auto-coded, in-policy, synced. Nobody had to ask Adam for anything.

This is what finance looks like when it runs itself.

Your team can be Adam. Or they can not be Adam.

Don’t be like Adam

Each edition delivers one clear, evidence-backed idea you can use. This week: How a control registry saves compliance sprawl

The escape route has been documented in peer-reviewed research for years, and it's simpler than most organizations realize: one control, mapped to every framework that requires it. But that approach only holds together if you maintain a control registry. Without it, the mapping exists only in someone's head—and that person will eventually leave.

The foundational problem with multi-framework compliance isn't that the frameworks conflict—it's that they largely agree. Wang et al. (2024) examined seven major compliance frameworks (SOC 2, GDPR, PCI DSS, HIPAA, CIS Controls V8, NIST CSF, and CMMC 2.0) in a peer-reviewed IEEE study and found that the Secure Controls Framework (SCF) could unify all seven into 33 control domains that simultaneously satisfy each framework's requirements. The study concluded that current tools and methodologies predominantly focus on singular compliance standards, leaving organizations without a practical method to interlink compliance efforts across frameworks—a gap that remains directly relevant to every SMB managing multiple obligations today (Wang et al., 2024).

This isn't coincidence. Every major framework emerged from the same underlying threat landscape. Access control, incident response, patching, logging—these aren't NIST inventions or ISO novelties. They're responses to how attackers actually behave. When researchers systematically decompose each framework's control requirements and apply semantic clustering, approximately 60–70% of control objectives across major frameworks address common underlying requirements through different terminological and structural approaches (Patchamatla, 2016). Control rationalization—the systematic consolidation of those overlapping requirements into unified control sets—can reduce duplicative compliance work by 40–75% while preserving full audit traceability (Patchamatla, 2016).

"Control rationalization can reduce duplicative compliance work by 40–75% while preserving full audit traceability." — Patchamatla (2016), Scholars Bulletin

The practical architecture is consistent across every study that has examined it: implement the control once, map it to multiple frameworks, collect evidence once.

This is where the research findings get uncomfortable. Rombaldo Junior et al. (2025) conducted a PRISMA-compliant systematic review of 132 peer-reviewed SME cybersecurity studies published between 2017 and 2024, appearing in the Journal of Cybersecurity. Their three dominant findings: Small and Medium Businesses (SMB) are under-funded, under-staffed, and lack the trained personnel to operationalize even a single framework effectively. The review identified "underfunded and resource-constrained cybersecurity programmes" and "limited literacy in cybersecurity" as primary barriers—not lack of awareness of which frameworks exist, but lack of capacity to run them (Rombaldo Junior et al., 2025).

Large organizations absorb framework proliferation by adding headcount. They hire a GRC analyst, buy a platform, and run parallel compliance workstreams. SMBs can't. When the same IT generalist who manages your firewall is also your compliance owner, asking them to maintain three separate evidence collection processes means none of them will be done well. The irony is that SMBs often face broader framework exposure than large enterprises do. A 30-person SaaS company might carry SOC 2 for enterprise customers, HIPAA for a healthcare integration, and PCI DSS if it processes payments—all simultaneously—each framework assuming organizational capacity that simply doesn't exist at that scale.

Proudfoot et al. (2024) documented this dynamic from the practitioner side in a study published in the European Journal of Information Systems. Their analysis of 22 senior cybersecurity leaders found that organizations operating across multiple regulatory jurisdictions face "more complex analysis and harmonisation efforts," with regulatory response frequently constraining innovation and organizational agility (Proudfoot et al., 2024). For SMBs operating without dedicated compliance staff, those friction costs are disproportionately severe.

The fix isn't a new framework. It's a record-keeping discipline: a control registry.

A control registry is a living inventory of every security and compliance control your organization actually operates. Each entry carries a control ID, a plain-language description, an owner, evidence requirements, a review cadence, and—critically—a column for every framework that control satisfies. When you implement MFA for privileged accounts, that control gets tagged: SOC 2 CC6.1, NIST CSF PR.AC-7, ISO 27001 A.9.4.2. Evidence collected once satisfies all three.

The columns that matter in your registry:

This is exactly the architecture Patchamatla (2016) operationalized in the unified control mapping literature: a control rationalization process that inventories all applicable requirements, clusters semantically equivalent controls across frameworks, defines unified control specifications, and maintains explicit crosswalk documentation back to each source framework for audit traceability. Without that repository, reuse is impossible to sustain across personnel changes, audits, and framework updates.

Building one doesn't require a GRC platform or a six-figure consultant. A well-structured spreadsheet with the right columns gets most SMBs most of the way there.

The barrier most SMBs face isn't conceptual—it's initiation. The controls are already in place. The question is whether they've been named, documented, and mapped.

Start with the framework your most demanding customer or regulator requires. If SOC 2 is the driver, enumerate every trust service criterion and ask: what control do we currently operate that satisfies this? Document the control, assign an owner, note the evidence. Now open the NIST CSF 2.0 mapping to SOC 2 (NIST publishes this crosswalk at no cost) and tag every control you just documented with the corresponding CSF subcategory. That's the first two columns of your registry's framework mapping—built in hours, not weeks.

Proudfoot et al. (2024) found that a common approach organizations use to minimize friction across frameworks is engagement with published regulatory guidance—interpreting what each framework requires and how requirements coincide or conflict, then using that analysis to drive harmonized adoption. A control registry forces exactly that analysis at the ground level, making the harmonization persistent and reusable rather than siloed in a one-time consultant engagement.

The goal isn't mapping everything at once. It's making the registry the source of truth for your compliance posture—the document that says: here are our controls, here is who owns them, and here is exactly how each one satisfies our compliance obligations. When a new framework lands in your lap, you open the registry and find out which gaps are real and which are already covered.

That's the shift research has consistently pointed toward: from reactive compliance theater to persistent, reusable compliance infrastructure—built on the recognition that one control, properly documented and maintained, can carry the weight of many frameworks at once.

Patchamatla, P. S. (2016). Mapping multi-standard compliance controls into unified enterprise risk dashboards. Scholars Bulletin, 2(12), 671–682. https://doi.org/10.21276/sb.2016.2.12.5

Proudfoot, J. G., Cram, W. A., & Madnick, S. (2024). Weathering the storm: Examining how organisations navigate the sea of cybersecurity regulations. European Journal of Information Systems, 34(3), 436–459. https://doi.org/10.1080/0960085X.2024.2345867

Rombaldo Junior, C., Becker, I., & Johnson, S. (2025). Unaware, unfunded, untrained and unsupported: A systematic review of SME cybersecurity. Journal of Cybersecurity, 11(1), 1–31. https://doi.org/10.48550/arXiv.2309.17186

Wang, W., Sadjadi, S. M., & Rishe, N. (2024). A survey of major cybersecurity compliance frameworks. In Proceedings of the 2024 IEEE 4th Cyber Awareness and Research Symposium (CARS). IEEE. https://doi.org/10.1109/CARS65142.2024.10565236