Control
Central logging of production access and changes
Recorded 11 Aug, accepted by Mei L, confirmed by Dana.
Evidence
Log store sources and retention settings
Counts towardnothing yet
Each framework you work to is another view of the same compliance program.
You keep one set of controls with the policies and evidence behind them.
SOC 2 and ISO 27001 ask about the same controls in different words. Kanonik maps them to 17 frameworks.
One control at our sample company, Harbor Ledger, now counts toward three frameworks.
- Dana’s team
Harbor Ledger works to SOC 2 and ISO 27001.
NIST CSF 2.0 is included too, as it is on every plan, so Harbor Ledger has three frameworks to answer to.
- Dana’s AI
The AI drafted a central logging control.
It also proposed how the control maps to each framework’s requirements. Each of those mappings is a draft like any other, checked and approved the same way.
- Sam
Each mapping went to a second person.
The check reads the control against the requirement and asks whether it really addresses it. Dana accepted the mappings. A statement that a control meets a requirement needs a second person, so each one then went to Sam.
- Kanonik
The control now counts toward all three.
Open the control in Kanonik and you’ll see each framework it counts toward, with the requirements it maps to in each one. Standing shows where you are on each framework, today or on any earlier date you pick.
Harbor Ledger’s control for central logging is in its record, with its evidence. Switch a framework on.
SOC 2 is on. The control counts toward CC7.2, fully, and Harbor Ledger’s covered count there includes it.
NIST CSF 2.0 is on. It comes with every plan, and the control counts toward DE.CM-01, fully.
Now switch on ISO/IEC 27001:2022, the way a customer might ask for it next year.
ISO/IEC 27001:2022 is on, and nothing was written again. The control was already in the record, with its evidence and its approval. It counts toward A.8.15 now. It counts partly toward A.8.16, through the NIST reference.
Switched off. The control is still in the record, so nothing is lost. It counts again the moment the framework is back on.
Without its evidence, the control isn’t in place, as far as the record can show. The mappings stay. They stop counting as covered and show as a planned control, which is work still to do.
The evidence is back, and the control is in place again. Its items count as covered.
SOC 2 TSC 2017 (rev. 2022)
not chosen
Switch it on to see which SOC 2 criteria this control counts toward.
CC7.2fully
Monitoring for suspicious activity
recorded link
Covered
- Covered
- Planned control
- Partly
- Open
- Here only
- Unassessed
- N/A
- Items
ISO/IEC 27001:2022
not chosen
Switch it on to see which requirements it counts toward.
A.8.15fully
Control 8.15
recorded link
CoveredA.8.16partly
Control 8.16
crosswalk, via DE.CM-01
Partly covered
- Covered
- Planned control
- Partly
- Open
- Here only
- Unassessed
- N/A
- Items
NIST CSF 2.0
not chosen
Switch it on.
DE.CM-01fully
Networks and network services are monitored
recorded link
CoveredNot recorded yet, so not counted: DE.CM-03 Personnel activity and technology usage are monitored.
- Covered
- Planned control
- Partly
- Open
- Here only
- Unassessed
- N/A
- Items
These are Harbor Ledger’s Standing numbers, taken from Kanonik’s own screens, with sample data. What you see move is the part this one control plays in each. Counts only, because a percentage would say more than the record does.
A requirement counts as covered only once you’ve decided it applies and the control behind it is actually in place. A control that’s mapped but not yet running shows as work still open.
We count it this strictly because an auditor finds the gap you thought was covered.
A second framework starts from the work you’ve already approved.
When a customer asks for ISO 27001 after SOC 2, you don’t write a second program. You ask your AI how your existing controls map to the new requirements. Each mapping it proposes then goes through the same steps as the central logging control above.
Expect plenty of open requirements the first time you look at a framework you haven’t worked on. That’s accurate. Nobody has told Kanonik yet which of that framework’s requirements apply to you, or which controls meet them.