One control set.
Five frameworks.
Nobody asks you for ISO 27001 alone. A customer wants SOC 2, the regulator wants POPIA, a European partner wants GDPR, and someone in procurement has a NIST spreadsheet. They overlap enormously — so Xee maps your Annex A control set onto all of them and shows you the coverage.
What one control buys you
A worked example: implement access control properly once, and it answers the same question in five places.
| ISO/IEC 27001:2022 | POPIA | SOC 2 | NIST CSF 2.0 | CIS v8.1 | GDPR |
|---|---|---|---|---|---|
| A.5.15 Access control | §19 | CC6.1 | PR.AA | CIS 6 | Art. 32 |
| A.5.34 Privacy & PII | §18–§22 | P1.1 | GV.OC | — | Art. 5 |
| A.8.8 Technical vulnerabilities | §19 | CC7.1 | ID.RA | CIS 7 | Art. 32 |
| A.8.13 Information backup | §19 | A1.2 | PR.DS | CIS 11 | Art. 32 |
| A.8.15 Logging | §19 | CC7.2 | DE.CM | CIS 8 | Art. 32 |
| A.5.24 Incident management | §22 | CC7.4 | RS.MA | CIS 17 | Art. 33 |
Illustrative extract. The full crosswalk covers the applicable set across all 93 Annex A controls, and lives inside the platform against your own control state.
See the gap before the customer does
Coverage bars per framework, calculated from what you've actually implemented — not from what the standard says exists.
- POPIA — the South African obligation, mapped control by control
- SOC 2 — trust services criteria for the customers who ask
- NIST CSF 2.0 — including the new Govern function
- CIS v8.1 — the technical baseline
- GDPR — Article 32 security of processing
Evidence counts more than once
The evidence you attach to an Annex A control carries across every framework that control satisfies. Attach the access review once; it answers CC6.1, PR.AA, CIS 6 and §19 at the same time.
- One evidence library, many answers
- Verified evidence flagged separately from self-attested
- Crosswalk visible on every control page
- Feeds questionnaire auto-answer directly
Where the crosswalk sits in the plans. Framework mapping is included on Growth and Scale. On Free you still get the full 93-control register, the risk register and the Statement of Applicability — the crosswalk is the upgrade.