Write the control once. See every clause it already answers.
- SOC 296 of 118
- ISO 27001104 of 118
- ISO 4200112 of 118
- NIST CSF 2.088 of 118
- NIST 800-5394 of 118
- PCI DSS 4.0.171 of 118
- HIPAA47 of 118
- GDPR24 of 118
- FedRAMP Moderate92 of 118
- DORA41 of 118
That’s one company’s whole control library. Every brass mark is a requirement in some framework, already answered by a control Harrow Freight wrote once.
Trusted by compliance teams at
- Harrow Freight
- Fernhill Claims
- Kestle Payments
- Albury Mutual
- Corran Health
- Marlowe Rail
- Wexley Labs
- Ostrey Insurance
One control. Eight clauses. One export.
Seven frameworks each ask about access reviews in their own words, and SOC 2 asks twice. Precept doesn’t copy the control eight times. Each clause points at it, and the evidence is attached to the control, so one Okta export answers all eight.
PC-AC-04Production system access is reviewed every by the system owner, and revoked within two working days of a finding.
- SOC 2quarterly
CC6.2 - SOC 2quarterly
CC6.3 - ISO 27001quarterly
A.5.18 - NIST CSF 2.0quarterly
PR.AA-05 - NIST 800-53quarterly
AC-2 - PCI DSS 4.0.1quarterly
7.2.4 - HIPAAquarterly
164.308(a)(4) - FedRAMP Moderatequarterly
AC-2(3)
1 Jul 09:12Attached once. Not copied into seven folders.
Change “quarter” in the control and all eight clauses read the new wording at once. Replace the export and all eight are current again. That’s the whole idea, 118 times over.
That was one column. There are 117 more.
See all five partsNow run it for your own pair.
Pick the framework you have and the one you need. Tie-in counts how much of the second your controls already answer, and says plainly what they don’t.
You already have 71 of ISO 27001’s 93 Annex A controls.
- Answered by evidence you already collect
- 71
- Partly answered: same control, more evidence
- 14
- New to you
- 8
ISO 27001 also asks for a management system (clauses 4 to 10): internal audit, management review, continual improvement. Nothing else maps to those. Budget for them separately; Precept gives you the templates, not a shortcut.
Figures are from Precept’s published crosswalk, version 2026.3. Your own count depends on how your controls are written; on a demo, we run it against your spreadsheet.
Book a demo with this pair- Answered
- 71
- Partly
- 14
- New
- 8
It replaces the spreadsheet and the shared drive. Not the people.
Most teams arrive with a control spreadsheet, a folder per framework, and a tracker of what the auditor asked for. Baseline reads the spreadsheet on day one. Most teams have their first framework mapped within a few weeks and a clean first evidence pass in about nine.
| Row | Your wording | Control | Action |
|---|---|---|---|
12 | Access to prod reviewed each quarter by system owner | PC-AC-04 | New control |
13 | ISO A.5.18 – review of access rights (quarterly) | PC-AC-04 | Merged with row 12 |
27 | Leavers removed from Okta within 2 days | PC-HR-04 | New control |
28 | Termination checklist incl. access (SOC2 CC6.2) | PC-HR-04 | Merged with row 27 |
41 | Laptops encrypted (FileVault / BitLocker) | PC-EP-01 | New control |
58 | Prod changes need PR approval | PC-CM-03 | New control |
- Week 0Spreadsheet imported
- Week 3First framework mapped
- Week 9First clean evidence pass
“Clean” means every in-scope control has current evidence and a named owner. It doesn’t mean the audit is over.
Built for the person answering the requests.
Precept is for companies of 500 to 5,000 people with at least one compliance hire, usually a GRC manager who spends her week answering auditors and customers’ security teams. If nobody at your company owns compliance yet, we’re the wrong tool, and we’ll tell you so on the call.
“The auditor’s evidence request arrived on a Tuesday. I had the answer by Thursday lunch.”
Bring your spreadsheet. We’ll show you what you already have.
A demo is 45 minutes with someone who has run audits. We import a sample of your controls and run Tie-in against them live.
Book a demoYou bring your own auditor. They get a free read-only seat. Why