Precept
Book a demo

What a second framework costs you, in controls.

Buyers ask what the next framework costs. The honest answer is mostly “less than you think”. Here is the count, pair by pair, and the part that doesn’t carry.

Every control against every framework.

The Survey view from a real-shaped workspace: 118 controls down the side, ten frameworks across the top. A brass mark means the control answers that framework. Pick a row to see every clause it maps to.

Harrow Freight/Survey
24 of 118 controls · 10 frameworks
Controls against frameworks. Choose a control to list the framework clauses it answers.
ControlNameSOC 22700142001CSF800-53PCIHIPAAGDPRFedRAMPDORA
Access control policy
Multi-factor sign-in for all staff
Quarterly access review
Answers 8 clauses in 7 frameworks
  • SOC 2CC6.2
  • SOC 2CC6.3
  • ISO 27001A.5.18
  • NIST CSF 2.0PR.AA-05
  • NIST 800-53AC-2
  • PCI DSS 4.0.17.2.4
  • HIPAA164.308(a)(4)
  • FedRAMP ModerateAC-2(3)
Privileged access in AWS
Depot handheld device access
Security awareness training
Background checks for new hires
Leaver access removed in two days
Change management policy
Production changes approved before merge
Infrastructure defined in code
Encryption at rest
Encryption in transit
Laptop disk encryption
Vulnerability scanning
Critical patches within 14 days
Security logging retained one year
Incident response plan tested
Backup restore tested quarterly
Vendor security review
Annual risk assessment
Customer data retention schedule
Finance system access segregated
Route-planning model inventory

Harrow Freight workspace, sample of 24 of 118 controls. Brass: mapped. Blank: not in scope.

Same control, read in each framework’s words.

Each framework describes the same practice differently. Precept keeps your wording on the left and every clause it answers on the right, so you can check the mapping instead of trusting it.

Harrow Freight · Control libraryYour wording
PC-AC-04

Quarterly access review

Production system access is reviewed every quarter by the system owner, and revoked within two working days of a finding.

Owner
Marcus Bell, IT Operations Lead
Written
Once
Last reviewed
14 July 2026
14
Crosswalk 2026.3Eight clauses, seven frameworks
  1. SOC 2CC6.2

    The entity is to register and authorise each user, internal or external, before system credentials are issued, and to withdraw those credentials once the user’s access ceases to be authorised.

  2. SOC 2CC6.3

    Access to data, software and system functions is to be granted, altered or withdrawn by reference to role and responsibility, with regard to least privilege and the separation of incompatible duties.

  3. ISO 27001A.5.18

    Rights of access to information and associated assets shall be provisioned, reviewed at intervals, amended and revoked in accordance with the organisation’s rules for access control.

  4. NIST CSF 2.0PR.AA-05

    Permissions, entitlements and authorisations are to be set out in policy and thereafter managed, enforced and periodically reviewed, consistent with least privilege and separation of duties.

  5. NIST 800-53AC-2

    The organisation shall manage system accounts throughout their life, defining account types, assigning account managers and approving access, and shall review accounts for compliance at a frequency it defines.

  6. PCI DSS 4.0.17.2.4

    User accounts and their associated privileges, third-party accounts included, shall be reviewed no less than once in every six-month period; inappropriate access is to be remediated and management’s acknowledgement of the outcome recorded.

    Intervals differPCI 6 months · yours 3 months

    The stricter interval wins, and yours is the stricter one, so this clause is answered as written. Had the control said “every year”, Precept would mark 7.2.4 partly answered and say why.

  7. HIPAA164.308(a)(4)

    A covered entity must adopt policies and procedures for authorising access to electronic protected health information, including the means by which a user’s right of access is established, documented, reviewed and modified.

  8. FedRAMP ModerateAC-2(3)

    Accounts are to be disabled, within the periods the baseline prescribes, once they have expired, are no longer associated with an individual, contravene policy, or have remained inactive beyond the permitted threshold.

Clauses paraphrased by Precept. The standards themselves are the authority.15

PCI asks for every six months; your control says every quarter. The stricter one wins, and Precept flags where it would have lost.

How we count.

Answered
An existing control's evidence satisfies the requirement without changes.
Partly answered
The control is right, but the evidence needs a field, a sample, or a frequency it doesn't have yet.
New
No existing control touches it.

Counts use Precept’s published crosswalk, version 2026.3, reviewed each quarter by our mapping team. Two former auditors sign every change.

Bring your own pair to a demo. We’ll run it against your controls, not ours.

Book a demo