Part II · Chapter 4 · What a control is · lesson 8
Where the two frameworks genuinely disagree
15 min
Builds on One boundary, written twice for two different readers
Part II · Chapter 4 · What a control is · lesson 8
15 min
Builds on One boundary, written twice for two different readers
You can buy a crosswalk between these two frameworks for about the price of a lunch. It is a table with two columns of identifiers and a tick in the middle, it is complete, and it is nearly useless.
Useless because nobody was ever confused about the topics. Both documents have something to say about access, about change, about suppliers. What a practitioner is confused about is what changes when the auditor changes — and that is precisely the column an equivalence table does not have.
Predict
One sentence generates most of the divergence between these two documents, and it is not about security at all.
One of them describes a management system: a thing that is supposed to keep running, check itself, and improve, with obligations about its own upkeep.
The other is an opinion about a period, addressed to the customers of a service, about whether the controls the organisation described were designed properly and operated as described.
From that one difference falls nearly everything. A management system has internal audit, a scheduled leadership review, control over its own paperwork and an enumerated decision about every control it chose not to apply. An opinion about a period has devices for bounding what it covers: a written description, carve-outs, optional categories, and the organisation's own commitments as the yardstick.
Neither list is missing from the other by oversight.
Here is this course's own crosswalk. It is deliberately short — eighteen controls, not a complete mapping — and the third column is the reason it exists. Read a few of the divergences rather than scanning the identifiers.
Where they part company
Identifiers, never titles — look the numbers up in the standards you bought. The column that matters is the third one.
Who still needs what, asked on a clock
One side can be satisfied by a review process that demonstrably exists and is overseen internally; the other turns the same control into a dated population and samples it, so three completed reviews and one skipped quarter is a passing picture in the first case and a deficiency in the second. The practical consequence is that the cadence itself becomes the control under a period examination, and a review done late is a different outcome from a review done.
The day a role changes
The arc is split across a people control and an access control on one side and collapsed into a single criterion on the other, and the mover falls through differently in each. Split across two domains, nobody obviously owns the transfer; collapsed into one, the transfer is in scope but indistinguishable from a joiner, so an auditor's sample almost never contains the case that actually fails.
Standing admin rights versus borrowed ones
Privileged access is a control with its own identifier on one side and has no criterion of its own on the other, which changes where a weakness becomes visible. Named, its absence is a hole in the register that somebody has to justify in writing; unnamed, the subject is only as sharp as the individual auditor's interest in it, and two examinations of the same company can reasonably differ.
Who is allowed to wave through their own change
The scopes are different sizes and the difference is not in the wording but in what auditors habitually ask for. One reaches any change to the processing environment, which includes a network rule or a reassignment of duties; the other is in practice read as the deployment pipeline, so the changes made outside that pipeline are simultaneously the riskiest and the least likely to be tested by either.
What happens between writing code and it running
This is the widest gap in the whole mapping. One side names a development lifecycle and coding practice as separate controls; the other has no development criterion at all and reaches the subject only sideways through change management. A software company can therefore hold a clean report on the criteria side without anyone ever asking how its code is written or reviewed.
What you kept, not what you emitted
One framing is production and protection of the records, which complete logs nobody reads will satisfy; the other is detection, where logs nobody looked at are weak evidence however complete they are. Neither names a retention period, so the number is always yours to defend, and the two framings disagree about whether an unmonitored archive is a control or a liability.
The alert someone actually answers
Detection and the evaluation of what was detected are one control on the management-system side and two criteria on the other, so the same alert history gets tested once there and twice here. The consequence is asymmetric: a gap in triage records is survivable where monitoring is a technological control and shows up from two directions where response is separately criterion-bound.
The moment it becomes an incident
The duty to tell anybody outside the organisation comes from different places. On the management-system side it lives largely in law and contract rather than in the standard; on the criteria side the organisation's own written description of its commitments becomes part of what is examined, so a notification promise the company wrote for itself is tested against it. A certificate's scope statement does nothing comparable.
The parts of your system other people run
Only one side has a carve-out. A subservice organisation can be excluded from the examination, which narrows what the opinion covers and formally moves the reader's work onto the vendor's own report; there is no equivalent device on the certification side, where the supplier relationship stays inside your controls and any limitation has to be expressed in the scope statement instead. Two companies with identical vendor stacks can therefore produce documents covering very different amounts of ground.
The restore you have not tried
On one side this is an annex control, and leaving it out takes a written applicability decision somebody signs; on the other it sits in a category the organisation chooses whether to include at all. An examination scoped to security alone tests no backup and no restore, so a clean report is entirely compatible with never having read an archive back.
The method, not the spreadsheet
One side makes the assessment produce an enumerated applicability document covering every annex control, which is the artefact the certificate leans on; the other evidences risk assessment as a process and produces no comparable register, so the control population is whatever the organisation describes. Also, these clauses are not annex controls and cannot be excluded on applicability grounds the way an annex control can.
The boundary of the thing you are protecting
The inventory is an object with per-entry ownership on one side and a means to an end on the other. Where it is a control, completeness is testable directly and an owner field with a team name in it is a finding; where it only exists to bound logical access, an omitted asset surfaces only if it also broke an access decision, so the same missing row is visible in one examination and invisible in the other.
What encryption does not protect you from
Key management is named inside the control on one side and is not named on the other, where the framing follows data in transmission and movement. The part most likely to be weak in practice, which is who holds and can use the keys, is therefore the part least likely to be asked about on the criteria side, and confidentiality is an optional category there so the area can be out of scope entirely.
The outage you have already agreed to tolerate
The yardstick belongs to different parties. One side assesses readiness against the organisation's own continuity plan and never forms a view on whether the chosen recovery figures are adequate for customers; the other measures against the commitments the organisation published, so an uptime claim made in a sales context becomes an audit criterion. The same architecture can pass one and fail the other on marketing copy alone.
Physical security when there is no building
For a company with no office the two sides land in opposite places. Off-premises assets and remote working keep the laptop-and-home-office case inside your own scope on the management-system side; the criteria side scopes physical protection to the facilities housing the system, so an organisation entirely on managed hosting pushes the question onto the hosting provider's report and the devices people actually carry fall outside it.
What you check before you trust someone
The two sides ask for different artefacts about the same hire. Screening is named as a control bounded by law and proportionality, so the check itself and the reasoning behind its scope are what get requested; the criteria side frames this as competence and commitment of personnel without naming any verification, so the role definition and the onboarding trail usually satisfy it and no background check is examined.
Training that changes what someone does at 4pm
Awareness is tied to competence inside a management system on one side and to internal communication of responsibilities on the other, so the first pulls towards role-appropriate content and the second towards proof that people were told. Neither asks for an effectiveness measure, which means the one artefact that would show whether behaviour changed is the one artefact no examination requests.
What people may do on hardware you do not own
One side names acceptable use as a control, so a register with nothing against it has a visible gap; the other has no acceptable-use criterion and reaches personal devices only through policies the organisation wrote itself, which makes a decision about personal hardware effectively self-graded there and explicitly in scope here.
18 edges and 12 one-sided items. The register behind this is capped and deliberately incomplete; a near-complete ordered table of a licensed standard reproduces its selection and arrangement however original each cell is.
Three of those are worth stopping on, because they are the ones that surprise people holding a clean document.
Development. This is the widest gap in the whole mapping. One side names a development lifecycle and coding practice as controls in their own right. The other has no development criterion at all and reaches the subject only sideways through change management. A software company can therefore hold a clean report on the criteria side without anyone ever asking how its code is written or reviewed.
Backups. On one side this is an annex control, so leaving it out takes a written applicability decision with somebody's name on it. On the other it sits in a category the organisation chooses whether to include. An examination scoped to security alone tests no backup and no restore, which means a clean report is entirely compatible with never having read an archive back.
Suppliers. Only one side has a carve-out. A subservice organisation can be excluded from the examination, which bounds what the opinion covers and hands the reader a second report to chase. There is no equivalent device on the certification side, so the supplier relationship stays inside your controls and any limitation has to be expressed in the scope statement instead. Two companies with identical vendor stacks can produce documents covering very different amounts of ground.
Twelve things exist on one side with no counterpart on the other. This is the list worth more than every equivalence above it, and it is the one no commercial crosswalk includes, because a table of correspondences has no row shape for an absence.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
Auditing yourself before anybody external does
9.2
A management system is expected to check itself on a cycle, which means an internal audit function with findings of its own that the external auditor then reads. The criteria side has monitoring language but nothing that makes the organisation commission an examination of itself, so a company can be entirely dependent on the annual external pass to learn anything.
Leadership sitting down with the whole picture on a schedule
9.3
A scheduled review by the people who control the budget, with a defined set of inputs, is part of the management system itself. Governance criteria on the other side are about the control environment generally and do not produce a recurring meeting with an agenda and minutes that an auditor can ask to see.
An enumerated applicability decision for every annex control
6.1.3
The artefact that lists every control in the annex with a decision and a justification beside it has no counterpart. The criteria side never makes anybody write down what they decided not to do, which removes both the discipline and the paper trail of exclusion.
Keeping a register of the legal and contractual requirements you are subject to
A.5.31
Identifying applicable obligations is a control, so the register is a thing that exists and can be found out of date. On the criteria side obligations enter only through the organisation's own description of its commitments, so an unlisted regulatory requirement is invisible rather than overdue.
Version control over the management system's own documents
7.5
The documents that describe the system are themselves subject to control, which is why a policy with no version and no approval date is a finding. Nothing equivalent exists on the other side: a policy is evidence of design there, and its own provenance is rarely the subject.
Look at what those five have in common. Internal audit, a scheduled leadership review, an enumerated applicability decision, a register of the obligations you are subject to, and version control over the system's own documents. Not one of them is a security control. Every one of them is an obligation about the management system's own upkeep — which is exactly what you would predict from a document that describes a system meant to keep running, and exactly what you would not expect from a document that reports on a period.
Only on one side
Almost all of this is structural rather than an oversight. One document is a management system and the other is an opinion about a period, and that single difference generates most of the list.
The written description of the service that the opinion attaches to
structural — no single identifier
The organisation writes a narrative of how the system works and the auditor opines on whether it is fairly presented. A certificate has a scope statement, which is a sentence, not a description, and nobody forms an opinion on its accuracy in the same way. This is the single largest structural difference between the two documents.
Your own commitments to customers used as the measuring stick
structural — no single identifier
What the organisation promised becomes part of what is tested, so a stronger promise makes the examination harder. Certification measures against the standard, which is the same standard for everybody, so a company cannot make its own audit harder by promising more and cannot make it easier by promising less.
Controls the customer has to operate for yours to work
structural — no single identifier
The report formally names things the reader has to do at their end, which is a mechanism for saying out loud that a control is only half yours. There is no device for this on the certification side, so a shared responsibility either lives inside your controls or lives nowhere.
Choosing whether whole subject areas are examined at all
structural — no single identifier
Availability, confidentiality, processing integrity and privacy are categories an organisation opts into, so a report can be silent on backups or on data handling by design rather than by omission. Dropping a whole domain on the certification side takes a written applicability decision per control, which is a different kind of silence.
Carving a supplier out of the examination
structural — no single identifier
A subservice organisation can be excluded, which bounds the opinion and hands the reader a second report to chase. The certification side has no carve-out at all, so the supplier stays inside your controls and the only lever is the scope statement.
Whether processing is complete, accurate and timely
PI1.1
An entire category concerns whether the system processes what it was given correctly, which is a quality question rather than a security one. The management-system standard for information security has no processing-accuracy domain; that subject belongs to a different standard entirely, so there is nothing to map it to.
An opinion about a period rather than a point in time
structural — no single identifier
Operating effectiveness over a window means each control has a population and a missed instance is a deficiency. Certification samples around a point in time inside a multi-year cycle with surveillance visits, so the same control can be evidenced by its design plus a recent example rather than by every instance in a window.
And these seven are the mirror image. A written description somebody forms an opinion about, your own commitments as the measuring stick, controls the customer has to operate at their end, whole subject areas you opt into, supplier carve-outs, a processing-accuracy category, and the fact of the opinion covering a period at all. Six of the seven are devices for telling a reader what an opinion does and does not cover. The seventh belongs to a different standard entirely.
So the list is not twelve independent facts to memorise. It is one structural difference, observed twelve times, and holding the structure means you can predict most of the list rather than remember it.
Check
A complete ordered table of one standard's identifiers against another's reproduces the selection and arrangement of two licensed documents, however original the prose in each cell. That is a per-table problem rather than a per-string one: any single identifier is a fact, and the complete arrangement is the thing somebody wrote and owns.
There is a pedagogy reason stacked on top of the legal one. A learner handed a complete table stops deciding and starts ticking, and ticking feels enough like progress to pass unnoticed. The register behind this course is capped and the build fails if it grows past the cap, which is a slightly unusual thing to enforce in software and is the most load-bearing constraint in the subject.
So the honest shape is: identifiers only, divergence first, deliberately incomplete, and a recommendation to buy the standards. The crosswalk you actually need covers the controls you run, which is a far shorter list than either document contains.