Compliance control mapping for utilities: one control, every framework it meets, tested once
Test once, comply with every framework.
See one case, screen by screen ↓A utility that runs a grid and a water system answers to several security frameworks at once: NERC CIP for its bulk electric system, IEC 62443 for its industrial control systems, NIST CSF as the board's yardstick, ISO/IEC 27001 for its certified IT, and a state rule for its water side. They ask for the same things in different words. “Change passwords every 15 calendar months”, “Strength of password-based authentication”, “Identities and credentials are managed” and “Authentication information” all land on one password control.
Yet each audit tests that control again, with its own sample, its own evidence request and its own spreadsheet. At Lumina Utilities, the sample utility in the working solution, four audit programmes ran 612 control tests on 214 controls last season, and the password control alone was tested four times. The mapping lives in a spreadsheet that ages with every new version: the last NIST CSF re-map took 11 weeks with consultants. And a requirement no one mapped to a control stays invisible until an auditor samples it. Under CIP that is a possible violation; under ISO, a nonconformity against the certificate.
Estimated split for one control library and one audit season, in working days, by hand and with the solution. The re-mapping row uses the working solution's own figures: 11 weeks for the last CSF re-map by hand, 2 days for the water rule amendment with agents.
Six agents read the frameworks, map every control, check the evidence and plan one test per control; the GRC lead confirms every link.
Tuesday 13 October 2026 at Lumina Utilities. The audit season is close: ISO 27001 surveillance in November, the IEC 62443 assessment of the Halden Ridge water SCADA in December, the water cyber attestation due 31 December, and the NERC CIP audit on site 18–29 January 2027. Here is what happens to one control, screen by screen, in the working solution.
Rhea owns Lumina's library of 214 controls. Overnight, from 02:10 to 02:31, the agents checked the library against 762 requirements in five frameworks. LUC-IAM-04, password and shared-account management, owned by Sanjay Rao, sits at the centre of the web, linked to 7 requirements in 4 frameworks: three in NERC CIP, two in IEC 62443, one each in NIST CSF and ISO 27001. One link is waiting for her.
“tested once · was 4” · Owner Sanjay Rao · Identity and access · quarterly
The framework reader found that the ISO 27001 Statement of Applicability v2026.2 reworded three controls, so the crosswalk mapper proposed the ISO 27001 A.5.17 link again. Rhea clicks the node and reads the requirement and Lumina's control side by side, with the mapper's reason and the evidence against the requirement: the vault workflow's issue, reset and rotation procedure, on page 5.
Why they match, full: “The Annex A control asks for a management process for authentication information; the control’s vault workflow is that process.”
Nothing counts toward coverage until a person confirms it. Rhea confirms the link, and it is recorded under her name; she can still challenge it later. The other links waiting for her across the library stay in her queue.
“ISO 27001 A.5.17 confirmed · 26 links still waiting across the library”
Rhea presses Trace the evidence. EV-2026-0912, the Keystone Vault password policy and rotation report for 1 Jul–30 Sep 2026, runs out along every link, and each requirement's own parameter is ticked as it lands: length 14 against CIP's 8 with three character types, the oldest password 11 months against 15, lockout after 5 tries with an alert, 23 default accounts changed, 1,284 accounts managed.
“One evidence item, 7 requirements, 4 frameworks · collected once”
In the evidence view, the report's passages carry margin notes. The 37 local accounts on Calder Electric CR-400 relays at six substations support at most 6 characters; they are set to the device maximum under technical feasibility exception TFE-2024-031, which CIP-007-6 R5.5 allows. Of 1,906 evidence items this cycle, 683 satisfy requirements in two or more frameworks, so they are collected once.
CIP-007-6 R5.5: “or the maximum the Cyber Asset supports”, TFE on file
The coverage heatmap shows every family of every framework, sized by its requirements and coloured by how well Lumina's controls cover it: 751 of 762 requirements fully covered, 7 partial and 4 with no control. IEC 62443 FR 1 shows 42 of 44, with SR 1.11 partial and SR 1.13 without a control. The overlap grid shows why testing once works: 179 controls serve both NERC CIP and ISO 27001.
“751 of 762 requirements fully covered · 7 partial · 4 no control”
Gap G-04: the 14 HMI workstations in the Halden Ridge control room alert the SOC after 5 failed logins but do not lock out, because a locked HMI mid-shift would leave the operator blind to the filters and dosing. Elif Demir, the control owner, proposes LUC-IAM-11c: alert on 5 failures in 10 minutes, the SOC calls the shift supervisor within 15 minutes, and lockout comes with the HMI upgrade in March 2027. Daniel accepts it until 31 March 2027.
“Accepted until 31 Mar 2027 · Daniel Mwangi · on the audit trail”
The test planner merges every programme's test of the same control: 214 tests this season, not 612, feeding 426 audit samples across five programmes, with testing from 19 Oct to 13 Nov. T-IAM-04 takes a sample of 60 accounts for 1 Jul–30 Sep 2026 and feeds NERC CIP, IEC 62443, NIST CSF and ISO 27001.
“398 duplicate tests avoided · $1.1M a year, estimated · 398 × 22 h × $125”
Rhea sends the season's plan to Hugo Lindqvist with a note: samples are set to the strictest auditor for each control, and LUC-IAM-04 uses 60 accounts for CIP-007 R5 and the 62443 assessment.
“Signed plans cannot be changed, only revised.”
Hugo signs plan v1. Testing runs from 19 October to 13 November, and each control is tested once for every programme it feeds: the ISO 27001 surveillance audit, the IEC 62443 assessment, the water cyber attestation, the NERC CIP audit and the CSF self-assessment.
“Hugo Lindqvist signed the plan · 214 tests, testing starts 19 Oct”
The same control, seen by the five people who map it, own it, test it and decide its gaps — what their season looked like, and what it looks like now.
Six agents read the frameworks, map every control, check the evidence and plan one test per control; the GRC lead confirms every link.
Reads each framework's text and version into atomic requirements with their parameters: lengths, clocks, counts and scope.
Proposes each control-to-requirement link with a strength, full or partial, and a reason that quotes both texts. Full only when every parameter is met.
Reads each evidence item against every linked requirement's parameters, period and scope, and marks the passages in the margin with page and passage.
Finds requirements with no control or only partial coverage, and drafts each gap with a proposed fix, owner and due date before the audit that tests it.
Builds one test per control with the sample size and period of the strictest auditor among the audits it feeds, scheduled before the first audit.
Checks the publishers of the five frameworks every night, compares a new version or amendment clause by clause with the one in force and queues the changed requirements for re-mapping.
Confirm, sign, accept risk. The agents propose; a named person decides.
Ask about any control, requirement, evidence item or gap, or say what to change. Each answer opens the screen it comes from.
What does the password control satisfy?
LUC-IAM-04 satisfies 7 requirements across 4 frameworks: CIP-007-6 R5.5, R5.6 and R5.7, IEC 62443-3-3 SR 1.5 and SR 1.7, NIST CSF PR.AA-01 and ISO 27001 A.5.17. One evidence item, EV-2026-0912, the Keystone Vault rotation report, meets every parameter: length 14 against 8, oldest password 11 months against 15. The ISO link is waiting for you: the 2026 Statement of Applicability reworded the control.
What would the CIP auditor find today?
Three CIP requirements are not fully covered, and Meridian Reliability Council is on site 18–29 Jan: CIP-003-9 Att. 1 Sec. 6, no control yet for vendor remote access at the 19 low-impact substations; CIP-013-2 R1.2.5, relay firmware arrives without a published hash; CIP-010-4 R1.6, the software source is not recorded for 6 gateway changes.
Why is SR 1.11 only partial at Halden Ridge?
The 14 HMI workstations in the Halden Ridge control room alert after 5 failed logins but do not lock out: a locked HMI mid-shift would leave the operator blind to filters and dosing. Elif Demir proposes a compensating control until the HMI upgrade in March 2027. It needs Daniel Mwangi's decision before the Ardent Assurance assessment on 7 Dec.
How much testing does one plan save?
Last season Lumina ran 612 control tests for four programmes; this season the plan has 214, one per control. That is 398 tests avoided, an estimated $1.1M a year at about 22 hours and $125 an hour per test. Each test uses the strictest sample of the audits it feeds.
13 screens from the working solution, on its sample data. Pick one to see it large.
Mapping, evidence and test rules, and who decides, are settings. Every change is saved as a new version.
| Setting | Default | Choose from |
|---|---|---|
| A person confirms every new link | On, locked | Always on: agents propose, nothing counts toward coverage until confirmed |
| Full only when every parameter is met | On | On · Off — a link that meets the outcome but not a number (length, days, count) is partial |
| Partial links count as gaps | On | On · Off — they appear on the heatmap and in Gaps until fixed or accepted |
| Re-map overnight | On | On · Off — every night at 02:10, and within an hour of a new framework version |
| Maximum evidence age | 92 days | Set in days, for quarterly controls |
| Sample size | 60 | Set in steps of 5; the strictest auditor's rule, at least 25 or 10% of the population |
| One test per control per season | On | On · Off — the test planner merges every programme's test of the same control |
| Security level target, IEC 62443 | SL2 | SL2 · SL3, for the water SCADA zones |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample utility's data · “estimated” = our arithmetic, inputs shown ($1.1M = 398 avoided tests × about 22 hours × $125 an hour, demo inputs to be replaced by your last audit cycle; the working-days split is our estimate) · “typical” = published figures (a $10M settlement for 127 NERC CIP violations, SecurityWeek, 2019). Frameworks named as context: NERC CIP-007-6, CIP-003-9 (effective 1 Apr 2026), IEC 62443-3-3, NIST CSF 2.0, ISO/IEC 27001:2022. Lumina Utilities and the people, auditors, regulators, suppliers, sites and records named on this page are fictional — characters and sample data in the working solution.
Compliance control mapping links each of your security controls to every framework requirement it satisfies, so one control and one piece of evidence can answer several audits. Compliance Control Mapping does it for utilities over NERC CIP, IEC 62443, NIST CSF, ISO 27001 and a state water cyber rule, with each link quoting both texts and saying whether it is full or partial.
Six agents work every night. The framework reader splits each framework into requirements with their parameters, the crosswalk mapper proposes links from your controls, the evidence matcher checks your evidence against each requirement's numbers, period and scope, the gap finder drafts the gaps and the test planner builds one test per control. The Head of Cyber GRC confirms links, the CISO decides gaps and internal audit signs the plan.
Yes, that is the case it is built for. In the working solution, the grid's control centres and substations are in NERC CIP scope, the water treatment works SCADA is assessed against IEC 62443 at security level 2, corporate IT holds the ISO 27001 certificate, NIST CSF is the board's yardstick and the water side answers to a state cyber rule, all from one library of 214 controls.
Each test takes the sample size and period of the strictest auditor among the audits it feeds, and the test planner never lowers a sample below any auditor's minimum. Internal audit signs the plan before testing starts, and a signed plan can only be revised, not changed.
The change watcher checks the publishers every night, compares the new text with the version in force and queues the changed requirements for the crosswalk mapper. In the working solution, the water cyber rule's amendment added 6 requirements and was mapped in 2 days; one had no control and became a gap. A requirement still in an active audit period is never retired.
That is the point of the coverage heatmap. Requirements with only partial coverage or no control appear there and in Gaps, each with what is missing, a proposed fix, an owner, a due date and the audit at risk. Only the CISO can accept risk on a gap, and only with an expiry date.
Yes. The agents read, propose and draft; they never confirm a link, edit evidence, lower a sample or accept risk. Nothing counts toward coverage until a person confirms it, and every proposal and decision is on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents: your framework texts, your control library, a sample of last season's evidence and your audit calendar. It goes live once every quality gate has passed. We will walk you through it on your own controls first.
Audit binders built continuously, not in a 30-day scramble.
1-min demoThird-Party Cyber Risk ManagementEvery supplier answer checked against its evidence before you sign.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoWe'll run Compliance Control Mapping on your own control library, your frameworks and last season's evidence.