Security Control Mapping Template

A sanitised portfolio workbook demonstrating a practical control-mapping approach across four frameworks:

• EU Cyber Resilience Act (CRA) readiness themes — Annex I product-security and vulnerability-handling requirements, and Article 14 reporting readiness
• ISO/IEC 27001:2022 Annex A control references
• NIST Cybersecurity Framework 2.0
• SOC 2 Trust Services Criteria

The workbook is a generic example for portfolio and learning purposes. It does not represent a certification, audit report, formal compliance attestation, or any live production environment.

What problem this solves

Small engineering teams — often a single infrastructure/security owner — implement real controls every day: identity, vulnerability management, data protection, backup/DR, incident response, supplier review, secure development, and customer-assurance evidence. Those controls are useful operationally, but they are not always expressed in the framework language that customers, auditors, recruiters, and regulators expect.

This template shows an inventory-first approach:

1. Start from controls and practices that are actually implemented.
2. Map each practice to the narrowest applicable control reference in each framework.
3. Record risk addressed, evidence sensitivity, implementation status, maturity, and limitations.
4. Track gaps honestly rather than overstating compliance.

Contents

File	Description
Security-Control-Mapping_Template_CRA_ISO27001_NISTCSF_SOC2_SANITISED.xlsx	Sanitised control-mapping workbook

Workbook tabs:

• README — purpose, status/maturity definitions, permitted vs prohibited public wording, and evidence-handling rules
• Control-Mapping — 48 example control rows across 10 domains, each mapped to CRA / ISO 27001 / NIST CSF 2.0 / SOC 2, with risk addressed, evidence-sensitivity classification, status, and maturity score
• Summary — live metrics such as control counts, implemented percentage, average maturity, CRA-relevant rows, and public-sensitivity rows
• Gap-Register — illustrative starter gaps commonly identified in small-environment readiness reviews
• Framework-Legend — reference notes for each framework
• Sanitisation-Log — how employer-specific detail was removed, as a reusable sanitisation checklist

Control domains covered

The example workbook covers these control domains:

1. Governance & Policy
2. Product & Secure SDLC
3. SBOM & Vulnerability Management
4. Identity & Access
5. Data Protection & Privacy
6. Infrastructure & Monitoring
7. Incident Response
8. Backup, DR & Resilience
9. Vendor & Third-Party Risk
10. Customer Assurance

How to use it

1. Copy the workbook internally.
2. Replace the example controls with the organisation's actually implemented controls — do not work backwards from a framework checklist.
3. Add internal evidence IDs and file paths in the internal copy only.
4. Validate framework references against the current published framework materials.
5. Set Status and Maturity honestly; overstated maturity fails the first audit question.
6. Track missing controls in the Gap-Register with owners, due dates, and treatment decisions.
7. Review the mapping quarterly or after a material environment, product, regulatory, or supplier change.

Method notes

• Inventory first. Every row begins from an operating control, not from a theoretical framework requirement.
• Map to the most specific control. Use the narrowest applicable ISO Annex A control(s) and NIST CSF 2.0 category; reference CRA only where a practice supports a CRA readiness theme.
• Qualify scope honestly. Partial entries are part of the method, not a defect. For example, SIEM readiness is different from 24/7 monitored SOC operation.
• Separate evidence from mapping. The mapping method can be public; internal evidence paths, findings, system names, vendor details, incidents, and security posture must stay private.
• Use gap tracking. Missing or partial controls should be recorded with risk, treatment decision, owner, and target date.

Safe wording

Appropriate wording:

• Control mapping
• Readiness mapping
• Evidence organisation
• Framework alignment
• Gap tracking
• Internal security-readiness artefact

Avoid wording such as:

• ISO 27001 certified
• ISO 27001 compliant
• SOC 2 compliant
• SOC 2 audited
• NIST compliant
• CRA compliant
• Implemented an ISMS
• Formal compliance attestation

Important disclaimer

This workbook is a sanitised template. It does not disclose employer-specific security posture, customer data, internal systems, incidents, vendor contracts, production architecture, confidential findings, or internal evidence.

It should be read as a control-mapping and evidence-organisation example only. It does not claim ISO 27001 certification, SOC 2 attestation, NIST compliance, or CRA conformity for any organisation.

Framework references

• ISO/IEC 27001:2022 — Annex A control numbers referenced only. The standard text is not reproduced and must be obtained from ISO.
• NIST Cybersecurity Framework 2.0 — publicly available from NIST.
• SOC 2 Trust Services Criteria — published by AICPA.
• EU Cyber Resilience Act — Article 14 reporting obligations apply from 11 September 2026; main conformity obligations apply from 11 December 2027.

---

Part of a personal technical portfolio. Related: sbom-lab — applied SBOM analysis, Dependency-Track deployment, and CRA vulnerability-handling readiness.