Control Harmonization Across ISO/IEC 27001, SOC Reports, and PCI DSS: A Position Paper on Evidence Reuse and Multi-Framework Assurance Readiness
Year: 2026
Type: article
Abstract: Organizations increasingly face overlapping assurance and compliance demands across ISO/IEC 27001, SOC reporting, and PCI DSS. In practice, the same underlying controls are often documented, tested, and explained multiple times for different assessors, resulting in duplicated effort, fragmented ownership, inconsistent evidence, and audit fatigue. This position paper argues that control harmonization is feasible and valuable when approached at the level of control objectives, ownership, and evidence governance rather than as a one-to-one clause mapping exercise. It proposes a practitioner-oriented harmonization model centered on unified control objectives, reusable evidence, single accountable ownership, and framework-specific overlays. The paper outlines expected benefits, limitations, and a practical adoption path for organizations seeking to improve assurance readiness while preserving the distinct requirements of each framework.
Author: Kandekar, Nikita
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7154470433
FWCI:
Cites:
Cited by:
Related to: