The cost of assessing framework by framework
Frameworks overlap heavily. Access control, logging, incident response, supplier management and business continuity appear in almost all of them, phrased differently and at different levels of detail. Assess each framework separately and the same control owners are interviewed several times, the same evidence is collected in several formats, and the results disagree with one another because each assessor interpreted the overlap differently.
Harmonise first, then assess
The alternative is to build a single, harmonised control set:
- Select what is in scope — the standards and regulatory packs that genuinely apply.
- Map requirements to common controls — each requirement from each source links to one control in the harmonised set; one control can satisfy many requirements.
- Assess each control once — maturity, implementation status and evidence are recorded against the common control.
- Report back per framework — coverage and gaps for each source framework are derived from the common assessment, not re-assessed.
Done well, this cuts assessment effort substantially and, more importantly, gives one consistent answer to "how compliant are we?" for every audience.
Score more than compliance
A yes/no compliance view does not tell leadership where to invest. A useful assessment records, for each control:
- Maturity against written descriptors, so scores mean the same thing each year.
- Residual risk — what exposure remains given the current state.
- Evidence — what was seen, by whom, and when.
From there, a risk map shows where weak controls meet high-impact risks, and those intersections become the priority actions.
From findings to a roadmap
Findings only matter if they become funded work. Group actions into horizons — quick wins within weeks, short-term projects within months, longer-term programmes — with owners and target dates. Track status over time so the next assessment starts from the roadmap rather than from scratch, and so the board sees progress rather than a new list of gaps.
When a tool helps
Spreadsheets cope with one framework and one assessor. Once you have several frameworks, several assessors and an annual cycle, a purpose-built assessment tool pays for itself. It keeps the mappings, scoring descriptors and evidence in one place, and it produces the board report and roadmap directly from the assessment data.