Comply with multiple regulations without duplication: the control map
Control mapping lets you comply with several regulations without duplicating work. You define each control once and link it to every requirement it meets. If ISO 27001, NIS2, DORA, Spain’s ENS and the GDPR all apply to you, much of what they ask for overlaps. This guide therefore explains how to build the map, with a table of real correspondences and the official references worth using.
In 30 seconds: security regulations share most of their requirements, such as risk, incidents, continuity, suppliers, access and encryption. Instead of running one project per regulation, use control mapping to record which article each control answers. That way, a single piece of evidence serves several audits. However, a correspondence is not an equivalence: each regulation keeps requirements of its own, such as reporting deadlines.
Why compliance work gets duplicated
Most regulated companies answer to more than one regulation. For example, a payment institution falls under DORA and the GDPR. In addition, it may certify against ISO 27001 because its customers ask for it. Similarly, a supplier to the Spanish public sector needs the ENS (Spain’s National Security Framework) and, depending on its activity, NIS2 as well.
If you treat each framework as an isolated project, you document the same control three or four times. Moreover, each version drifts on its own and contradictions appear between policies. The cost is not only the hours: it is also the risk of inconsistencies in front of an auditor.
What control mapping is
Control mapping produces a living table that links your internal controls to the requirements of each regulation. Each row is one of your own controls, for example “quarterly access review”. Each column, in turn, is a regulation, with the article or measure that the control helps to meet.
The key lies in the direction of the link. You do not start from each regulation to create controls; instead, you start from your controls to demonstrate several regulations. That way, you collect evidence once and reuse it everywhere. We explain it in the guide to automated evidence for audits.
How to do control mapping in six steps
- First, define the scope: which regulations apply and to which services, because not all of them cover the whole company.
- Next, choose an anchor framework. ISO 27001 works well because its Annex A holds 93 controls in four themes.
- Then write your controls with verbs and owners, without copying the legal text.
- After that, link each control to the articles of each regulation and state whether coverage is full or partial.
- In addition, flag orphan requirements: those only one regulation asks for, which need a control of their own.
- Finally, give each control its evidence, its frequency and its owner.
The partial-coverage step prevents the most errors. For example, ISO 27001 incident management covers much of NIS2. However, it does not set the reporting deadlines in its Article 23. Nor does it cover DORA’s. That is why good control mapping distinguishes between “covered” and “partly covered”.
Control mapping example: ISO 27001, NIS2, DORA, ENS and GDPR
This control mapping example uses the ten measures in Article 21(2) of the NIS2 Directive as its axis. ISO 27001 references follow the 2022 version and ENS references follow Annex II of Royal Decree 311/2022.
| Capability | ISO 27001:2022 | NIS2 (Art. 21(2)) | DORA | ENS | GDPR |
|---|---|---|---|---|---|
| Policies and risk analysis | 6.1.2, 6.1.3 and A.5.1 | Point (a) | Arts. 6 and 9(4)(a) | org.1 and op.pl.1 | Arts. 24 and 32(2) |
| Incident handling | A.5.24 to A.5.28 | Point (b) and Art. 23 | Arts. 17 and 19 | op.exp.7 | Arts. 33 and 34 |
| Continuity and backups | A.5.29, A.5.30 and A.8.13 | Point (c) | Arts. 11 and 12 | op.cont.2 and mp.info.6 | Art. 32(1)(b) and (c) |
| Supply chain | A.5.19 to A.5.22 | Point (d) | Arts. 28 and 30 | op.ext.1 and op.ext.3 | Art. 28 |
| Development and vulnerabilities | A.8.8 and A.8.25 | Point (e) | Art. 9(4)(e) and (f) | op.exp.4 and mp.sw.1 | Art. 25 |
| Effectiveness assessment | 9.1, 9.2 and A.5.35 | Point (f) | Arts. 6(6), 24 and 25 | Audit under Art. 31 | Art. 32(1)(d) |
| Cyber hygiene and training | A.6.3 | Point (g) | Art. 13(6) | mp.per.3 and mp.per.4 | Art. 39(1)(b) (if there is a DPO) |
| Cryptography | A.8.24 | Point (h) | Art. 9(4)(d) | op.exp.10, mp.com.2 and mp.si.2 | Art. 32(1)(a) |
| Access, people and assets | A.5.9, A.5.15 and A.5.18 | Point (i) | Art. 9(4)(c) | op.exp.1 | Art. 32(4) |
| Multi-factor authentication | A.8.5 | Point (j) | Art. 9(4)(d) | op.acc.5 and op.acc.6 | Art. 32(1) (risk-based) |
Read the table as a starting point, not as a legal equivalence. For example, the GDPR has no control catalogue: its Article 32 asks for measures appropriate to the risk. DORA, by contrast, goes into far more detail in technical standards such as Delegated Regulation (EU) 2024/1774.
Official references so you do not start from scratch
You do not need to invent the correspondences. On 26 June 2025, ENISA published its NIS2 technical implementation guidance. It develops the measures in Implementing Regulation (EU) 2024/2690 for digital providers, such as cloud, data centre and managed service providers. It also brings examples of evidence and a control mapping spreadsheet. That spreadsheet links each requirement to standards and frameworks such as ISO/IEC 27001.
Even if your company falls outside that scope, the guidance shows what a supervisor considers reasonable. Still, ENISA warns that it is not binding and recommends checking with the national authority first. If you come from the public sector, also read our comparison of the ENS and NIS2. And if you already hold ISO 27001, see how to use it as a shortcut to NIS2, GDPR and DORA.
Common mistakes when mapping regulations
- Confusing correspondence with compliance: a ticked cell proves nothing without evidence.
- Copying each regulation’s text as if it were a control, which multiplies the rows.
- Forgetting exclusive requirements, such as DORA’s register of information on ICT third parties.
- Leaving the map frozen while regulations change.
That last point matters in Spain. NIS2 remains untransposed, and the Commission referred Spain to the CJEU in July 2026. In addition, Royal Decree 806/2026 dissolved Parliament and called elections for 29 November. As a result, the law will not arrive in 2026 and Royal Decree-Law 12/2018 still applies. Meanwhile, your control mapping should reflect both texts. You will find more detail in our analysis of the state of NIS2 transposition.
Frequently asked questions
Is there an official control mapping between NIS2 and ISO 27001?
Yes, with caveats. ENISA’s technical guidance of June 2025 includes a correspondence table. Specifically, it links the requirements of Regulation (EU) 2024/2690 to ISO/IEC 27001 and other frameworks. However, it is not binding and it targets digital providers.
Does ISO 27001 cover everything NIS2 requires?
Not entirely. ISO 27001 covers much of the Article 21 measures, but NIS2 adds obligations of its own. They include incident reporting in phases (Article 23) and training for management bodies (Article 20). That is why you should flag them as unpaired requirements.
How often should you review your control mapping?
Review it at least once a year and also whenever a regulation or your scope changes. DORA, for example, requires a review of the ICT risk management framework at least once a year (Article 6(5)). Thus your control mapping stays aligned with your audits.
Does the same map work for the GDPR?
For security, yes: Article 32 asks for appropriate technical and organisational measures, and many overlap with ISO 27001. However, the GDPR goes beyond security. Lawful bases, data subject rights and records of processing need controls of their own.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC builds control mapping into a common model and works out, service by service, which regulations you meet and what is missing. In other words: one control, many regulations. You define the evidence once and reuse it across ISO 27001, NIS2, DORA, the ENS and the GDPR. Moreover, the regulatory clock alerts you before every deadline. The third-party register and incident and notification management also cover the unpaired requirements. See the regulations the platform covers or request a demo.
