Common controls framework
Also known as: Unified Control Framework (UCF), Integrated Control Framework, Control Mapping Matrix
A common controls framework is a centralized library of security and operational controls designed to satisfy multiple compliance requirements simultaneously. By mapping individual controls to various standards—such as GDPR, HIPAA, or PCI DSS—an organization avoids duplicating effort across different audits. This approach allows a single control activity to provide evidence for several different regulatory obligations.
In practice
During an assessment, a practitioner uses a mapping matrix to identify which single evidence artifact satisfies requirements across multiple frameworks. For example, testing a password policy once can fulfill the access control requirements for both SOC 2 and ISO 27001 simultaneously.