Skip to content
Tidebreak Advisory

The Assessment Lens

Mapping one finding to two frameworks at once

Originally posted on LinkedIn. Mirrored here so it reads on its own.

The most underused technique in IT assessment is mapping a single finding to two frameworks at once.

Not "we use CIS Controls" or "we map to NIST CSF." Both, and also the professional conduct rule or regulatory specification the finding actually touches.

A shared attorney drive with standing MSP administrative access is CIS Safeguard 6.8. It is also ABA Model Rule 1.6(c) and 5.3. A managing partner who sees the first mapping understands the control. A managing partner who sees both mappings understands why the finding is the firm's exposure, not the MSP's.

The dual mapping is what turns a security finding into a governance artifact. That is the difference between an IT report and an assessment your partners can read.

#CyberGovernance

All writing