Cross-framework mapping
Annex A controls mapped to SOC 2 criteria and DPDP obligations, maintained by our compliance team as standards change.
L2PERIMETER / F-01
Home / Platform / Control Library
Control LibraryOne control set. Every framework mapped to it.
ISO 27001:2022, SOC 2 and DPDP requirements are cross-mapped into a single library of controls. Each control knows which requirements it satisfies, so one piece of evidence counts everywhere it should.
control-library / unified map
ISO 27001ControlSOC 2DPDPEvidence
A.5.15Access controlCC6.1, CC6.2S.8(5)MFA + access review
A.5.24Incident management planningCC7.3, CC7.4S.8(6)Breach plan draft
A.5.19Supplier relationshipsCC9.2S.8(2)4 DPAs pending
A.8.13Information backupA1.2S.8(5)Backup logs, 7 days
A.8.15LoggingCC7.2S.8(5)CloudTrail, all regions
A.5.34Privacy and protection of PIIP1.1, P3.1S.5, S.6Consent records missing
1 evidence item for A.5.15 satisfies 4 requirements across 3 frameworks
HOW IT WORKS
Four steps, then it runs on its own.
- 01
Scope
Choose frameworks, entities and systems in scope. The library filters to what applies.
- 02
Tailor
Mark controls applicable or excluded with a justification. The Statement of Applicability writes itself.
- 03
Assign
Give each control an owner and a review cadence. Owners see only what they are responsible for.
- 04
Prove
Link automated checks and manual evidence. Status rolls up to every mapped requirement.
CAPABILITIES
What Control Library does for you.
Statement of Applicability
Generated from your scoping decisions with justifications, version history and approval trail.
Control owners
Every control has a named owner, a backup and a review date. Overdue reviews surface on the owner’s list.
Custom controls
Add client-specific or sector requirements and map them to existing evidence instead of starting over.
Change history
Every status change, exclusion and owner change is recorded with who, when and why.
Readiness by framework
See readiness per framework, per entity and per owner, updated as evidence lands.
IN DETAIL
Framework coverage
ISO 27001:2022
Clauses 4 to 10 of the management system plus all 93 Annex A controls across organisational, people, physical and technological themes. Supports transition from the 2013 edition.
SOC 2
Common Criteria CC1 to CC9 and the additional Availability, Confidentiality, Processing Integrity and Privacy criteria. Prepare for Type I first, then run the observation window for Type II.
DPDP Act, 2023
Readiness for Data Fiduciary duties: notice and consent, reasonable security safeguards, breach intimation, processor contracts, retention and erasure, and Data Principal rights.
QUESTIONS
About Control Library
Who maintains the mappings?
Our compliance team maintains the mappings and publishes changes with release notes. You can review every mapping and override it for your organisation.
Can we import an existing control set?
Yes. Upload a spreadsheet of existing controls and we map them into the library so earlier work is not lost.
Do you support multiple entities?
Level 3 supports multiple legal entities and business units, each with its own scope and shared controls where they overlap.
L6 / DATA CORE
Seal the core.
Connect up to three tools and see exactly where you stand against one framework. Free, read-only, and live in about fifteen minutes.
Start readiness check freePrefer to walk through scope first? Contact us