Looking to find a reference that maps the various control standards (i.e. HIPAA, PCI-DSS, GLBA, ISO) to each other.

I envision the answer being a spreadsheet that outlines the controls for one standard (say ISO-27002) as row items and the other standards (PCI, HIPAA, GLBA) as columns with the relevant control number:

ISO | Desc                  | PCI | HIPAA | GLBA
A.1   Data Classification    3.2.1   I.8     2.7 
A.2   Asset Management       3.6.1   283.1   7.9


Here are a few examples of what I'm looking for, but something more comprehensive that includes all of the standards:

  • 2
    Sounds like a fine piece of work - I look forward to seeing your output! ;-) Sep 29, 2016 at 15:28
  • What you're looking for is often called a matrix - here's an example.
    – gowenfawr
    Sep 29, 2016 at 16:37
  • @gowenfawr other than being a little out of date this is exactly the type of thing (matrix) I'm looking for. Any idea where to get an updated version?
    – HashHazard
    Sep 29, 2016 at 16:50

1 Answer 1


Are you familiar with the UCF Common Controls Hub at https://commoncontrolshub.com/? It allows you to create an "Authority Documents List" using your example standards and download a spreadsheet that lets you compare them and identify gaps and overlaps. Very cool.

  • Bill is right. The folks at BluePrint systems worked with us to integrate this into their software in under 3 months. Everything you need to develop using the API is absolutely free, and you get a free research account in the Common Controls Hub as well. The developer URL is: developer.unifiedcompliance.com you can try everything online. If you have any questions, sign up in the slack channel (also no cost) and you can ask them there. Nov 28, 2016 at 17:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .