Largely yes. Write one set of controls in plain language, map each to the frameworks your buyers ask about, and collect evidence once. Overlap is high for access, change management, logging, and vendor management. AI specific risks, such as model provenance and agent permissions, need controls of their own.
Why one set works
Frameworks differ in form but ask similar questions: who can access systems, how changes are reviewed, how incidents are handled, how suppliers are managed. SOC 2 reports are organized around five categories (security, availability, processing integrity, confidentiality, privacy), ISO/IEC 27001 is a management system standard, and NIST's AI RMF is a voluntary framework with four functions: Govern, Map, Measure, and Manage. A control such as "production changes require a reviewed pull request" can satisfy a point in each.
What overlaps and what does not
| Area | Shared across frameworks | Needs AI specific work |
|---|---|---|
| Access control | Yes | Agent and tool permissions |
| Change management | Yes | Model and prompt changes |
| Vulnerability management | Yes | Model file and package provenance |
| Logging | Yes | Prompt and tool call logs |
| Vendor management | Yes | Model provider terms and data use |
| Risk assessment | Yes | AI risks from the NIST Generative AI Profile |
| Data handling | Yes | Training and eval data rules |
How to build it
- Inventory controls you already operate. Write each as one sentence with an owner.
- Tag each control to the frameworks you need now, not all of them.
- Attach evidence once: a screenshot, export, ticket, or log, with a date.
- Add AI controls for the gaps above. NIST's SP 800-218A extends the Secure Software Development Framework with practices for generative AI model development and is a useful checklist.
- Review quarterly and retire stale evidence.
Be honest about status
Mapping is not certification. Do not say you are certified or conformant to a framework unless an independent party has issued that result. An audit in progress is described as in progress.
Try it yourself
Open the demo and select one control. Notice how many frameworks it points to and where the gaps are.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard offers compliance and evidence automation with framework mapping. Try a free scan at gold.safeguard.sh/scan.
Quick check
Should we start with SOC 2 or ISO 27001?
Follow what your first buyers ask for. See reading the buyer request.
Is the NIST AI RMF something you certify against?
No. NIST describes it as voluntary.
Sources
Last reviewed: 19 October 2026.
