Three Frameworks, Four People, Six Weeks
Vantage Logistics is pursuing three markets at once. It already holds ISO/IEC 27001:2022 certification covering its warehouse platform. A defense subcontractor now requires NIST SP 800-171 compliance with a self-assessment score recorded in SPRS; the subcontractor's statement of work includes repair-history data that the prime marks as CUI, which the platform does not process today. A prospective enterprise customer sent a questionnaire asking for a SOC 2 Type II and, in the same document, 'FedRAMP Moderate equivalence.' The GRC lead proposes maintaining three separate control sets in three spreadsheets so each audience sees exactly what it expects. Engineering has four people assigned to compliance and a change freeze in six weeks.
1. Recommend a primary control framework and explain how the other obligations attach to it. Be explicit about what a crosswalk does and does not buy Vantage.
Read the worked answer
Use one control catalog as the spine and treat the others as overlays with their own scoping.
Primary: ISO/IEC 27001:2022 Annex A with 27002 guidance. It is already certified and independently audited, so the management-system machinery - risk treatment, internal audit, management review, corrective action - exists and is evidenced. Rebuilding that in a second language costs more than it returns.
Overlay 1: NIST SP 800-171 for a defined CUI enclave. This is not a mapping exercise in the sense that matters. A crosswalk shows where requirements overlap; it does not implement them. Where a 800-171 requirement has no ISO equivalent, or has a stricter parameter, Vantage must implement and assess it, then compute the SPRS score from that assessment. Mapping ISO to 800-171 and declaring compliance would be a false statement to the customer and to the government.
Overlay 2: SOC 2 Type II is an attestation, not a control set - scope it to the trust services criteria the customer actually cares about and reuse the same evidence.
One spine, one repository, multiple scoped views. Crosswalks reduce duplicated evidence collection; they never substitute for implementing the requirement.
2. Draft the response to the customer's request for 'FedRAMP Moderate equivalence.'
Read the worked answer
Do not accept the phrase and do not claim to meet it. There is no such status; FedRAMP authorization is granted to a cloud service offering by a federal agency (or through the program's joint path) after assessment by an accredited assessor.
The response should do three things:
- Clarify the underlying need. Ask what the customer must satisfy - is a federal agency requiring this, or is it internal procurement language? The required artifact differs sharply.
- State what Vantage can evidence today: ISO/IEC 27001:2022 certification, a SOC 2 Type II report, and a completed gap analysis against the NIST SP 800-53 Moderate baseline with the open items and their remediation dates.
- Offer a defensible substitute - the gap analysis plus a contractual commitment to a remediation plan - and price the effort honestly if actual authorization is required.
Sending an unsupported equivalence claim is a misrepresentation risk that survives long after the deal closes, and it is the kind of statement that surfaces in the customer's next audit.
3. Evaluate the three-spreadsheet proposal and identify who should approve the resulting control set.
Read the worked answer
Reject it. The failure mode is divergence: a control change is made in one sheet and not the others, so the organization begins making contradictory statements to different audiences about the same safeguard. That is both an audit problem and an integrity problem. Evidence collection also triples, which is unaffordable with four people and a change freeze.
Instead: one control catalog, one crosswalk table mapping requirement IDs across ISO, 800-171, and the SOC 2 criteria, and one evidence repository where each artifact has an ID referenced by every view. Each audience gets a filtered report, not a separate truth.
Approval authority: the GRC lead proposes; the CISO owns the control framework; the system owner is accountable for the controls in their system; and where the framework choice affects the authorization basis, the authorizing official concurs. An analyst or the GRC lead alone cannot approve a control set, because approving it commits the organization to being assessed against it.