Cross-framework mapping

A cross-framework mapping links one OneComply control to one or more controls in other frameworks. It means the same implementation work may support multiple obligations, but it does not automatically mean the target obligation is fully satisfied.

OneComply separates reuse potential from regulatory satisfaction. Dashboard coverage uses weighted mapping strength so related or partial links cannot be counted as complete compliance.

• Equivalent — the implementation is expected to satisfy the target control with the same evidence package.
• Partial — the implementation supports the target control but needs reviewer confirmation or supplemental evidence.
• Related — useful context for reviewers; not treated as direct satisfaction.

• Framework dashboards show weighted reuse potential for active tenant controls only.
• Control Mapping Concierge uses curated source-library crosswalks first, then exact references, normalized codes, and internal mapping references.
• Evidence carry-forward links imported evidence to the accepted control and to non-related mapped controls in the same tenant, with inherited-link notes for audit traceability.
• Exports preserve OneComply IDs, customer aliases, and mapped target references so reviewers can reconcile legacy control IDs.

1. Update the canonical framework control library and bump the framework library version.
2. Run mapping validation tests for duplicate codes, broken references, self-references, duplicate targets, retired phantom prefixes, source-library crosswalks, and CRA extended mappings.
3. Use the framework sync workflow to propagate changed mappedTo arrays to existing tenant controls.
4. Review dashboard overlap after sync. The dashboard uses tenant controls, so a framework that has not been initialized by a tenant is not counted as active coverage.
5. Record regulator/legal interpretation changes separately from engineering reference fixes.

• Broken static mappedTo references fail automated tests.
• External source-library crosswalk targets must resolve to real OneComply controls.
• CRA extended cross-mapping targets must resolve to real OneComply controls.
• Retired phantom prefixes such as DORA-RST, DORA-RCV, and DORA-BCK are blocked from returning.
• Curated external crosswalk matches are labelled separately from weaker internal mapping-reference matches.