Controls Harmonization for Multi-Framework Compliance

This project consolidated ISO 27001, ISO 27701, and HITRUST e1 controls into a single harmonized control list while preserving full traceability to every original requirement.

The objective was not just deduplication, but defensible consolidation: identifying when controls were truly equivalent across frameworks despite differences in wording, scope, and granularity.

I standardized control data across frameworks, separated titles and descriptions as distinct signals, and explored lexical similarity before moving to semantic embeddings to better capture conceptual overlap.

The final system used thresholded semantic matching, deterministic one-to-one pairing, and GPT-4o mini for structured adjudication of ambiguous cases, producing audit-friendly merge decisions with rationale.

The pipeline reduced 283 source controls to 233 final harmonized controls, a net reduction of 50 controls while retaining full coverage and original-ID traceability.

The work showed that lexical similarity alone was too brittle for this task, while a hybrid semantic-plus-LLM workflow produced stronger recall without sacrificing consistency or defensibility.

In compliance harmonization, similar wording does not guarantee equivalent obligation, so explainable judgment matters as much as raw similarity scoring.

The strongest design was a hybrid one: deterministic logic for consistency, semantic similarity for recall, and LLM reasoning only where human-style adjudication was actually needed.