A manufacturer with a defence contract, healthcare clients and an enterprise customer demanding attestation can be looking at CMMC, HIPAA and SOC 2 simultaneously. The instinctive response is three workstreams with three owners.

It is the wrong structure, because between 60 and 70 percent of the underlying controls are the same control described in different vocabulary. Access review is access review whether the auditor calls it CC6.2, §164.308(a)(4) or AC-2.

Build the control set once

The first move is to stop organising work by framework and start organising it by control. Build a single control set for your organisation, then map each control to every framework requirement it satisfies.

This inverts the usual project structure. Instead of “what does SOC 2 require”, you ask “what controls does this business need”, and then demonstrate that those controls satisfy each framework. One implementation, one set of evidence, multiple attestations.

Practically, that means a control register with columns for the control, its owner, its evidence source, and one column per framework showing which requirement it maps to. It is unglamorous and it is the single highest-leverage artefact in a multi-framework programme.

The common core

These controls appear in essentially every framework. Build them first, at the highest standard any of your frameworks demands, and roughly two-thirds of your obligations move at once.

• Access control and review — provisioning, least privilege, periodic review, timely revocation on departure
• Multi-factor authentication — phishing-resistant on privileged and remote access
• Logging and monitoring — centralised collection with retention meeting the longest requirement you face
• Vulnerability management — scanning, risk-based prioritisation and documented remediation timelines
• Change management — documented, approved, tested, with an audit trail
• Incident response — written plan, defined roles, tested at least annually
• Backup and recovery — documented objectives, tested restores
• Risk assessment — periodic, documented, with a treatment plan
• Vendor management — due diligence, contracts, ongoing review
• Security awareness training — at hire and annually, with records
• Encryption — at rest and in transit, with key management
• Asset inventory — complete, current, and the foundation for most of the above

Build each to the strictest applicable standard. If CMMC requires a tighter access review cadence than SOC 2, adopt the CMMC cadence everywhere. Maintaining two standards for one control costs more than meeting the higher one.

Sequencing when you have a deadline

The order depends on which constraint binds first.

If a customer contract is at stake: SOC 2 first

SOC 2 is the most flexible framework of the three — you scope which Trust Services Criteria apply and you have latitude in how controls are implemented. It is also usually the fastest to a demonstrable outcome, and the resulting control set covers a large share of what HIPAA and CMMC will later ask for.

Realistic timeline: 6 to 9 months to a Type II report from a standing start, including the observation window. Type I is faster but many buyers now specifically require Type II, so check before optimising for it.

If you handle PHI: HIPAA first, but only just

HIPAA obligations are already live — there is no readiness period, and the Security Rule risk analysis is both the foundational requirement and the most commonly cited deficiency in enforcement actions. Complete the risk analysis first regardless of what else you are doing, because it also feeds directly into SOC 2 and CMMC risk requirements.

Realistic timeline: 3 to 6 months to defensible compliance, assuming reasonable starting hygiene.

If you are in the defence supply chain: CMMC drives everything

CMMC is the least flexible and the most prescriptive, so if it applies, let it set the standard for the common core and treat the others as derived. The scoping decision — specifically whether to build an enclave for controlled unclassified information rather than bringing the whole environment into scope — is the single decision with the largest cost impact in the entire programme. Get it right before implementing anything.

Realistic timeline: 6 to 12 months for Level 2, longer if scope is not reduced.

Automate evidence from the start

Most of the recurring cost of compliance is not implementing controls. It is proving, every cycle, that they operated throughout the period.

Organisations that collect evidence manually spend a substantial multiple of the automated cost on every subsequent cycle, forever. Automating collection during the initial programme — access review exports, change records, patch compliance, training completion, backup test results, all landing in a structured repository continuously — is the difference between year two costing a fraction of year one and year two costing the same as year one.

What to avoid

• Three separate consultants. You will get three control sets, three sets of documentation and three sets of evidence for the same underlying controls.
• Buying a compliance platform before designing the controls. The tool automates evidence for controls you have defined. It cannot tell you what they should be.
• Treating the audit date as the goal. Frameworks require controls to operate over a period. Implementing everything a month before the window starts produces evidence gaps that are visible to any competent auditor.
• Assuming compliance means secure. Every framework is a floor. Plenty of organisations have passed an audit and been compromised the same quarter. Know which residual risks your framework does not address, and document your decision on each.

The short version

Build one control set to the strictest standard you face. Map it to every framework. Automate the evidence from day one. Sequence by whichever deadline binds first, and let the common core carry the rest.

Organisations that do this typically complete their second framework in a third of the time the first took. Organisations that run parallel projects complete the second in about the same time as the first, and pay for it twice.