Evidence reuse is an artifact-identity problem before it is a mapping problem.

A compliance team maps SOC 2 CC6.1 to ISO 27001 Annex A 8.2 and concludes the access-review screenshot they already collected for one audit should count for the other. The mapping is usually defensible — both controls ask, in different language, whether access is reviewed on a schedule. The trouble starts one layer down, where nobody wrote down what the screenshot actually is: which system it was taken from, what population it covers, on what date, collected by whom, under what method.

Without that layer, 'this control maps to that control' silently becomes 'this file satisfies that requirement' — a much stronger claim that the crosswalk never made and the artifact was never asked to support. The mapping table is doing double duty as an identity record, and it was never built for that job.

SP 800-53A does not organize assessment around control labels; it organizes around assessment objects — the specific policies, mechanisms, activities, and individuals examined or tested — and requires each one to be described with enough precision that a different assessor could find and re-examine the same object later. That is an identity requirement, not a mapping requirement, and it predates any conversation about reusing evidence across frameworks.

Treat that as the more fundamental layer. A crosswalk connects two requirements. An assessment object's identity — its source system, its scope boundary, its collection date, its collector — is what lets a second assessor decide whether the object they're looking at is the one the first assessor actually tested, or something that merely looks similar.

NIST built the Open Security Controls Assessment Language specifically because control catalogs, system security plans, components, and assessment results kept getting represented as loosely structured documents that different tools and frameworks could not reconcile. OSCAL gives components and assessment results stable, machine-addressable identifiers that exist independent of which catalog cites them — which is a direct, public acknowledgment that framework-to-framework mapping was never going to solve reuse by itself.

The lesson generalizes past OSCAL's specific schema: an evidence platform that wants reuse to survive a second auditor's questions needs the same property — an artifact identity that outlives the label any one framework puts on it, carrying its source, scope, method, and checksum forward regardless of which control number cited it first.

Even with a correct mapping and a well-identified artifact, reuse is a decision with conditions attached, not a permanent grant. The population the artifact covered has to still match the system in scope. The collection period has to still be current under the second framework's own freshness expectations, which are frequently different from the first's. And the reviewer who accepted it the first time made a judgment call that a second reviewer is entitled to re-examine, not inherit blind.

The obvious objection is that this makes reuse sound too expensive to bother with — if every artifact needs this much bookkeeping, why not just collect twice. The answer is that the bookkeeping is a one-time cost per artifact, paid once at collection, while re-collection is a recurring cost paid every audit cycle for every framework. The identity record is what converts a one-time collection into a durable asset instead of a single-use file.