Alright, so I've been dragged into yet another "framework consolidation" project, this time with Hyperproof as the chosen hammer for every compliance nail. The control library is a beast—thousands of items, mapping to multiple frameworks (SOC 2, ISO 27001, GDPR, you name it), and it's a tangled mess.
Everyone's default answer seems to be "just use the auto-mapping features and tags!" which, in my experience, is a fast track to a library that *looks* organized but collapses under any actual use. The search becomes useless, and you end up with duplicate controls because the logic behind the auto-grouping is opaque.
So, what's the *actual* best practice here? I'm skeptical of the usual advice to create a hyper-granular hierarchy or to rely solely on Hyperproof's suggested mappings. In other platforms I've used (looking at you, Marketo and HubSpot), the key was often a brutally simple primary structure with very intentional, limited custom fields for filtering—not a byzantine tag system no one maintains.
How are you all structuring this without creating a taxonomy so complex it requires its own compliance program? Do you lean heavily on the "inheritance" model, or do you keep frameworks completely separate and manually link controls? I've seen both fail spectacularly.
Another tool isn't the answer.