The argument
That Control Looks Familiar. Check Its Population.
Control reuse is defensible only when the reused activity actually matches the objective, implementation, population, frequency, ownership, and exception workflow of the claim.
The field pattern
Both teams call their activity “vulnerability management.” One scans external hosts weekly and routes failures to a ticket queue. The other scans container images at build time and blocks releases. A crosswalk maps both to the same control statement, then quietly cites whichever report is easiest to export.
Why it matters
Control Doppelgängers create false reuse. The organization may genuinely operate several useful activities, yet the assessment claim becomes unreliable when similarity of labels replaces comparison of what each activity covers and proves.
A reusable control needs an explicit applicability envelope. Outside that envelope, the implementation should be treated as a variant with its own population, method, owner, exceptions, and evidence—not forced into the same costume.
Questions that expose the Wack
- Do these activities satisfy the same objective for the same kinds of system components?
- Are frequency, method, population source, exclusions, and exception handling materially equivalent?
- Which implementation variants fall outside the central control’s applicability envelope?
- What does each artifact prove independently of the label attached to it?