One control. Every framework it satisfies.

Controls are modeled independently of frameworks; frameworks are citation lists pointing at controls, not separate control sets.

One control — "multi-factor authentication enforced for all privileged access" — carries citations to NIS2 Art. 21(2)(j), DORA's ICT risk chapter, ISO 27001 Annex A, NIST CSF 2.0's Protect function, NIST SP 800-53 IA-2, and SOC 2's security criteria simultaneously. One piece of evidence satisfies all six.