Methods, systems, and computer program products for incremental regulatory compliance are provided herein. A computer-implemented method includes obtaining at least one first document indicative of a first set of requirements, at least one second document indicative of a second set of requirements, and a baseline document indicative of one or more security controls currently implemented in a system architecture; performing a document comparison between the at least one first document, the at least one second document, and the baseline document to identify overlapping requirements across the first set and the second set that are not satisfied by the one or more security controls; and recommending at least one additional security control to be implemented in said system architecture for satisfying at least one of the identified overlapping requirements.