About ControlMapping

Who maintains it

ControlMapping is maintained by Paul Gillet, who has worked in cybersecurity for 20 years. It is the crosswalk Paul wanted to have: free, open, and sourced link by link, so you can see exactly why two requirements are connected and how far to rely on it.

Why it exists

Most organisations answer to more than one security framework, and most framework crosswalks are either locked in a vendor's product or a spreadsheet without sources. ControlMapping is a free, open reference: every link between requirements says where it comes from, so you can judge how far to rely on it.

How the data is checked

• Every requirement ID is validated against the framework's official catalogue on every build; unknown or withdrawn IDs fail the build.
• Links come from published crosswalks by NIST, ENISA, CIS and PCI SSC (labelled crosswalk) or are ControlMapping's editorial judgement, each with a written reason (labelled editorial).

The full method, sources and versions are on the methodology page.

Report a mistake

A form for reporting mistakes is on its way. When it's live, include the requirement ID, the framework you expected it to map to, and your source, such as an official crosswalk or the standard's text.

Not compliance advice

ControlMapping shows how requirements relate. It doesn't tell you whether you comply: check the official text, and your auditor, assessor or regulator.