Crosswalk or judgement? How much framework mapping rests on published evidence
Every compliance tool shows mappings between frameworks. Few tell you which ones come from an official crosswalk and which are somebody's opinion. We counted ours.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Every compliance platform, consultancy spreadsheet and audit tool comes with mappings between frameworks. They rarely say where those mappings come from. Some are copied from official crosswalks; many are somebody's best judgement, done once and never revisited. Both can be useful, but you should know which you are relying on.
ControlMapping labels every link: crosswalk when a published crosswalk supports it, editorial when it's our judgement with a stated reason. Here is the split.
The numbers
| Framework | Mappings | Crosswalk | Editorial | Crosswalk share |
|---|---|---|---|---|
| NIS2 | 65 | 64 | 1 | 98% |
| ISO 27001 | 105 | 99 | 6 | 94% |
| 800-53 | 120 | 106 | 14 | 88% |
| CMMC | 72 | 60 | 12 | 83% |
| HIPAA | 47 | 36 | 11 | 77% |
| PCI DSS | 95 | 70 | 25 | 74% |
| CIS v8.1 | 163 | 40 | 123 | 25% |
| SOC 2 | 66 | 0 | 66 | 0% |
| GDPR | 34 | 0 | 34 | 0% |
| Essential Eight | 62 | 0 | 62 | 0% |
| All | 829 | 475 | 354 | 57% |
Overall, a little over half of our topic mappings are backed by a published crosswalk. The rest are editorial. The split varies enormously by framework.
Why the split varies
Some frameworks have authoritative crosswalks. NIST publishes official references from CSF 2.0 to SP 800-53, and from SP 800-53 to ISO 27001. ENISA, the EU agency, publishes a mapping from every NIS2 Implementing Regulation point to ISO 27001 and CSF 2.0. NIST's SP 800-171 Appendix D maps CMMC's requirements to SP 800-53. Mappings for these frameworks are mostly crosswalk-backed.
Some crosswalks are partial. CIS's own mapping in NIST's catalogue covers only 49 of the 153 CIS safeguards; PCI SSC's mapping to CSF 2.0 omits some core requirements such as the MFA requirements. Everything beyond them is editorial.
Some frameworks have none we can use. No openly licensed crosswalk exists for SOC 2, GDPR or the Essential Eight. Every link for those is editorial, which doesn't make it wrong, but it does make it an opinion you should be able to check.
Why it matters
- Authority differs. A NIST or ENISA crosswalk has been through public comment and is used across the industry. An editorial mapping is one analyst's view. When an auditor asks why you treated two requirements as equivalent, "NIST's mapping says so" is a stronger answer.
- Crosswalks don't prove compliance either. Even an official crosswalk only says that two requirements address related outcomes. It doesn't say your implementation of one meets the other.
- Unlabelled mappings hide mistakes. If you can't tell where a mapping came from, you can't tell when it's wrong. When we audit our own data, the labels are what make errors in editorial mappings quick to find and fix.
Key takeaways
- Only a little over half of our topic mappings rest on a published crosswalk; the rest are editorial judgement.
- The share varies by framework: high for NIST, NIS2 and CMMC, zero for SOC 2, GDPR and the Essential Eight.
- Judgement isn't wrong, but it should be labelled and explained.
- Ask any mapping for its source, version, meaning and reasoning before relying on it.
What to ask of any mapping
- What is the source? An official crosswalk, the framework owner, or someone's judgement?
- Is the reasoning visible? An editorial link should say why.
- Which version? Mappings against superseded versions (CSF 1.1, ISO 27001:2013, PCI DSS v3.2.1) can be badly wrong.
- What does "mapped" mean? Equivalent, partly overlapping, or merely related?
Our methodology names every source and version, every requirement page shows the basis of each link, and the downloads include the evidence column so you can check our work.
Questions
What is a framework crosswalk?
A published mapping between the requirements of two frameworks, such as NIST's mapping of SP 800-53 to ISO 27001. It shows that requirements address related outcomes, not that meeting one satisfies the other.
Why are SOC 2 mappings editorial?
The AICPA publishes mappings from the Trust Services Criteria to other frameworks, but not under an open licence, so ControlMapping can't use them as evidence. Every SOC 2 link is our judgement, with the reason shown.
Are editorial mappings less accurate than crosswalks?
Not necessarily; an expert judgement can be more precise than a broad published crosswalk. The difference is authority and checkability, which is why editorial links should always carry a reason.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.