The case for open, free compliance data

Here is a strange fact about the compliance industry. Tens of thousands of organisations answer to more than one security framework. Each one needs to know how those frameworks relate. And almost every one of them builds or buys that knowledge separately: a consultant's spreadsheet, a platform's proprietary crosswalk, an analyst's weekend. The same mapping, rebuilt again and again, rarely checked, never shared.

The mapping is common knowledge in disguise

Whether ISO 27001's A.8.24 relates to PCI DSS 3.5.1 isn't a trade secret. It's a fact about two published documents, the same for everyone. Treating it as proprietary data creates three problems:

• Duplication. The industry pays for the same work many times over.
• Errors persist. A private mapping is checked by its owner, if anyone. A public one is checked by everyone who uses it.
• No accountability. You can't evaluate a mapping you can't see, so you can't tell a careful one from a careless one. We've written about the problem with crosswalks you can't check.

The public sector already gets it

The most authoritative crosswalks are already free. NIST publishes its CSF 2.0 informative references and its SP 800-53 mappings openly, and runs a catalogue of submitted crosswalks. ENISA published its NIS2 mapping to ISO 27001 and CSF. ASD publishes the ISM, including the Essential Eight controls, under an open licence. These are among the most used compliance documents in the world precisely because anyone can use them.

What open would change

• Tools compete on usability, not data hoarding. The value moves to workflow, evidence and automation, where it belongs.
• Mappings get better faster. Errors reported by users get fixed for everyone.
• Small organisations get the same quality as large ones, without paying for a platform to find out how two frameworks relate.
• Auditors and regulators can check the reasoning behind a mapping instead of taking it on trust.

Where the limits are

Openness has limits. ISO, PCI SSC and the AICPA own their standards' text, and that should be respected: open mapping data can share identifiers, short titles and reasoning without reproducing copyrighted requirements. And free doesn't mean unsourced; open data that hides its provenance is just a different kind of black box.

What good open compliance data needs

Open isn't enough on its own. For mapping data to be genuinely useful as a shared resource, it needs:

• Stable identifiers that match the official catalogues, validated whenever either framework changes.
• Provenance per link: which crosswalk or which judgement, and why.
• Versions of every framework, with withdrawn requirements handled explicitly.
• Machine-readable formats (CSV, spreadsheets, JSON) as well as web pages.
• A clear licence that allows reuse, including commercially, while respecting third-party rights.
• A way to report errors, and a record of corrections.

That's the standard we try to meet. The methodology explains how each item is handled here.

Key takeaways

• Organisations rebuild the same framework mappings privately, again and again.
• The most authoritative crosswalks (NIST, ENISA, ASD) are already free, and they're the most used.
• Open data gets checked and corrected; private mappings decay unseen.
• Openness must respect standards' copyright and always show provenance.
• Free data still needs maintenance: validation against current catalogues on every change.

What we do

ControlMapping's downloads publish the full crosswalk (every topic, requirement link, basis and reason) under CC BY 4.0, with third-party licences respected. The methodology documents every source and rule. It's a small contribution, but it's the model I think compliance data should follow: open, sourced, versioned and free to improve. If you find a mistake, tell us, so it gets fixed for everyone.

Questions

Is ControlMapping's data free to reuse?

Yes. ControlMapping's own work (topic definitions, mapping picks, editorial notes, our summaries) is CC BY 4.0. Third-party material keeps its own licence: NIST content is public domain, CIS titles are CC BY-NC-ND, and ISO, PCI and AICPA text isn't reproduced.

Why aren't all framework crosswalks open?

Some framework owners licence their standards and mappings commercially, and many vendors treat their crosswalks as product differentiation.

Can I use ControlMapping data in a commercial product?

ControlMapping's own work is CC BY 4.0, which allows commercial use with attribution. Third-party material keeps its own licence; for example, CIS safeguard titles are CC BY-NC-ND.