The problem with vendor crosswalks you can't check
Most compliance platforms ship with a proprietary crosswalk that maps one control to a dozen frameworks. Ask where any individual line comes from and you'll often get no answer.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Compliance automation platforms have made multi-framework programmes far easier to run. Most of them sell a central promise: implement a control once and it satisfies SOC 2, ISO 27001, NIST, HIPAA and more, because the platform's crosswalk says so. Ask the platform where a specific mapping came from, which version it's against and why the two requirements are equivalent, and the answer is often silence.
That's a problem, and not a pedantic one.
Unverifiable mappings move risk to you
When a platform tells you that your access control satisfies a requirement in a framework you're newly subject to, and it's wrong, the audit finding is yours, not the vendor's. You relied on a mapping you couldn't inspect. Auditors don't accept "the tool mapped it" as a justification; they read the requirement and test whether your control meets it.
Mappings go stale silently
Frameworks change. CSF 2.0 withdrew 79 CSF 1.1 subcategories (where they went); ISO 27001:2022 renumbered Annex A; PCI DSS v4.0 added dozens of requirements. A crosswalk that isn't versioned and validated against current catalogues decays. An unlabelled crosswalk decays invisibly.
"Mapped" hides what kind of mapping
A line between two requirements might mean they are equivalent, or that one is a subset of the other, or only that they share a theme. Our own analysis of how much mapping rests on published evidence found that a large share of mappings anywhere are judgement calls, not published crosswalks:
| Framework | Mappings | Crosswalk | Editorial | Crosswalk share |
|---|---|---|---|---|
| NIS2 | 65 | 64 | 1 | 98% |
| ISO 27001 | 105 | 99 | 6 | 94% |
| 800-53 | 120 | 106 | 14 | 88% |
| CMMC | 72 | 60 | 12 | 83% |
| HIPAA | 47 | 36 | 11 | 77% |
| PCI DSS | 95 | 70 | 25 | 74% |
| CIS v8.1 | 163 | 40 | 123 | 25% |
| SOC 2 | 66 | 0 | 66 | 0% |
| GDPR | 34 | 0 | 34 | 0% |
| Essential Eight | 62 | 0 | 62 | 0% |
| All | 829 | 475 | 354 | 57% |
Judgement calls aren't bad. Unlabelled ones are.
What to demand from any crosswalk
- Source per link: an official crosswalk (NIST, ENISA, the framework owner) or the vendor's judgement.
- A reason for every judgement call, visible to you.
- Versions of both frameworks, and a date it was last validated.
- What "mapped" means: equivalent, partial or related.
- Export: the ability to take the mapping out and check it yourself.
If a vendor can't provide these, use their mappings as hints, not answers.
How to test a crosswalk you've been given
You don't need to audit a whole crosswalk to judge it. Sample it:
- Pick ten links at random from the framework you know best.
- Read both requirement texts for each.
- Classify each link: equivalent, partly overlapping, merely related, or wrong.
- Check two version-sensitive cases, for example a CSF 1.1 identifier or an ISO 27001:2013 control number.
If most links hold up and the versions are current, the crosswalk is probably usable as a guide. If several are wrong or stale, treat the whole thing as unverified. Our own data is open to the same test: every requirement page, such as ISO 27001 A.8.8, shows each link's basis and reason.
Key takeaways
- Unverifiable mappings move audit risk onto you.
- Demand source, version, meaning and reasoning for each link.
- Sample-test any crosswalk before relying on it.
Why we publish ours
ControlMapping exists partly because of this problem. Every link is labelled crosswalk or editorial, every editorial link has its reason, every ID is validated against the official catalogue on every build, and the whole dataset is downloadable under an open licence. It's not the only way to do it, but it's the standard we think the industry should hold itself to. See the methodology and the downloads.
Questions
Are compliance platform crosswalks accurate?
Some are carefully maintained; others are not. Without visible sources, versions and reasons for each mapping, you can't tell which, and auditors won't accept 'the tool says so' as justification.
What should a trustworthy crosswalk show?
For each link: the source (an official crosswalk or the vendor's judgement), the versions of both frameworks, what the link means (equivalent or merely related), and a reason when it's a judgement call.
What is NIST OLIR?
NIST's Online Informative References programme: a catalogue of crosswalks between NIST frameworks and other standards. Submissions from third parties are checked for format, not for correctness.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.
Analysis · 2026-09-29HIPAA Security Rule through the NIST CSF 2.0 lensA NIST CSF 2.0 programme maps to almost every HIPAA Security Rule requirement. What carries over, the two that don't, and what CSF adds beyond HIPAA.