Why we label every mapping "crosswalk" or "editorial"
Every link on this site carries one of two marks. It's a small design decision that does most of the work of making a free mapping trustworthy.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Every mapping on ControlMapping carries one of two marks. Crosswalk means a published crosswalk supports the link: NIST, ENISA, CIS or PCI SSC said these requirements relate. Editorial means it's our judgement, with the reason written down. It's the most important design decision on the site, and it came from a simple observation: most framework mappings in circulation give no way to tell which is which.
The problem it solves
A mapping is a claim: "this requirement relates to that one." Some claims rest on official crosswalks that went through public comment. Others are one analyst's judgement. Both can be right. But when they look identical, every mapping inherits the credibility of the best one, and every error hides among the rest. That's how organisations end up telling auditors that a control "satisfies" a requirement because a tool said so.
What the labels make possible
- You can weigh the evidence. A crosswalk link from NIST's own mapping is strong; an editorial link is a reasoned opinion to check.
- Mistakes become findable. When we audit our own data for errors, the labels and reasons make them quick to locate and fix. An unlabelled crosswalk gives a reviewer nothing to work with.
- Honesty about limits. Some frameworks have no openly licensed crosswalk at all (SOC 2, GDPR, the Essential Eight). Labelling every one of their links editorial tells you that directly, rather than implying an authority that doesn't exist.
Here's what the split looks like today:
| Framework | Mappings | Crosswalk | Editorial | Crosswalk share |
|---|---|---|---|---|
| NIS2 | 65 | 64 | 1 | 98% |
| ISO 27001 | 105 | 99 | 6 | 94% |
| 800-53 | 120 | 106 | 14 | 88% |
| CMMC | 72 | 60 | 12 | 83% |
| HIPAA | 47 | 36 | 11 | 77% |
| PCI DSS | 95 | 70 | 25 | 74% |
| CIS v8.1 | 163 | 40 | 123 | 25% |
| SOC 2 | 66 | 0 | 66 | 0% |
| GDPR | 34 | 0 | 34 | 0% |
| Essential Eight | 62 | 0 | 62 | 0% |
| All | 829 | 475 | 354 | 57% |
Why not publish only crosswalk links?
Because the crosswalks have gaps. CIS's published mapping covers 49 of 153 safeguards; PCI SSC's omits some core requirements; SOC 2 has none we can use. A site that showed only crosswalk links would show SOC 2 as unmapped and most of CIS as missing, which is less useful and, in its own way, misleading. Editorial links fill the gaps, labelled so you know what you're relying on.
The rules behind the labels
- An editorial link always has a reason.
- A link counts as crosswalk only if the crosswalk really supports it: family-level references and chains through editorial links don't count.
- Every requirement ID is validated against the official catalogue on every build.
- "Loosely related" is shown separately and never counted as coverage.
What an editorial link looks like
An editorial link is never just a line between two IDs. Each carries a short reason that anyone can check. For example, SOC 2 CC4.1 (ongoing and separate evaluations of internal control) is linked to ISO 27001 clause 9.2 (internal audit) with the note that both require independent evaluation of whether controls work, through monitoring, internal audit and independent review. A reader who disagrees can see exactly what we assumed and tell us. See it on the CC4.1 requirement page.
Key takeaways
- Labels let you weigh each mapping's evidence.
- Editorial links fill real gaps in published crosswalks, with reasons.
- Every compliance mapping should show its source.
What I'd ask of everyone else
Label your mappings. It costs almost nothing and changes how much anyone can trust them. If you build compliance tools, show the source of each link; if you buy them, ask for it. Our methodology explains every rule, and the downloads include the basis of every mapping so you can check our work, and tell us where we're wrong.
Questions
What does a crosswalk link mean on ControlMapping?
A published crosswalk from an authoritative source (NIST, ENISA, CIS or PCI SSC) supports the link, directly or through an SP 800-53 control that is itself crosswalk-linked.
What does an editorial link mean?
No published crosswalk makes the link, but ControlMapping judges the requirements related; the reason is always shown, so you can check it.
Can I suggest a correction to a mapping?
Yes. Every requirement page has a link explaining how to report a wrong or missing mapping; include the IDs, the framework you expected and your source.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.
Analysis · 2026-09-29HIPAA Security Rule through the NIST CSF 2.0 lensA NIST CSF 2.0 programme maps to almost every HIPAA Security Rule requirement. What carries over, the two that don't, and what CSF adds beyond HIPAA.