Comparison
Essential Eight vs NIST CSF 2.0: Australia's baseline in global terms
NIST Cybersecurity Framework 2.0 · ASD Essential Eight · data 2026-10-27
Australian organisations that report to overseas parents or boards often need to express their Essential Eight posture in NIST CSF 2.0 terms, and international organisations entering Australian government supply chains need the reverse. The two sit at different levels: CSF describes outcomes across governance and the whole incident lifecycle; the Essential Eight prescribes eight technical strategies, each measured at Maturity Levels One to Three through ASD's ISM controls.
Going from CSF to the Essential Eight, every E8 control is mapped or loosely related, mostly through CSF's platform security, identity and data-protection outcomes. As with ISO, many matches are only loosely related: CSF won't tell you that Office macros from the internet must be blocked, or that application control must cover drivers at ML3.
Going from the Essential Eight to CSF, most CSF outcomes are unmatched, particularly the Govern function (risk strategy, policy, oversight, supply-chain risk) and much of Identify, Detect, Respond and Recover beyond logging, incident reporting and backups.
ASD publishes no crosswalk to NIST, so the Essential Eight side of this comparison is ControlMapping's editorial mapping, by strategy.
Key takeaways
- Report Essential Eight maturity inside a CSF profile: it maps mainly to the Protect function.
- CSF → E8: treat each strategy's ML2 controls as specific implementation requirements under the matching CSF outcomes.
- E8 → CSF: the governance and response outcomes are new work.
Of 126 ASD Essential Eight requirements, 57 map to something in NIST CSF 2.0, 69 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (69)
| Essential Eight | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | ID.RA-01PR.PS-02 | Only shares CSF ID.RA-01, PR.PS-02: related, not a mapping | |
| Patch operating systems · 10 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | ID.RA-01PR.PS-02PR.PS-03 | Only shares CSF ID.RA-01, PR.PS-02, PR.PS-03: related, not a mapping | |
| Multi-factor authentication · 9 | ||||
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | PR.AA-03 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 11 | ||||
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | PR.AA-05 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | PR.PS-05 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | PR.PS-05 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | PR.PS-05 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | PR.PS-05 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | PR.PS-05 | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | PR.PS-01PR.PS-05 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| User application hardening · 13 | ||||
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | PR.PS-01 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | PR.DS-11RC.RP-03 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | PR.DS-11RC.RP-03 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | PR.DS-11RC.RP-03 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | PR.DS-11RC.RP-03 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | PR.DS-11RC.RP-03 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (57)
| Essential Eight | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | ID.AM-01ID.AM-02ID.AM-04+3 | Same topic: Asset Management (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 5 | ||||
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Editorial | PR.PS-02 | Same topic: Patch Management (editorial pick) |
| Multi-factor authentication · 7 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | DE.AE-03PR.PS-04 | Same topic: Logging & Audit (editorial pick) |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | Editorial | PR.AA-03 | Same topic: Multi-Factor Auth (editorial pick) |
| Restrict administrative privileges · 9 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | DE.AE-03PR.PS-04 | Same topic: Logging & Audit (editorial pick) |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | Editorial | PR.AA-05 | Same topic: Privileged Access (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | DE.CM-09PR.PS-05 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | DE.CM-09PR.PS-05 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | DE.CM-09PR.PS-05 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | DE.CM-09PR.PS-05 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | DE.AE-03PR.PS-04 | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | DE.CM-09PR.PS-05 | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | DE.CM-09PR.DS-02PR.PS-05 | Same topic: Endpoint Protection, Email Security (editorial pick) |
| User application hardening · 7 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | DE.AE-03PR.PS-04 | Same topic: Logging & Audit (editorial pick) |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Editorial | PR.PS-01 | Same topic: Secure Config (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | PR.DS-11RC.RP-03 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | PR.DS-11PR.IR-03RC.RP-02+2 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | PR.DS-11RC.RP-03 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | PR.DS-11RC.RP-03 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | PR.DS-11RC.RP-03 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | PR.DS-11RC.RP-03 | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | DE.CM-01DE.CM-03DE.CM-09 | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | RS.CO-02 | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | RS.CO-02 | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | DE.AE-02DE.AE-03DE.AE-04+3 | Same topic: Anomaly Detection, SIEM / SOC (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | DE.AE-03PR.PS-04 | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | ID.IM-04RS.MA-01RS.MA-02+2 | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | DE.AE-03DE.AE-06DE.AE-08+3 | Same topic: SIEM / SOC (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | DE.CM-01DE.CM-03DE.CM-09 | Same topic: Cont. Monitoring (editorial pick) |
Of 106 NIST Cybersecurity Framework 2.0 requirements, 32 map to something in Essential Eight, 1 are only loosely related, and 73 have no mapping in our data.
Likely new work: NIST CSF 2.0 requirements with no mapping to Essential Eight (73)
| NIST CSF 2.0 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Detect (DE) · 3 | ||||
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | No mapping in our data | — | No mapping to Essential Eight in our data. |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | No mapping in our data | — | No mapping to Essential Eight in our data. |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Govern (GV) · 31 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.RR-04 | Cybersecurity is included in human resources practices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-04 | Suppliers are known and prioritized by criticality | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | No mapping in our data | — | No mapping to Essential Eight in our data. |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Identify (ID) · 14 | ||||
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.IM-01 | Improvements are identified from evaluations | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Protect (PR) · 12 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Recover (RC) · 5 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Respond (RS) · 8 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.AN-08 | An incident's magnitude is estimated and validated | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.MA-05 | The criteria for initiating incident recovery are applied | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.MI-01 | Incidents are contained | No mapping in our data | — | No mapping to Essential Eight in our data. |
| RS.MI-02 | Incidents are eradicated | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| NIST CSF 2.0 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Protect (PR) · 1 | ||||
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | ISM-1407ISM-1501ISM-1694+5 | Only shares CSF PR.PS-03: related, not a mapping | |
Mapped (32)
| NIST CSF 2.0 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| Detect (DE) · 8 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Editorial | ISM-1228 | Same topic: Anomaly Detection (editorial pick) |
| DE.AE-03 | Information is correlated from multiple sources | Editorial | ISM-1228ISM-1509ISM-1623+4 | Same topic: SIEM / SOC, Logging & Audit (editorial pick) |
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Editorial | ISM-1228 | Same topic: Anomaly Detection (editorial pick) |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Editorial | ISM-1228ISM-1906 | Same topic: SIEM / SOC (editorial pick) |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Editorial | ISM-1228ISM-1906 | Same topic: SIEM / SOC (editorial pick) |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Editorial | ISM-0109ISM-1906ISM-1907 | Same topic: Cont. Monitoring (editorial pick) |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Editorial | ISM-0109ISM-1906ISM-1907 | Same topic: Cont. Monitoring (editorial pick) |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Editorial | ISM-0109ISM-0843ISM-1228+7 | Same topic: Cont. Monitoring, Endpoint Protection, Anomaly Detection (editorial pick) |
| Identify (ID) · 7 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Protect (PR) · 9 | ||||
| PR.AA-03 | Users, services, and hardware are authenticated | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| PR.PS-01 | Configuration management practices are established and applied | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| Recover (RC) · 3 | ||||
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| Respond (RS) · 5 | ||||
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | ISM-0123ISM-0140 | Same topic: Reporting (editorial pick) |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| RS.MA-02 | Incident reports are triaged and validated | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| RS.MA-03 | Incidents are categorized and prioritized | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| RS.MA-04 | Incidents are escalated or elevated as needed | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
By topic
Both cover (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
Only NIST CSF 2.0 (34):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPIntrusion DetectionForensicsCommunicationMitigationRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.