Download the crosswalk
The full ControlMapping dataset, free: every topic mapping and every requirement-to-CSF 2.0 link across 14 frameworks. Each row says whether it's backed by a published crosswalk or is our editorial judgement, with the evidence or reason. Version 2026-10-27.
| File | Contents | Size |
|---|---|---|
| controlmapping-topic-mappings.csv | Topic mappings: 1094 rows (topic, framework, requirement, basis, evidence, note) | 227 KB |
| controlmapping-requirements-to-csf.csv | Requirement → CSF 2.0 links: 4233 rows (join on the subcategory to relate any two frameworks) | 441 KB |
| controlmapping-crosswalk.xlsx | Excel workbook: read me, topic × framework matrix, topic mappings, requirement → CSF links, CSF subcategories, sources | 254 KB |
| controlmapping-graph.json | Requirement graph (JSON): 1323 requirements with CSF 2.0 links, topics, full catalogues — the data behind the gap tool | 805 KB |
How to use it
- "Which requirements does topic X map to?": filter topic mappings by topic.
- "What relates ISO A.8.24 to PCI DSS?": in requirements to CSF, find A.8.24's CSF 2.0 subcategories, then the PCI rows with the same subcategories. The gap analysis tool does this for whole frameworks.
- Read the methodology before relying on a row: crosswalks show related outcomes, not equivalence.
Licence
Licence: ControlMapping's own work (topic definitions, mapping picks, editorial notes, SOC 2 criterion summaries) is CC BY 4.0 — credit "ControlMapping (controlmapping.org)".
Third-party material: NIST CSF 2.0, SP 800-53, SP 800-171 and SP 800-66 text and crosswalks are US Government works (public domain). CIS Controls safeguard titles © Center for Internet Security, CC BY-NC-ND 4.0. ISO/IEC 27001, PCI DSS and AICPA TSC: identifiers and short titles/summaries only; the standards' text is not reproduced. DORA (Regulation (EU) 2022/2554) © European Union, reused with acknowledgement. APRA CPS 234 text based on content from the Federal Register of Legislation (https://www.legislation.gov.au), CC BY 4.0. Essential Eight: ISM controls © Commonwealth of Australia (Australian Signals Directorate), CC BY 4.0. NIS2: requirement titles and the NIS2 to CSF 2.0 / ISO 27001 mapping from ENISA's NIS2 Technical Implementation Guidance (© ENISA, reproduced with acknowledgement). UK Cyber Essentials: control names only (Crown copyright). ControlMapping is not affiliated with or endorsed by any standards body or regulator.
Basis "crosswalk" = linked by a published crosswalk (source in the evidence column); "editorial" = ControlMapping's judgement (reason in the note column). Crosswalks show related outcomes, not proof of compliance. Not compliance advice.