Methodology
ControlMapping groups security requirements into 50 topics (Encryption, Multi-Factor Auth, Incident Response, …) and shows which requirement in each framework covers each topic. This page explains where every mapping comes from, so you can judge how far to rely on it.
Reading the glyphs
The same five glyphs mean the same thing on every page. Each carries a label; colour is only a backup.
- Topic definition: NIST CSF 2.0 outcomes that define the topic.
- Crosswalk: a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link.
- Editorial: ControlMapping's judgement where no crosswalk exists; the reason is shown.
- : only shares a CSF 2.0 outcome: worth checking, not a mapping.
- No mapping in our data: nothing mapped in our data; often new work, but check the coverage notes.
A mapping is Crosswalk or Editorial: the two requirements are curated into the same topic, or linked directly. Only mappings count as coverage, in the gap tool, comparisons and counts. is a lead to check, never coverage.
No mapping in our data means nothing is mapped in our data. For most frameworks that is likely new work, but coverage is uneven: CIS v8.1: most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards; SOC 2: SOC 2 links are editorial only; GDPR: only GDPR's security articles are mapped, editorially; Essential Eight: Essential Eight links are editorial only; DORA: DORA links are editorial, and its technical standards are not mapped; CPS 234: CPS 234 is principles-based and its links are editorial; Cyber Essentials: Cyber Essentials covers five technical controls only. Treat no mapping there as "not yet mapped", and check before budgeting.
1. NIST CSF 2.0 is the hub
Each topic is defined by one or more NIST Cybersecurity Framework 2.0 subcategories (for example, Encryption = PR.DS-01 data-at-rest and PR.DS-02 data-in-transit). Choosing those subcategories is our editorial decision, and it's shown on every topic page.
2. Crosswalk vs editorial
For every other framework, each requirement listed against a topic is checked against published crosswalks from NIST's Online Informative References (OLIR) catalogue:
- Crosswalk: a published crosswalk links that requirement to one of the topic's CSF subcategories, either directly or through an SP 800-53 control that is itself linked. The link is shown, e.g. "Crosswalk: PR.DS-01" or "NIST HIPAA map: SC-13".
- Editorial: no published crosswalk makes the link, but we judge it relevant, and the reason is shown. Every GDPR, SOC 2 and Essential Eight mapping is editorial: no openly licensed crosswalk exists for them.
Crosswalks differ in authority. Those by NIST or the framework's owner (CIS for CIS Controls) are the strongest. The PCI DSS crosswalk is PCI SSC's own. The ISO 27001 crosswalks to CSF 2.0 were submitted by independent parties, and NIST doesn't verify non-NIST submissions for correctness. ISO links are also checked against NIST's own 800-53 → ISO 27001 mapping. The table below names each source.
Links through whole 800-53 control families (NIST's older data links some subcategories to every family) are not counted as evidence. A CMMC, HIPAA or ISO link that runs through an SP 800-53 control only counts if that 800-53 control is itself crosswalk-linked to the topic.
Of the 968 requirement mappings outside CSF 2.0, 475 are backed by a crosswalk and 493 are editorial.
3. Requirement-to-requirement relationships
Requirement pages, comparisons, the gap tool and the downloads relate requirements across frameworks. Two requirements are mapped when:
- both are picks in the same ControlMapping topic (curated and validated as above). The link is Crosswalk when both picks are crosswalk-backed in that topic, and Editorial otherwise; or
- a pairwise mapping links them directly: ENISA's NIS2 → ISO 27001 table, NIST's HIPAA → SP 800-53 crosswalk, NIST's SP 800-53 → ISO 27001 mapping, or, for CMMC, NIST's SP 800-171r2 Appendix D and SP 800-171r3 → SP 800-53 references (all Crosswalk). Where no crosswalk exists, a small set of ControlMapping editorial pairs (for example SOC 2 CC4.1 ↔ ISO 27001 Clause 9.2) fills obvious holes; each carries its reason (Editorial).
Otherwise, two requirements that are linked to the same NIST CSF 2.0 subcategory are shown as : they address related outcomes, but one doesn't satisfy the other. These leads are ranked (crosswalk-backed first, then by outcomes shared), capped at 8 per framework on requirement pages, and kept collapsed. Two kinds of link are dropped as noise: links shared only through CSF's generic improvement outcomes (ID.IM), and SP 800-53 "-1" policy-and-procedures controls unless the shared outcome is a policy one (GV.PO).
CMMC practices reach CSF 2.0 through their SP 800-171 Rev 3 counterpart or Appendix D's 800-53 controls, and HIPAA requirements through NIST's HIPAA → SP 800-53 crosswalk. The downloads include every requirement → CSF 2.0 link, so you can check or extend the work.
4. Every ID is validated
The build fails if any requirement ID doesn't exist in its framework's catalogue or has been withdrawn (for example, CSF 1.1 IDs such as ID.BE-01 that were withdrawn in CSF 2.0).
5. Sources and versions
| Framework | Requirement catalogue | Crosswalk used | Mappings (crosswalk) |
|---|---|---|---|
| NIST Cybersecurity Framework 2.0 | NIST CPRT export of CSF 2.0 (incl. withdrawn 1.1 subcategories) | The hub: every topic is defined by CSF 2.0 subcategories | — |
| ISO/IEC 27001:2022 | Annex A control and clause numbers with short titles (the standard's text is ISO's copyright) | ISO/IEC 27001:2022 to CSF 2.0 (OLIR, independent submitters) and NIST's own SP 800-53 Rev 5 to ISO/IEC 27001:2022 mapping | 105 (99) |
| CIS Controls v8.1 | CIS Controls v8.1 safeguards with CIS's titles (CC BY-NC-ND 4.0) | CIS's own CIS Controls v8.1 to CSF 2.0 mapping in OLIR, which covers 49 of 153 safeguards; the rest are editorial | 163 (40) |
| SOC 2 (Trust Services Criteria) | 2017 Trust Services Criteria IDs (revised points of focus 2022) with ControlMapping's own one-line summaries; the criteria text is AICPA's copyright | AICPA publishes TSC mappings (e.g. to NIST 800-53 and ISO 27001), but not under an open licence, so all SOC 2 mappings here are ControlMapping editorial | 66 (0) |
| PCI DSS v4.0.1 | PCI DSS v4.0.1 requirement numbering (checked against the crosswalk) with ControlMapping's own one-line summaries; the requirement text is PCI SSC's copyright | PCI SSC's own PCI DSS v4.0.1 to CSF 2.0 mapping (Board of Advisors), published in NIST's CSF 2.0 informative references | 95 (70) |
| CMMC Level 2 | NIST CPRT export of SP 800-171 Rev 2 (the 110 CMMC Level 2 practices) with DoD's CMMC Level 2 practice names | NIST SP 800-171 Rev 2 Appendix D (→ SP 800-53, Rev 4 IDs carried to Rev 5), plus SP 800-171 Rev 3 → SP 800-53 and CSF 2.0 → 800-171r3 references through the matching Rev 3 requirement | 72 (60) |
| NIST SP 800-53 Rev 5.2 | NIST OSCAL catalogue, SP 800-53 Rev 5.2.0 (incl. withdrawn controls) | NIST CSF 2.0 informative references (800-53 Rev 5.2.0 and 5.1.1) | 120 (106) |
| HIPAA Security Rule | NIST SP 800-66r2 (CPRT): Security Rule standards and implementation specifications. IDs follow NIST's form, which drops the CFR's trailing (1) on standards: §164.310(a) here is §164.310(a)(1) | NIST's HIPAA Security Rule to SP 800-53 Rev 5.1.1 crosswalk (OLIR), via the topic's crosswalk-backed 800-53 controls | 47 (36) |
| GDPR | GDPR articles carrying security obligations (Arts. 5, 24–25, 28–30, 32–35, 37–39) | None exists (GDPR is a privacy law), so all GDPR mappings are editorial | 34 (0) |
| NIS2 Implementing Regulation (EU) 2024/2690 | The 49 requirement points of the Annex to Commission Implementing Regulation (EU) 2024/2690, with ENISA's titles | ENISA's official mapping table (v1.2) from each point to NIST CSF 2.0 and ISO/IEC 27001:2022; normalised (e.g. withdrawn CSF 1.1 IDs moved via NIST's data), and generic ID.IM improvement links used only when nothing else is mapped | 65 (64) |
| ASD Essential Eight | The 126 Information Security Manual controls ASD tags with Essential Eight maturity levels (ISM September 2026, CC BY 4.0), grouped by ASD's eight strategies | None: ASD publishes no Essential Eight/ISM crosswalk to NIST or ISO, so the strategy → CSF 2.0 links and topic mappings are ControlMapping editorial. The control-to-strategy assignment follows ASD's Essential Eight Maturity Model | 62 (0) |
| DORA (Regulation (EU) 2022/2554) | Regulation (EU) 2022/2554 as published in the Official Journal (Publications Office): the 22 articles that bind financial entities, with their paragraph and point text | None exists, so all DORA mappings are editorial, made at paragraph or point level with a reason for each | 93 (0) |
| APRA CPS 234 Information Security | APRA Prudential Standard CPS 234 as registered on the Federal Register of Legislation (F2018L01745, CC BY 4.0): operative paragraphs 13 to 36, with ControlMapping's short titles | None exists, so all CPS 234 mappings are editorial | 35 (0) |
| UK Cyber Essentials (NCSC) | NCSC Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026): the five technical control themes (Crown copyright: names only) | None exists, so all Cyber Essentials mappings are editorial, each naming the specific requirement | 11 (0) |
Source data fetched 2026-10-16; mappings built 2026-10-27.
6. Known gaps
- PCI SSC's CSF mapping omits some core requirements, including the MFA requirements (8.4.x) and most of Requirement 1's network security controls. Where we include those, they're marked editorial.
- CIS's OLIR crosswalk covers only 49 of the 153 CIS v8.1 safeguards, so many CIS mappings are editorial. CIS publishes a fuller mapping behind a download form, which isn't incorporated.
- NIST's HIPAA crosswalk maps to SP 800-53, so a HIPAA requirement counts as crosswalk-backed only when it reaches one of the topic's crosswalk-linked 800-53 controls.
- CMMC Level 2 is SP 800-171 Rev 2. Its official links come from Rev 2's own Appendix D (which names SP 800-53 Rev 4 controls; seven withdrawn in Rev 5 follow NIST's incorporated-into links, and SC-19 for VoIP has no successor) and from the matching Rev 3 requirement. Rev 3 rewrote some requirements, so a Rev 3 link is evidence of the same topic, not identical wording.
- Some topics have no equivalent requirement in a framework. For example, CMMC Level 2 has no recovery-planning practice and CIS v8.1 has no governance safeguard. These gaps are real, not omissions.
7. Not compliance advice
Crosswalks show where frameworks address similar outcomes. They don't prove that meeting one requirement satisfies another. Confirm against the official text of each framework and with your assessor or auditor.