Crosswalk
Map once. Satisfy many.
We build one control set for your organization and map it to every framework you need — so one piece of evidence answers ISO, NIST, SOC 2 and your customers at the same time.
- 1
Pick your frameworks — the ones your clients, regulators and contracts ask for.
- 2
Build one control set — organized by capability, not by framework.
- 3
Evidence once — every control carries its references, so audits reuse it.
The crosswalk
Each row is a capability area we deliver. Each column shows where that work lands in a framework. Pick a quick view, or switch individual frameworks on and off.
| Capability areaHow we help | ISOISO/IEC 27001:2022 | ISOISO/IEC 42001:2023 | ISOISO/IEC 27701:2025 | ISOISO 22301:2019 | ISACACOBIT 2019 | NISTNIST AI RMF 1.0 | NISTNIST CSF 2.0 | NISTNIST SP 800-53 r5 | CISCIS Controls v8.1 | CSACSA CCM v4.1 | CSACSA AICM v1.1 | AICPASOC 2 (TSC 2017) | PCI SSCPCI DSS v4.0.1 | NIST · DoDNIST SP 800-171 / CMMC L2 | OWASPOWASP LLM Top 10 (2026) | MITREMITRE ATLAS | EUEU AI Act | CanadaPIPEDA | QuébecQuebec Law 25 | AlsoRelated standards & laws |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Governance, policy & rolesGovernance & Compliance Assessments · Policy Development | Cl. 5 · A.5.1–5.4 | Cl. 5 · A.2, A.3 | Cl. 5 · A.3.3–3.4 | Cl. 5 | EDM01 · APO01 | GOVERN 1–2 | GV.OC · GV.RR · GV.PO | PM · XX-1 (e.g. AC-1, AT-1) | — | GRC | GRC-09 · GRC-12 | CC1 · CC2 | Req. 12 | CA | — | — | Art. 16–17 · Art. 26 | 4.1 · 4.8 | s. 3.1–3.2 | ISO/IEC 27014 · ISO/IEC 38500 |
| Risk managementRisk Management Framework Implementation | Cl. 6.1 · 8.2–8.3 | Cl. 6.1 · 8.2–8.4 | Cl. 6.1 · 8.2–8.3 · A.1.2.6 | Cl. 6.1 · 8.2 | EDM03 · APO12 | MAP 1–5 · MEASURE 1–4 · MANAGE 1 | GV.RM · ID.RA | RA · PM-9 | — | GRC | GRC-11 · MDS-06 | CC3 | 12.3 | RA | — | — | Art. 9 | — | s. 3.3 | ISO 31000 · ISO/IEC 27005 · ISO/IEC 23894 · NIST SP 800-30 r1 · FAIR |
| Asset & data inventoryGovernance & Compliance Assessments | A.5.9–5.11 | A.4 | A.1.2.9 · A.2.2.7 · A.3.5 | — | BAI09 | GOVERN 1.6 | ID.AM | CM-8 · PM-5 | 1 · 2 · 3 | DCS · DSP · UEM | DSP-20 · MDS-03 | CC6.1 | 12.5 | CM · MP | — | AML.M0023 · AML.M0025 | — | — | — | NIST IR 8011 Vol. 2 |
| Identity & accessPolicy Development · Assessments | A.5.15–5.18 · A.8.2–8.5 | — | A.3 | — | DSS05.04 | — | PR.AA | AC · IA | 5 · 6 | IAM | IAM-16–18 | CC6.1–6.3 | Req. 7 · 8 | AC · IA | LLM03 | AML.M0019 · AML.M0026 | — | 4.7.3 | s. 10 · s. 20 | NIST SP 800-63-4 |
| Network security & zero trustAssessments · Policy Development | A.8.20–8.22 | — | A.1.4.10 | — | DSS05.02 | — | PR.IR | SC-7 · AC-4 | 12 · 13 | I&S | AIS-11 · AIS-13 | CC6.6 | Req. 1 | SC · AC | — | AML.M0032 | — | — | — | NIST SP 800-207 · NIST SP 800-207A · CISA Zero Trust Maturity Model 2.0 · DoD Zero Trust Reference Architecture |
| Data protection & privacyAssessments · Policy Development | A.5.12–5.14 · A.5.33–5.34 · A.8.10–8.12 · A.8.24 | A.7 | A.1.2–A.1.5 · A.2.2–A.2.5 | — | APO14 | MEASURE 2.10 | PR.DS | SC-8 · SC-28 · MP · PT | 3 | DSP · CEK | DSP-21–24 | C1.1–C1.2 · P1.1–P8.1 · CC6.7 | Req. 3 · 4 | MP · SC | LLM02 | AML.M0012 · AML.T0057 | Art. 4a · Art. 10 | 4.2–4.6 · 4.9 | s. 4–8.1 · s. 12–14 · s. 17 · s. 27–28.1 | ISO/IEC 29100 · ISO/IEC 29151 · NIST Privacy Framework · Ontario PHIPA |
| Secure developmentPolicy Development · Assessments | A.8.25–8.33 | A.6 | A.3 | — | BAI03 | MEASURE 2 | PR.PS-06 | SA-8 · SA-11 · SA-15 | 16 | AIS | AIS-09–10 · AIS-12 · AIS-15 · MDS-01 · MDS-13 | CC8.1 | Req. 6 | SC | LLM01 · LLM10 | AML.M0020 · AML.T0051 | Art. 15 | — | s. 3.3 · s. 9.1 | NIST SSDF (SP 800-218/218A) · ISO/IEC 27034 · OWASP ASVS · OWASP SAMM · OWASP Top 10 |
| Vulnerability & configurationAssessments | A.8.8 · A.8.9 | — | — | — | BAI10 · DSS05.07 | — | ID.RA-01 · PR.PS-01–02 | RA-5 · CM-2 · CM-6 · SI-2 | 4 · 7 | TVM · CCC | TVM-13 · MDS-02 · MDS-07 | CC7.1 | Req. 2 · 6.3 · 11.3 | RA · CM · SI | — | AML.M0016 | — | — | — | NIST SP 800-40 r4 · NIST SP 800-128 |
| Logging, monitoring & detectionIncident Response Planning | A.8.15–8.17 | A.6.2.8 | A.3 | — | DSS05.07 | MEASURE 2.4 · MANAGE 4.1 | DE.CM · DE.AE | AU · SI-4 | 8 · 13 | LOG | LOG-15–16 · MDS-10 | CC7.2 | Req. 10 | AU · SI | — | AML.M0024 | Art. 12 · Art. 19 · Art. 26(6) | — | — | NIST SP 800-92 · NIST SP 800-137 · MITRE ATT&CK |
| Incident responseIncident Response Planning | A.5.24–5.28 | A.8.4 | A.3.11–3.12 | Cl. 8.4 | DSS02 | MANAGE 4.3 | RS | IR | 17 | SEF | MDS-11 | CC7.3–7.5 | 12.10 | IR | — | — | Art. 73 | s. 10.1–10.3 | s. 3.5–3.8 | ISO/IEC 27035-1/-2 · NIST SP 800-61 r3 |
| Business continuity & resilienceIncident Response Planning | A.5.29–5.30 · A.8.13–8.14 | — | A.3 | Cl. 8.2–8.5 | DSS04 | — | RC · PR.IR | CP | 11 | BCR | — | A1 | — | — | LLM06 | AML.M0004 · AML.T0029 | Art. 15(4) | 4.7 | — | ISO/IEC 27031 · NIST SP 800-34 r1 |
| Third-party & supply chainThird-Party Risk Assessment · Software Procurement | A.5.19–5.23 | A.10 | A.1.2.7 · A.2.5.7–5.9 | Cl. 8.1 · 8.3.4 | APO10 | GOVERN 6 | GV.SC | SR · SA-9 | 15 | STA | MDS-09 · MDS-12 | CC9.2 | 12.8 | — | LLM04 · LLM05 | AML.M0014 · AML.T0010 | Art. 25 · Art. 53 | 4.1.3 | s. 17 · s. 18.3 | ISO/IEC 27036 · ISO 28000 · NIST SP 800-161 r1 · SLSA |
| Awareness & trainingSecurity Awareness & Training | Cl. 7.2–7.3 · A.6.3 | Cl. 7.2–7.3 | Cl. 7.2–7.3 | Cl. 7.2–7.3 | APO07 | GOVERN 2.2 | PR.AT | AT | 14 | HRS | HRS-14–15 | CC1.4 | 12.6 | AT | — | AML.M0018 | Art. 4 | 4.1.4 · 4.7.4 | — | NIST SP 800-50 r1 · NIST SP 800-181 r1 (NICE) |
| AI system governance & impactAI Governance | — | A.5 · A.6 · A.8 · A.9 | A.1.2.6 · A.1.3.11 | — | EDM01 | GOVERN · MAP · MEASURE · MANAGE | GV · ID.RA | — | — | — | GRC-10 · GRC-13–15 · MDS-04–05 | — | — | — | LLM07 | AML.M0029 | Art. 5–6 · Art. 14 · Art. 27 | — | s. 3.3 · s. 8.1 · s. 12.1 | ISO/IEC 42005 · ISO/IEC 23894 · ETSI EN 304 223 |
| Audit, assurance & improvementGovernance & Compliance Assessments | Cl. 9 · 10 | Cl. 9 · 10 | Cl. 9 · 10 | Cl. 9 · 10 | MEA01–MEA04 | GOVERN 1.5 | GV.OV · ID.IM | CA | — | A&A | MDS-08 | CC4 | 12.4 | CA | LLM01–LLM10 | AML.M0008 | Art. 43 · Art. 72 | 4.10 | — | ISO 19011 · ISO 37301 · NIST SP 800-53A |
Indicative, high-level alignment using public clause, control, function and requirement identifiers. It is not an official mapping or a certification claim; exact coverage depends on your scope and is confirmed during an engagement. “—” means the framework has no direct equivalent. CSA AICM includes every CSA CCM domain; its column lists only the AI-specific controls it adds. NIST SP 800-171 / CMMC L2 shows requirement families shared by SP 800-171 and CMMC Level 2. MITRE ATLAS shows mitigation (AML.M) and technique (AML.T) IDs. ISO/IEC 27701 “A.3” refers to its shared information security controls. PIPEDA references are Schedule 1 principles unless marked “s.”. Last reviewed October 2026.
Need a different framework?
Tell us what you're held to — we'll show you how it maps.