Crosswalk
One framework.
Built from all of yours.
This page is a working sample of the tooling we use to prepare our advisory work.
Built from your obligations, not someone else's template.
Our tooling accepts any source of requirements: ISO and NIST standards, laws and regulations, customer security questionnaires, contract clauses, audit findings and internal policies. It breaks each source into individual requirements, maps them against each other and shows where they overlap, conflict or leave gaps.
We use that mapping to build one framework for your organization. Every requirement you answer to becomes part of a single control set, and each control is traced to its sources, so you implement once and evidence once.
- 1
Bring every source: the standards, regulations, questionnaires and contracts you answer to.
- 2
Build one control set: organized by capability, so each control serves several frameworks.
- 3
Evidence once: every control carries its references, so audits reuse the same evidence.
Sample crosswalk
This sample uses the frameworks clients ask about most. Each row is a capability area; each column shows where that work lands in a framework. Choose a quick view or switch individual frameworks on and off.
| Capability areaHow we help | ISOISO/IEC 27001:2022 | ISOISO/IEC 42001:2023 | ISOISO/IEC 27701:2025 | ISOISO 22301:2019 | ISACACOBIT 2019 | NISTNIST AI RMF 1.0 | NISTNIST CSF 2.0 | NISTNIST SP 800-53 r5 | CISCIS Controls v8.1 | CSACSA CCM v4.1 | CSACSA AICM v1.1 | AICPASOC 2 (TSC 2017) | PCI SSCPCI DSS v4.0.1 | NIST · DoDNIST SP 800-171 / CMMC L2 | OWASPOWASP LLM Top 10 (2026) | MITREMITRE ATLAS | EUEU AI Act | CanadaPIPEDA | QuébecQuebec Law 25 | AlsoRelated standards & laws |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Governance, policy & rolesGovernance & Compliance Assessments · Policy Development | Cl. 5 · A.5.1-5.4 | Cl. 5 · A.2, A.3 | Cl. 5 · A.3.3-3.4 | Cl. 5 | EDM01 · APO01 | GOVERN 1-2 | GV.OC · GV.RR · GV.PO | PM · XX-1 (e.g. AC-1, AT-1) | n/a | GRC | GRC-09 · GRC-12 | CC1 · CC2 | Req. 12 | CA | n/a | n/a | Art. 16-17 · Art. 26 | 4.1 · 4.8 | s. 3.1-3.2 | ISO/IEC 27014 · ISO/IEC 38500 |
| Risk managementRisk Management Framework Implementation | Cl. 6.1 · 8.2-8.3 | Cl. 6.1 · 8.2-8.4 | Cl. 6.1 · 8.2-8.3 · A.1.2.6 | Cl. 6.1 · 8.2 | EDM03 · APO12 | MAP 1-5 · MEASURE 1-4 · MANAGE 1 | GV.RM · ID.RA | RA · PM-9 | n/a | GRC | GRC-11 · MDS-06 | CC3 | 12.3 | RA | n/a | n/a | Art. 9 | n/a | s. 3.3 | ISO 31000 · ISO/IEC 27005 · ISO/IEC 23894 · NIST SP 800-30 r1 · FAIR |
| Asset & data inventoryGovernance & Compliance Assessments | A.5.9-5.11 | A.4 | A.1.2.9 · A.2.2.7 · A.3.5 | n/a | BAI09 | GOVERN 1.6 | ID.AM | CM-8 · PM-5 | 1 · 2 · 3 | DCS · DSP · UEM | DSP-20 · MDS-03 | CC6.1 | 12.5 | CM · MP | n/a | AML.M0023 · AML.M0025 | n/a | n/a | n/a | NIST IR 8011 Vol. 2 |
| Identity & accessPolicy Development · Assessments | A.5.15-5.18 · A.8.2-8.5 | n/a | A.3 | n/a | DSS05.04 | n/a | PR.AA | AC · IA | 5 · 6 | IAM | IAM-16 to IAM-18 | CC6.1-6.3 | Req. 7 · 8 | AC · IA | LLM03 | AML.M0019 · AML.M0026 | n/a | 4.7.3 | s. 10 · s. 20 | NIST SP 800-63-4 |
| Network security & zero trustAssessments · Policy Development | A.8.20-8.22 | n/a | A.1.4.10 | n/a | DSS05.02 | n/a | PR.IR | SC-7 · AC-4 | 12 · 13 | I&S | AIS-11 · AIS-13 | CC6.6 | Req. 1 | SC · AC | n/a | AML.M0032 | n/a | n/a | n/a | NIST SP 800-207 · NIST SP 800-207A · CISA Zero Trust Maturity Model 2.0 · DoD Zero Trust Reference Architecture |
| Data protection & privacyAssessments · Policy Development | A.5.12-5.14 · A.5.33-5.34 · A.8.10-8.12 · A.8.24 | A.7 | A.1.2-A.1.5 · A.2.2-A.2.5 | n/a | APO14 | MEASURE 2.10 | PR.DS | SC-8 · SC-28 · MP · PT | 3 | DSP · CEK | DSP-21 to DSP-24 | C1.1-C1.2 · P1.1-P8.1 · CC6.7 | Req. 3 · 4 | MP · SC | LLM02 | AML.M0012 · AML.T0057 | Art. 4a · Art. 10 | 4.2-4.6 · 4.9 | s. 4-8.1 · s. 12-14 · s. 17 · s. 27-28.1 | ISO/IEC 29100 · ISO/IEC 29151 · NIST Privacy Framework · Ontario PHIPA |
| Secure developmentPolicy Development · Assessments | A.8.25-8.33 | A.6 | A.3 | n/a | BAI03 | MEASURE 2 | PR.PS-06 | SA-8 · SA-11 · SA-15 | 16 | AIS | AIS-09 to AIS-10 · AIS-12 · AIS-15 · MDS-01 · MDS-13 | CC8.1 | Req. 6 | SC | LLM01 · LLM10 | AML.M0020 · AML.T0051 | Art. 15 | n/a | s. 3.3 · s. 9.1 | NIST SSDF (SP 800-218/218A) · ISO/IEC 27034 · OWASP ASVS · OWASP SAMM · OWASP Top 10 |
| Vulnerability & configurationAssessments | A.8.8 · A.8.9 | n/a | n/a | n/a | BAI10 · DSS05.07 | n/a | ID.RA-01 · PR.PS-01 to PR.PS-02 | RA-5 · CM-2 · CM-6 · SI-2 | 4 · 7 | TVM · CCC | TVM-13 · MDS-02 · MDS-07 | CC7.1 | Req. 2 · 6.3 · 11.3 | RA · CM · SI | n/a | AML.M0016 | n/a | n/a | n/a | NIST SP 800-40 r4 · NIST SP 800-128 |
| Logging, monitoring & detectionIncident Response Planning | A.8.15-8.17 | A.6.2.8 | A.3 | n/a | DSS05.07 | MEASURE 2.4 · MANAGE 4.1 | DE.CM · DE.AE | AU · SI-4 | 8 · 13 | LOG | LOG-15 to LOG-16 · MDS-10 | CC7.2 | Req. 10 | AU · SI | n/a | AML.M0024 | Art. 12 · Art. 19 · Art. 26(6) | n/a | n/a | NIST SP 800-92 · NIST SP 800-137 · MITRE ATT&CK |
| Incident responseIncident Response Planning | A.5.24-5.28 | A.8.4 | A.3.11-3.12 | Cl. 8.4 | DSS02 | MANAGE 4.3 | RS | IR | 17 | SEF | MDS-11 | CC7.3-7.5 | 12.10 | IR | n/a | n/a | Art. 73 | s. 10.1-10.3 | s. 3.5-3.8 | ISO/IEC 27035-1/-2 · NIST SP 800-61 r3 |
| Business continuity & resilienceIncident Response Planning | A.5.29-5.30 · A.8.13-8.14 | n/a | A.3 | Cl. 8.2-8.5 | DSS04 | n/a | RC · PR.IR | CP | 11 | BCR | n/a | A1 | n/a | n/a | LLM06 | AML.M0004 · AML.T0029 | Art. 15(4) | 4.7 | n/a | ISO/IEC 27031 · NIST SP 800-34 r1 |
| Third-party & supply chainThird-Party Risk Assessment · Software Procurement | A.5.19-5.23 | A.10 | A.1.2.7 · A.2.5.7-5.9 | Cl. 8.1 · 8.3.4 | APO10 | GOVERN 6 | GV.SC | SR · SA-9 | 15 | STA | MDS-09 · MDS-12 | CC9.2 | 12.8 | n/a | LLM04 · LLM05 | AML.M0014 · AML.T0010 | Art. 25 · Art. 53 | 4.1.3 | s. 17 · s. 18.3 | ISO/IEC 27036 · ISO 28000 · NIST SP 800-161 r1 · SLSA |
| Awareness & trainingSecurity Awareness & Training | Cl. 7.2-7.3 · A.6.3 | Cl. 7.2-7.3 | Cl. 7.2-7.3 | Cl. 7.2-7.3 | APO07 | GOVERN 2.2 | PR.AT | AT | 14 | HRS | HRS-14 to HRS-15 | CC1.4 | 12.6 | AT | n/a | AML.M0018 | Art. 4 | 4.1.4 · 4.7.4 | n/a | NIST SP 800-50 r1 · NIST SP 800-181 r1 (NICE) |
| AI system governance & impactAI Governance | n/a | A.5 · A.6 · A.8 · A.9 | A.1.2.6 · A.1.3.11 | n/a | EDM01 | GOVERN · MAP · MEASURE · MANAGE | GV · ID.RA | n/a | n/a | n/a | GRC-10 · GRC-13 to GRC-15 · MDS-04 to MDS-05 | n/a | n/a | n/a | LLM07 | AML.M0029 | Art. 5-6 · Art. 14 · Art. 27 | n/a | s. 3.3 · s. 8.1 · s. 12.1 | ISO/IEC 42005 · ISO/IEC 23894 · ETSI EN 304 223 |
| Audit, assurance & improvementGovernance & Compliance Assessments | Cl. 9 · 10 | Cl. 9 · 10 | Cl. 9 · 10 | Cl. 9 · 10 | MEA01-MEA04 | GOVERN 1.5 | GV.OV · ID.IM | CA | n/a | A&A | MDS-08 | CC4 | 12.4 | CA | LLM01-LLM10 | AML.M0008 | Art. 43 · Art. 72 | 4.10 | n/a | ISO 19011 · ISO 37301 · NIST SP 800-53A |
This is an indicative, high-level alignment using clause, control, function and requirement identifiers. It is not an official mapping or a certification claim; coverage depends on your scope and is confirmed for each engagement. n/a means the framework has no direct equivalent. CSA AICM includes every CSA CCM domain, and its column lists only the AI-specific controls it adds. The NIST SP 800-171 / CMMC L2 column shows requirement families shared by both. MITRE ATLAS cells show mitigation (AML.M) and technique (AML.T) IDs. In ISO/IEC 27701, A.3 refers to the shared information security controls. PIPEDA references are Schedule 1 principles unless marked s. (section). Last reviewed October 2026.
Need a different framework?
Tell us which standards and obligations you answer to, and we will show you how they map.