Crosswalk
Crosswalk: Security
The Security view of the crosswalk: the same generated table, restricted to its columns. The All link opens every instrument column.
This view, 5 instruments
Domains by instruments
Rows are the corpus domains and columns are the standards, laws, frameworks, and programmes the corpus alignment matrices carry. A cell with a recorded mapping carries a count of the domain's documents that address the instrument, opening the instrument page at that domain, and a cell with none reads "no mapping". In the 3 columns here for ISO/IEC 27001:2022, NIST CSF 2.0, and CSA CCM v4.1, a cell also previews, in code type, up to 6 of the control and clause identifiers the domain's documents are mapped to, where any are recorded, and the instrument page lists every identifier and label in full. No domain has a recorded mapping in the AICPA TSC column here, so every cell there reads "no mapping". The remaining NIST SP 800-53 Rev. 5 column here takes its cells from the documents mapped to the instrument's control areas; there a cell with a recorded mapping shows the count alone, and the instrument page lists those control areas.
The Views list opens the other views, All among them, and the group lists below it name every instrument under its group, each linking its instrument page.
| Domain | 27001:2022ISO/IECStandards and management systems | CSF 2.0NISTFrameworks and control catalogues | SP 800-53 Rev. 5NISTFrameworks and control catalogues | CCM v4.1CSAFrameworks and control catalogues | TSCAICPAAudit and attestation |
|---|---|---|---|---|---|
| Governance | §5.1, §5.2, §6.1, §6.1.3, §8.2, A.5.33, and more 22 documents | GV.RM, ID.RA, PR.DS, GV.RR, PR.AA, ID.IM, and more 17 documents | no mapping | GRC-01, GRC-02, GRC-04, DSP-16, DSP-02, CCC-08, and more 22 documents | no mapping |
| Risk | §5.1, §5.3, §6.1, §6.2, §6.1.1, §6.1.2, and more 15 documents | ID.RA, GV.SC, ID.IM, RC.RP 13 documents | 3 documents | GRC-01, GRC-02, STA-01, GRC-04, A&A-02, A&A-03, and more 15 documents | no mapping |
| Compliance | §9.2, §9.3, §10.1, §10.2, §4.1, §4.2, and more 37 documents | ID.IM, GV.RR, GV.OV, GV.OC, PR.AA, DE.CM, and more 30 documents | 2 documents | GRC-06, GRC-07, A&A-05, GRC-01, GRC-02, A&A-04, and more 37 documents | no mapping |
| Security | §5.2, A.5.1, A.5.2, A.5.15, A.5.16, A.5.17, and more 36 documents | GV.OC, GV.PO, PR.AA, PR.IR, PR.AT, PR.DS, and more 36 documents | 17 documents | GRC-01, IAM-01, SEF-01, IAM-02, IAM-03, IAM-04, and more 36 documents | no mapping |
| Operations | A.8.8, A.8.9, A.8.31, A.8.20, A.8.21, A.8.22, and more 27 documents | PR.PS, DE.CM, PR.IR, PR.DS, ID.IM, DE.AE, and more 26 documents | 5 documents | CCC-01, CCC-02, TVM-01, I&S-03, I&S-08, I&S-09, and more 27 documents | no mapping |
| Supply chain | A.5.19, A.5.20, A.5.21, A.5.22, A.5.23, A.5.30, and more 18 documents | GV.SC, RC.RP, ID.AM, ID.RA, DE.CM, PR.DS, and more 17 documents | 1 document | STA-01, STA-02, STA-03, STA-05, STA-10, STA-13, and more 18 documents | no mapping |
| Resilience | A.5.29, A.5.30, A.8.14, A.8.13, A.5.24, A.5.26, and more 21 documents | RC.RP, RC.CO, ID.RA, RS.MA, ID.IM, PR.IR, and more 21 documents | 3 documents | BCR-01, BCR-02, BCR-03, BCR-04, BCR-05, BCR-08, and more 21 documents | no mapping |
| Privacy | A.5.34, A.8.11, A.8.12, A.5.31, §5.3, A.8.25, and more 52 documents | PR.DS, ID.RA, PR.PS, ID.AM, RS.MA, RS.CO, and more 49 documents | no mapping | DSP-01, DSP-02, DSP-04, DSP-09, DSP-10, GRC-01, and more 52 documents | no mapping |
| Architecture | §6.1, A.5.8, A.8.27, §8.1, A.5.14, A.8.26, and more 8 documents | ID.AM, PR.PS, ID.IM, PR.DS, PR.IR, DE.CM, and more 8 documents | no mapping | GRC-01, GRC-02, CCC-01, CCC-02, AIS-01, AIS-02, and more 8 documents | no mapping |
| Dev security | A.8.27, A.8.29, A.5.36, A.8.25, A.8.28, A.8.30, and more 17 documents | GV.SC, PR.PS, ID.RA, GV.RR, DE.CM, GV.OC, and more 17 documents | 2 documents | AIS-04, AIS-05, AIS-06, CCC-01, TVM-06, CCC-02, and more 16 documents | no mapping |
| AI | §5.1, §5.3, A.5.2, A.5.4, A.5.36, A.8.29, and more 45 documents | ID.RA, DE.CM, GV.SC, ID.AM, ID.IM, DE.AE, and more 39 documents | no mapping | GRC-01, GRC-06, A&A-02, GRC-02, AIS-05, DSP-05, and more 45 documents | no mapping |
| Crypto | §6.1.2, A.5.2, A.5.9, A.5.19, A.5.31, A.5.1, and more 2 documents | ID.AM, ID.RA, PR.AA, PR.DS, RS.MA, RC.RP 2 documents | no mapping | GRC-01, GRC-02, GRC-06, GRC-07, CEK-01, CEK-20, and more 2 documents | no mapping |
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion. Its AICPA TSC 2017 column is being populated domain by domain: until a document's Trust Services Criteria mapping has been assessed, its N/A in that column records that no mapping has been made yet and does not assert that no criterion applies. An AICPA TSC cell in the table here reads "no mapping" where every document the matrix lists for the domain has N/A in that column.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.