Crosswalk data licence
Licence the control mapping corpus itself, not a report about it. Every mapping is judged for a specific direction between two named standards, and the mappings we rejected are published alongside the ones we accepted.
What makes this different from a free corpus
The freely available control mappings share two properties. They are hub and spoke, so any pair between two standards is derived by passing through a third, never judged directly. And they are largely undifferentiated: the dominant relationship label states only that two controls concern the same topic.
Ours are judged pair by pair and carry a direction. That distinction is measurable rather than asserted. Where a privacy regulation is read into a security catalogue, and then the same two catalogues are read the other way, the two coverage figures differ by several multiples. A symmetric similarity score cannot produce that result, because a symmetric method returns a symmetric answer.
We also publish the rejections. A corpus that only ever reports matches gives you no way to tell a judgement from a suggestion.
Included pairs
| From | Into | Coverage | Rejected |
|---|---|---|---|
| FedRAMP Moderate | CMMC 2.0 | 98.2% | 1 |
| NIST SP 800-171 Rev 3 | CMMC 2.0 | 94.5% | 0 |
| NIST SP 800-53 Rev 5 | ASD Strategies to Mitigate Cyber Security Incidents | 86.5% | 0 |
| NIST SP 800-53 Rev 5 | CMMC 2.0 | 85.5% | 99 |
| NIST SP 800-53 Rev 5 | ISO 27001:2022 | 84.9% | 170 |
| NIST SP 800-53 Rev 5 | ISO 27002:2022 | 84.9% | 180 |
| GDPR | Australian Privacy Principles (APPs) | 84.6% | 0 |
| FedRAMP Moderate | ASD Strategies to Mitigate Cyber Security Incidents | 83.8% | 0 |
| NIST SP 800-53 Rev 5 | Azure Security Benchmark | 83.5% | 0 |
| FedRAMP Moderate | ANSSI Guide d'hygiene informatique (42 mesures, v2.0) | 83.3% | 0 |
| ISO 27002:2022 | ANSSI Guide d'hygiene informatique (42 mesures, v2.0) | 83.3% | 0 |
| NIST SP 800-53 Rev 5 | ANSSI Guide d'hygiene informatique (42 mesures, v2.0) | 83.3% | 0 |
How it is licensed
An annual licence to the corpus, delivered as data you can query and hold, for use inside your own platform, assessment practice or internal control environment. The licence sits with you, not with a vendor whose tool you happen to use.
Pricing on application while the first licences are placed.
Request the licence terms