Crosswalk
The crosswalk
Where the corpus maps to the standards, laws, frameworks, and programmes it cites. Every row, column, cell, and count is generated from the compliance alignment matrix, the reverse framework control crosswalk, the canonical citations register, and the taxonomy.
The full table, 19 instruments
Domains by instruments
Rows are the corpus domains and columns are the standards, laws, frameworks, and programmes the corpus alignment matrices carry. A cell with a recorded mapping carries a count of the domain's documents that address the instrument, opening the instrument page at that domain, and a cell with none reads "no mapping". In the 4 columns of the full table for ISO/IEC 27001:2022, NIST CSF 2.0, CSA CCM v4.1, and CSA AICM v1.1, a cell also previews, in code type, up to 6 of the control and clause identifiers the domain's documents are mapped to, where any are recorded, and the instrument page lists every identifier and label in full. In the 5 columns of the full table for CTPAT (2020), PIP, BASC (V6-2022), WCO SAFE (2025 edition), and AEO/AEO-S, the recorded mappings carry descriptive control-area labels rather than short identifiers, so a cell with a recorded mapping shows the count alone and the instrument page lists the labels in full. No domain has a recorded mapping in the AICPA TSC column of the full table, so every cell there reads "no mapping". The remaining 9 columns of the full table take their cells from the documents mapped to the instrument's control areas; there a cell with a recorded mapping shows the count alone, and the instrument page lists those control areas.
Each of the 6 topic views in the Views list shows the columns for one topic, and All shows every column; every column is in at least one topic, and the Domain column shows in every view. A topic can take columns from more than one instrument group, and a column can sit in more than one topic. Every column shows here, All is a link to this full table, and each topic view is a link to a page with that topic's columns only, which also links the topic's related instrument pages where it has any. Below the Views list, the group lists name every instrument under its group, each linking its instrument page; the 8 under Also in the corpus have a page and no column until a matrix carries them.
| Domain | 27001:2022ISO/IECStandards and management systems | 42001:2023ISO/IECStandards and management systems | CSF 2.0NISTFrameworks and control catalogues | SP 800-53 Rev. 5NISTFrameworks and control catalogues | AI RMF 1.0NISTFrameworks and control catalogues | CCM v4.1CSAFrameworks and control catalogues | AICM v1.1CSAFrameworks and control catalogues | LLM Top 10 (2026)OWASPFrameworks and control catalogues | ATLAS v2026.07MITREFrameworks and control catalogues | AI ActEULaws and regulations | GDPREULaws and regulations | DORAEULaws and regulations | NIS 2EULaws and regulations | CTPAT (2020)CBPSector and trade programmes | PIPCBSASector and trade programmes | BASC (V6-2022)WBOSector and trade programmes | SAFE (2025 edition)WCOSector and trade programmes | AEO/AEO-SHMRCSector and trade programmes | TSCAICPAAudit and attestation |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Governance | §5.1, §5.2, §6.1, §6.1.3, §8.2, A.5.33, and more 22 documents | no mapping | GV.RM, ID.RA, PR.DS, GV.RR, PR.AA, ID.IM, and more 17 documents | no mapping | no mapping | GRC-01, GRC-02, GRC-04, DSP-16, DSP-02, CCC-08, and more 22 documents | MDS-03, GRC-15, IAM-18, GRC-14, GRC-12, GRC-11, and more 12 documents | no mapping | no mapping | 2 documents | 2 documents | no mapping | no mapping | 2 documents | 3 documents | 7 documents | 5 documents | 7 documents | no mapping |
| Risk | §5.1, §5.3, §6.1, §6.2, §6.1.1, §6.1.2, and more 15 documents | 1 document | ID.RA, GV.SC, ID.IM, RC.RP 13 documents | 3 documents | 1 document | GRC-01, GRC-02, STA-01, GRC-04, A&A-02, A&A-03, and more 15 documents | MDS-10, GRC-11, GRC-15, GRC-10, MDS-04, MDS-11, and more 6 documents | no mapping | no mapping | 1 document | no mapping | 2 documents | 3 documents | 1 document | 5 documents | 11 documents | 1 document | 15 documents | no mapping |
| Compliance | §9.2, §9.3, §10.1, §10.2, §4.1, §4.2, and more 37 documents | no mapping | ID.IM, GV.RR, GV.OV, GV.OC, PR.AA, DE.CM, and more 30 documents | 2 documents | no mapping | GRC-06, GRC-07, A&A-05, GRC-01, GRC-02, A&A-04, and more 37 documents | GRC-11 1 document | no mapping | no mapping | no mapping | no mapping | no mapping | 2 documents | 6 documents | 7 documents | 11 documents | 11 documents | 13 documents | no mapping |
| Security | §5.2, A.5.1, A.5.2, A.5.15, A.5.16, A.5.17, and more 36 documents | no mapping | GV.OC, GV.PO, PR.AA, PR.IR, PR.AT, PR.DS, and more 36 documents | 17 documents | no mapping | GRC-01, IAM-01, SEF-01, IAM-02, IAM-03, IAM-04, and more 36 documents | MDS-06, GRC-10 2 documents | 1 document | no mapping | no mapping | 4 documents | 3 documents | 10 documents | 32 documents | 35 documents | 35 documents | 31 documents | 35 documents | no mapping |
| Operations | A.8.8, A.8.9, A.8.31, A.8.20, A.8.21, A.8.22, and more 27 documents | no mapping | PR.PS, DE.CM, PR.IR, PR.DS, ID.IM, DE.AE, and more 26 documents | 5 documents | no mapping | CCC-01, CCC-02, TVM-01, I&S-03, I&S-08, I&S-09, and more 27 documents | GRC-13, MDS-10, LOG-15, LOG-16 2 documents | no mapping | no mapping | no mapping | no mapping | 2 documents | 2 documents | 11 documents | 12 documents | 15 documents | 11 documents | 15 documents | no mapping |
| Supply chain | A.5.19, A.5.20, A.5.21, A.5.22, A.5.23, A.5.30, and more 18 documents | no mapping | GV.SC, RC.RP, ID.AM, ID.RA, DE.CM, PR.DS, and more 17 documents | 1 document | no mapping | STA-01, STA-02, STA-03, STA-05, STA-10, STA-13, and more 18 documents | GRC-11, MDS-03, DSP-20 3 documents | 1 document | no mapping | 1 document | 3 documents | 5 documents | 1 document | 13 documents | 13 documents | 13 documents | 13 documents | 13 documents | no mapping |
| Resilience | A.5.29, A.5.30, A.8.14, A.8.13, A.5.24, A.5.26, and more 21 documents | no mapping | RC.RP, RC.CO, ID.RA, RS.MA, ID.IM, PR.IR, and more 21 documents | 3 documents | no mapping | BCR-01, BCR-02, BCR-03, BCR-04, BCR-05, BCR-08, and more 21 documents | no mapping | no mapping | no mapping | no mapping | no mapping | 3 documents | 4 documents | no mapping | 17 documents | 17 documents | no mapping | 17 documents | no mapping |
| Privacy | A.5.34, A.8.11, A.8.12, A.5.31, §5.3, A.8.25, and more 52 documents | no mapping | PR.DS, ID.RA, PR.PS, ID.AM, RS.MA, RS.CO, and more 49 documents | no mapping | no mapping | DSP-01, DSP-02, DSP-04, DSP-09, DSP-10, GRC-01, and more 52 documents | DSP-20, GRC-10, GRC-15, DSP-22, GRC-11, GRC-13 6 documents | 1 document | no mapping | 1 document | 7 documents | 1 document | no mapping | no mapping | no mapping | 1 document | no mapping | no mapping | no mapping |
| Architecture | §6.1, A.5.8, A.8.27, §8.1, A.5.14, A.8.26, and more 8 documents | no mapping | ID.AM, PR.PS, ID.IM, PR.DS, PR.IR, DE.CM, and more 8 documents | no mapping | no mapping | GRC-01, GRC-02, CCC-01, CCC-02, AIS-01, AIS-02, and more 8 documents | AIS-09, IAM-18, MDS-03, DSP-20, DSP-24 3 documents | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping |
| Dev security | A.8.27, A.8.29, A.5.36, A.8.25, A.8.28, A.8.30, and more 17 documents | no mapping | GV.SC, PR.PS, ID.RA, GV.RR, DE.CM, GV.OC, and more 17 documents | 2 documents | no mapping | AIS-04, AIS-05, AIS-06, CCC-01, TVM-06, CCC-02, and more 16 documents | AIS-12, AIS-15, HRS-15 2 documents | 2 documents | no mapping | no mapping | 1 document | no mapping | 1 document | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping |
| AI | §5.1, §5.3, A.5.2, A.5.4, A.5.36, A.8.29, and more 45 documents | 24 documents | ID.RA, DE.CM, GV.SC, ID.AM, ID.IM, DE.AE, and more 39 documents | no mapping | 17 documents | GRC-01, GRC-06, A&A-02, GRC-02, AIS-05, DSP-05, and more 45 documents | GRC-12, GRC-15, GRC-10, GRC-11, GRC-13, DSP-20, and more 41 documents | 9 documents | 1 document | 18 documents | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping |
| Crypto | §6.1.2, A.5.2, A.5.9, A.5.19, A.5.31, A.5.1, and more 2 documents | no mapping | ID.AM, ID.RA, PR.AA, PR.DS, RS.MA, RC.RP 2 documents | no mapping | no mapping | GRC-01, GRC-02, GRC-06, GRC-07, CEK-01, CEK-20, and more 2 documents | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping | no mapping |
Note
What this mapping is
From the GRC Library Compliance Alignment Matrix: citations are indicative, not exhaustive (the representative-citation convention), and no entry constitutes a certification, attestation, or legal opinion. Its AICPA TSC 2017 column is being populated domain by domain: until a document's Trust Services Criteria mapping has been assessed, its N/A in that column records that no mapping has been made yet and does not assert that no criterion applies. An AICPA TSC cell in the table here reads "no mapping" where every document the matrix lists for the domain has N/A in that column.
From the Reverse Framework Control Crosswalk Matrix: coverage is partial, and external control identifiers and clause numbers are referenced for navigation only; the library does not reproduce third-party control text.
From the Cross-Framework Alignment Matrix: the alignment is not an official mapping, certification claim, legal opinion, or reproduction of third-party framework content.
The standards, laws, frameworks, and programmes in the canonical citations register, mapped here or not, are listed with their current editions on the Standards & frameworks page, generated from that register.