GRCLibrary.ai

Matrix

Reverse Framework Control Crosswalk Matrix

This matrix answers the most common adopter question: "given a control identifier or family from an external framework, which documents in this library address it?". The mapping is structured by external framework so that an adopter can navigate from a regulatory or framework control to the relevant library artefacts.

Type
Matrix
Version
1.0.20
Date
2026-10-27
Owner
Control Framework Maintainer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Core Governance
Review frequency
6 to 12 months and upon material source-framework or document index change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope and limitations
  • ISO/IEC 27001:2022 Annex A
  • ISO/IEC 42001:2023 (AI management systems)
  • NIST CSF 2.0
  • NIST SP 800-53 Rev. 5 (selected families)
  • NIST AI RMF 1.0 (Govern, Map, Measure, Manage)
  • CSA CCM v4.1 (selected domains)
  • EU AI Act
  • GDPR (and UK GDPR by analogue)
  • DORA (Digital Operational Resilience Act)
  • NIS 2 Directive
  • OWASP LLM Top 10 (2026) and MITRE ATLAS
  • CTPAT MSC and BASC v6 (trade and supply-chain security)
  • How to extend this matrix

Related documents