Docs / Crosswalks by standard

Crosswalks by standard

Find the standard you already work with, and the exact edition each crosswalk was built against.

Read this first. A crosswalk records a documented correspondence between an ODA3 framework and another standard, under stated criteria. It does not establish compliance, equivalence, endorsement or certification.

Each crosswalk sets out its criteria in its methodology section; read those before relying on a mapping. How to read the mapping terms.

Under each crosswalk: the date its external source was stated current or the law it was mapped as at, and its review trigger, where the crosswalk states them. A blank means the crosswalk does not state it.

Download all mapping datasets (ZIP, 953 KB) JSON and XLSX for CRO-019 to CRO-036, with a README listing each file's SHA-256.

ZIP checksum

ef418100f646604d06aab7439afb283b682a8abbab3e08387135cc080fb4a1d5

Management systems

ID	Standard	Edition mapped	Status	Version
CRO-019	GAISSF™ to ISO/IEC 42001 Crosswalk	ISO/IEC 42001:2023, Edition 1 (2023-12)	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-020	GAISSF™ to ISO/IEC 27001 Crosswalk	ISO/IEC 27001:2022, Edition 3	Draft for Publication	1.0	View methodology JSON data XLSX data

US risk frameworks

ID	Standard	Edition mapped	Status	Version
CRO-022	GAISSF™ to NIST AI RMF Crosswalk Scope: 59 GAISSF™ controls to 72 AI RMF Core subcategories, both directions Review trigger: Revision of GAISSF or AI RMF, material mapping evidence, or independent-review disposition.	NIST AI RMF 1.0 (NIST AI 100-1), January 2023	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-023	GAISSF™ to NIST CSF 2.0 Crosswalk Review trigger: Revision of GAISSF or NIST CSF, material mapping evidence, or independent-review disposition.	NIST Cybersecurity Framework 2.0 (NIST CSWP 29)	Draft for Publication	1.0	View methodology JSON data XLSX data

EU regulation

ID	Standard	Edition mapped	Status	Version
CRO-027	GAISSF™ to EU AI Act Crosswalk Law as at: 27 Jul 2026 (using the consolidated text of 27 July 2026 incorporating Regulation (EU) 2026/1744)	Regulation (EU) 2024/1689, consolidated text of 27 July 2026 incorporating Regulation (EU) 2026/1744	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-028	GAISSF™ to DORA Crosswalk Review trigger: Revalidate after amendments, new Level 2 acts, supervisory guidance, material GAISSF changes or significant enforcement developments.	Regulation (EU) 2022/2554 (DORA)	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-029	GAISSF™ to NIS2 Crosswalk	Directive (EU) 2022/2555 (NIS2)	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-030	GAISSF™ to GDPR Crosswalk	Regulation (EU) 2016/679 (GDPR)	Draft for Publication	1.0	View methodology JSON data XLSX data

Assurance and sector regimes

ID	Standard	Edition mapped	Status	Version
CRO-031	GAISSF™ to SOC 2 Crosswalk	AICPA 2017 Trust Services Criteria (Revised Points of Focus – 2022)	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-032	GAISSF™ to PCI DSS Crosswalk	PCI DSS v4.0.1	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-033	GAISSF™ to CIS Controls Crosswalk	CIS Controls v8.1	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-034	GAISSF™ to CSA CCM Crosswalk	CSA Cloud Controls Matrix (CCM) v4.1	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-035	GAISSF™ to HIPAA Crosswalk	HIPAA, 45 CFR Parts 160 and 164	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-036	GAISSF™ to FedRAMP Crosswalk Source stated current: 29 Jun 2026 (As verified on 29 June 2026, FedRAMP operates under the Consolidated Rules for 2026, officially launched on 25 June 2026) Review trigger: Any change to GAISSF, FedRAMP rules, certification classes, Rev5 baselines, 20x requirements, NIST SP 800-53 or agency requirements.	FedRAMP Consolidated Rules for 2026; NIST SP 800-53 Rev. 5	Draft for Publication	1.0	View methodology JSON data XLSX data

Threat references

ID	Standard	Edition mapped	Status	Version
CRO-024	GAISSF™ to OWASP LLM Top 10 Crosswalk Review trigger: Revalidation is required when GAISSF or the mapped OWASP source baseline changes. Newer edition: OWASP released a 2026 edition in August 2026; that later edition is not mapped by this document and requires a separate revalidation or crosswalk.	OWASP Top 10 for LLM Applications 2025 (released 17 November 2024)	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-025	GAISSF™ to MITRE ATLAS Crosswalk Source stated current: 6 Oct 2026 (MITRE ATLAS Content v2026.09; released 15 Sep 2026; current as of 6 Oct 2026)	MITRE ATLAS v2026.09	Draft for Publication	1.0	View methodology JSON data XLSX data
CRO-026	GAISSF™ to MITRE ATT&CK Crosswalk Source stated current: 6 Oct 2026 (MITRE ATT&CK Enterprise v19.2, current as of 6 October 2026)	MITRE ATT&CK v19, Enterprise	Draft for Publication	1.0	View methodology JSON data XLSX data

Other crosswalks

ID	Standard	Edition mapped	Status	Version
CRO-021	GAISSF™ to ISO/IEC 23894 Crosswalk	ISO/IEC 23894:2023	Draft for Publication	1.2	View methodology JSON data XLSX data
CSX-PAISF-004	GAISSF™ Domain 9 to PAI-SF™ Control Crosswalk	Not stated	Final Publication	1.0	View methodology
CSX-PAISF-011	PAI-SF™ Standards Crosswalk	Not stated	Final Publication	1.0	View methodology

How to read the mapping terms

Each crosswalk rates how a GAISSF™ control corresponds to an item in the other standard (relationship), how fully that item is addressed overall (coverage), and how sure the analysis is (confidence). These ratings describe correspondence between documents. They are not evidence findings, and they do not show compliance, equivalence or certification.

Relationship	Meaning
SP Strong partial	Substantial objective, scope and evidence overlap. Evidence may be reused after qualification; a GAISSF™ residual remains.
P Partial	Related objective or lifecycle coverage with material differences. Use as supporting evidence only.
S Supporting	General governance or assurance support. Do not treat as control satisfaction.
C Contextual	Relevant external-regime or comparison context. No equivalence or compliance inference.
E Direct enablement	The GAISSF™ control itself performs or governs the mapping to that standard, for example a gap analysis against it. A separate category, not a strength rating; it does not establish conformity.
N No material relationship	No material mapping was identified.
O Outside scope	Outside the scope of the crosswalk.
U Unable to determine	The available source does not allow a rating.

Coverage	Meaning
Substantially Addressed	The crosswalk judges the item substantially addressed by the mapped GAISSF™ controls.
Partially Addressed	The crosswalk judges the item partly addressed.
Indirectly Supported	Mapped controls support the item indirectly.
Not Addressed	No sufficiently direct GAISSF™ control was mapped.
Outside Scope / Unable to Determine	As for the relationship terms above.

Confidence: High, Medium-High, Medium, Medium-Low, Low, or Not Rated (no mapping, outside scope or indeterminate). Coverage counts measure mapping coverage only; they are not a compliance score. Definitions follow the crosswalks’ own methodology sections (for example GAISSF-CRO-019 §3 and GAISSF-CRO-022).

Earlier wording in some files. CRO-019 to CRO-021 spell the terms out in full. “No material mapping” means N. “Low-Medium” means Medium-Low. CRO-027 (EU AI Act) uses a mapping-density scale (“High mapping density”, “Partial mapping”, “Indirect mapping”, “No mapped GAISSF control”) that counts how many controls relate to an Article; it is not a measure of how fully the Article is addressed. Each crosswalk moves to the terms above at its next reissue.