Docs / Crosswalks by standard

Crosswalks by standard

Find the standard you already work with, and the exact edition each crosswalk was built against.

Read this first. A crosswalk records a documented correspondence between an ODA3 framework and another standard, under stated criteria. It does not establish compliance, equivalence, endorsement or certification.

Each crosswalk defines its own mapping states and criteria in its methodology section; read those before relying on a mapping.

Management systems

ID	Standard	Edition mapped	Status
CRO-019	GAISSF™ to ISO/IEC 42001 Crosswalk	ISO/IEC 42001:2023, Edition 1 (2023-12)	Draft for Publication — Public — External Review Open	View methodology
CRO-020	GAISSF™ to ISO/IEC 27001 Crosswalk	ISO/IEC 27001:2022, Edition 3	Draft for Publication — Public — External Review Open	View methodology

US risk frameworks

ID	Standard	Edition mapped	Status
CRO-022	GAISSF™ to NIST AI RMF Crosswalk Scope: 59 GAISSF™ controls to 72 AI RMF Core subcategories, both directions	NIST AI RMF 1.0 (NIST AI 100-1), January 2023	Draft for Publication — Public — External Review Open	View methodology
CRO-023	GAISSF™ to NIST CSF 2.0 Crosswalk	NIST Cybersecurity Framework 2.0 (NIST CSWP 29)	Draft for Publication — Public — External Review Open	View methodology

EU regulation

ID	Standard	Edition mapped	Status
CRO-027	GAISSF™ to EU AI Act Crosswalk	Regulation (EU) 2024/1689, consolidated text of 27 July 2026 incorporating Regulation (EU) 2026/1744	Draft for Publication — Public — External Review Open	View methodology
CRO-028	GAISSF™ to DORA Crosswalk	Regulation (EU) 2022/2554 (DORA)	Draft for Publication — Public — External Review Open	View methodology
CRO-029	GAISSF™ to NIS2 Crosswalk	Directive (EU) 2022/2555 (NIS2)	Draft for Publication — Public — External Review Open	View methodology
CRO-030	GAISSF™ to GDPR Crosswalk	Regulation (EU) 2016/679 (GDPR)	Draft for Publication — Public — External Review Open	View methodology

Assurance and sector regimes

ID	Standard	Edition mapped	Status
CRO-031	GAISSF™ to SOC 2 Crosswalk	AICPA 2017 Trust Services Criteria (Revised Points of Focus – 2022)	Draft for Publication — Public — External Review Open	View methodology
CRO-032	GAISSF™ to PCI DSS Crosswalk	PCI DSS v4.0.1	Draft for Publication — Public — External Review Open	View methodology
CRO-033	GAISSF™ to CIS Controls Crosswalk	CIS Controls v8.1	Draft for Publication — Public — External Review Open	View methodology
CRO-034	GAISSF™ to CSA CCM Crosswalk	CSA Cloud Controls Matrix (CCM) v4.1	Draft for Publication — Public — External Review Open	View methodology
CRO-035	GAISSF™ to HIPAA Crosswalk	HIPAA, 45 CFR Parts 160 and 164	Draft for Publication — Public — External Review Open	View methodology
CRO-036	GAISSF™ to FedRAMP Crosswalk	FedRAMP Consolidated Rules for 2026; NIST SP 800-53 Rev. 5	Draft for Publication — Public — External Review Open	View methodology

Threat references

ID	Standard	Edition mapped	Status
CRO-024	GAISSF™ to OWASP LLM Top 10 Crosswalk	OWASP Top 10 for LLM Applications 2025 (released 17 November 2024)	Draft for Publication — Public — External Review Open	View methodology
CRO-025	GAISSF™ to MITRE ATLAS Crosswalk	MITRE ATLAS v2026.09	Draft for Publication — Public — External Review Open	View methodology
CRO-026	GAISSF™ to MITRE ATT&CK Crosswalk	MITRE ATT&CK v19, Enterprise	Draft for Publication — Public — External Review Open	View methodology

Other crosswalks

ID	Standard	Edition mapped	Status
CRO-021	GAISSF™ to ISO/IEC 23894 Crosswalk	ISO/IEC 23894:2023	Draft for Publication — Public — External Review Open	View methodology
CSX-PAISF-004	GAISSF™ Domain 9 to PAI-SF™ Control Crosswalk	Not stated	Published 03 August 2026	View methodology
CSX-PAISF-011	PAI-SF™ Standards Crosswalk	Not stated	Public reference v1.0	View methodology