Security Framework Control Crosswalk

An open, cited crosswalk of 197 CSA CCM v4 controls mapped to ISO/IEC 27001:2022, SOC 2 (Trust Services Criteria), NIST CSF 2.0, NIST SP 800-53 Rev. 5, and the Shared Assessments SIG.

Answering a security questionnaire in one framework usually satisfies the equivalent control in the others — this dataset makes that mapping explicit, with per-mapping confidence and provenance so you can tell a solid control-to-control link from a directional domain-level one.

Questions and mappings only — no answers. This dataset never asserts that any organization implements a control. It maps which controls correspond, not how to answer them. (See Scope.)

Interactive version: https://accountmade.com/tools/framework-crosswalk

Files

File	What it is
data/crosswalk.json	Full structured dataset (controls + mappings + provenance).
data/crosswalk.csv	Flat CSV — one row per control × target-framework mapping.
data/frameworks.json	The frameworks referenced, with version and source URL.
schema.json	JSON Schema (draft-07) for crosswalk.json.

Structure

The spine is CSA CCM v4 (the most questionnaire-native, richest-mapped framework). Each control carries mappings into the other frameworks:

{
  "ccmId": "IAM-14",
  "domainPrefix": "IAM",
  "domain": "Identity & Access Management",
  "title": "Strong Authentication",
  "spec": "Define, implement and evaluate strong authentication (e.g. MFA) for access to systems and data.",
  "mappings": [
    {
      "framework": "soc2",
      "ids": ["CC6.1"],
      "level": "control",          // control-to-control, or domain-level anchor
      "confidence": "high",        // high | medium | low
      "source": "Secure Controls Framework (SCF) — CCM v4 ↔ SOC 2",
      "note": "…"                  // present on domain-level mappings
    }
  ]
}

Mapping altitude (read this before you trust a cell)

Authoritative per-control cross-mappings are, for several frameworks, published only in gated member workbooks (CSA) or machine-readable OLIR records (NIST). We map at the altitude the public data honestly supports and label it:

• level: "control" — a specific control-to-control link from a public crosswalk.
• level: "domain" — a structural domain/family anchor, used where per-control public data is gated. Treat these as a strong starting point and verify against the primary framework.

Every mapping also carries a confidence (high / medium / low) and a source string. Low-confidence and domain-level mappings are directional — do not treat them as an audited equivalence.

Provenance

Mapping	Source	Typical confidence
CCM v4 control set	Cloud Security Alliance (CCM v4)	—
CCM → SOC 2	Secure Controls Framework (SCF) crosswalk	high (per-control)
CCM → ISO 27001	Third-party CCM→ISO 27001:2013 encoding, converted to 2022 via ISO 27002:2022 Annex B, then verified control-by-control against ISO/IEC 27002:2022	high/medium where verified, low where directional
CCM → NIST CSF 2.0 / 800-53	CSA CCM ↔ NIST (OLIR), anchored at the domain / control-family level	high (domain-level)
CCM → SIG	Shared Assessments SIG 2024/25 ↔ CCM domain alignment (no per-control SIG↔CCM map is published)	medium (domain-level)

Framework versions and source URLs are in data/frameworks.json.

Usage

# CSV → your spreadsheet / BI tool
open data/crosswalk.csv

# JSON with jq: which controls map to SOC 2 CC6.1?
jq '[.controls[] | select(.mappings[] | .framework=="soc2" and (.ids | index("CC6.1")))] | .[].ccmId' data/crosswalk.json

Scope

• Included: control identifiers, short titles, one-line specs, and cross-framework mappings with confidence + provenance.
• Not included: any framework's full normative text; any organization's answers, evidence, or claimed control state. This is a map, not an answer bank.

License

Crosswalk mappings and structure: CC BY 4.0 — free to use, adapt, and redistribute with attribution to AccountMade — https://accountmade.com/tools/framework-crosswalk. The underlying frameworks remain the property of their respective publishers; see LICENSE for details.

Contributing

Corrections to mappings are welcome — open an issue or PR with the source you're mapping against. Include the primary reference (published crosswalk, workbook, or OLIR record) so the confidence and source fields stay honest.