What is control mapping?

Control mapping is the practice of linking a security control, or a requirement in one framework, to the related requirements in other frameworks. It lets an organisation do the work once and show how that work answers several expectations, such as ISO/IEC 27001, SOC 2, the NIST Cybersecurity Framework and a national standard.

A mapping is a statement of relationship, and it is rarely a statement of equivalence. Two requirements can overlap heavily, overlap partly, or sit at very different levels of detail. Treating a partial overlap as a full match is the most common source of audit surprises.

What NIST says about mappings

NIST’s Cybersecurity Framework 2.0 uses the term “Informative References” for this. It describes them as mappings that indicate relationships between the Core and various standards, guidelines, regulations and other content, which help inform how an organisation may achieve the Core’s outcomes. The framework also points out that some references are narrower than a Subcategory: a particular control from NIST SP 800-53 may be one of many references needed to achieve a single outcome. Other references are higher level, such as a policy requirement that partly addresses several Subcategories.

NIST also runs the National Online Informative References (OLIR) Program. Its report, NISTIR 8278 Rev. 1, defines an Online Informative Reference as a standardised expression of the relationships between concepts from standards, guidelines and regulations, and says the programme encourages and facilitates defining them. The OLIR programme page describes a catalogue of reference data and a tool for generating derived relationship mappings against a focal document.

Relationship types

NIST IR 8477, “Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines” (final, February 2024), describes several mapping styles. One of them, set theory relationship mapping, gives five relationship types for the logical similarity of two concepts. Concept A is the requirement you are mapping from and concept B is the one you are mapping to:

Relationship type	NIST’s description (paraphrased)
Subset of	A is a subset of B: B contains everything A does, and more.
Intersects with	A and B overlap, but each includes content the other does not.
Equal	A and B are the same, though not necessarily identical.
Superset of	A is a superset of B: A contains everything B does, and more.
No relationship	A and B are unrelated; their content does not overlap.

NIST also says the relationship type and the rationale must be used together. The same pair can be graded differently depending on the rationale: for example, two requirements with near-identical wording can be “intersects with” on a syntactic rationale but “equal” on a semantic one if the differing words mean the same thing. So when you record a mapping, record why you graded it that way.

Some practical guidance follows, which is ours and not NIST’s. “Intersects with” may be the honest answer for many real pairs; NIST says only that the concepts overlap, so in practice you may need extra evidence or wording on one side. “Equal” is the strongest grade, but NIST defines it as “the same, although not necessarily identical”, so still confirm that your evidence fits the other requirement before reusing it.

Worked example: a periodic user access review

Take one control from an MSP’s library: “Access privileges for the client’s systems are reviewed periodically, and no longer needed access is removed.” The table below shows where it can sit in other frameworks. The identifiers come from NIST’s own CSF 2.0 reference data, downloaded on 7 November 2026; the Subcategory wording is quoted from that file.

Reference	What the source tells us	Your control (A) relative to this reference (B), illustrative
NIST CSF 2.0 PR.AA-05	Subcategory: access permissions, entitlements and authorizations are defined in a policy, managed, enforced and reviewed, and incorporate least privilege and separation of duties. Its first implementation example is to review logical and physical access privileges periodically and whenever someone changes roles or leaves.	Subset of. The review is one part of a wider outcome that also covers policy, enforcement, least privilege and separation of duties.
ISO/IEC 27001:2022 Annex A 5.15 and 5.18; NIST SP 800-53 Rev. 5 AC-02	Listed by NIST as informative references for PR.AA-05.	Not graded: NIST’s data gives no relationship type; grade against the licensed text.

Read the table as a method, not an answer. NIST’s reference list for PR.AA-05 is a set of informative references for the Subcategory as a whole, so a listed reference may address only part of it. The relationship grade in the last column is our reading of the quoted CSF wording, not a statement from NIST. SOC 2 Trust Services Criteria identifiers are not shown because they come from the AICPA’s own publication, which this table does not reproduce. Add them from that source when you build your mapping.

The control text of ISO/IEC 27001 and the SOC 2 criteria is copyrighted, so a mapping you publish or share should carry identifiers and your own descriptions rather than reproduced wording.

Why it matters

Most clients face more than one expectation. A software supplier may need SOC 2 for customers, ISO/IEC 27001 for European tenders, and a regional baseline for a particular market. Without mapping, each one becomes a separate project with its own spreadsheet, its own evidence requests and its own owners.

With mapping, the organisation keeps one set of controls and one body of evidence. When a new framework appears, the question becomes “what is new?” instead of “where do we start?”. Our guide to the multi-framework compliance playbook shows how that plays out for a service line.

How an MSP or vCISO delivers it

1. Pick one primary framework. Choose the one that most closely matches the client’s strongest requirement, and treat the others as mapped views.
2. Build a control library. Write each control once, in plain language, with a single owner.
3. Map using a published source where one exists. Use an official or well-documented mapping, and record its name, version and date. If you build your own mapping, say so.
4. Record the strength of each relationship. A simple scale, such as full, partial or related, avoids overstating coverage.
5. Attach evidence once. One piece of evidence, such as an access review, can support several requirements.
6. Check partial matches by hand. Where a mapping is partial, add a note about what additional evidence the second framework asks for.
7. Revisit when frameworks change. Versions are updated, and a mapping that was correct for the old version may not be for the new one.

For readiness work against a single framework, see the gap assessment guide. To see the frameworks GetCybr supports, visit the frameworks page.

Published mapping sources

Where a published mapping exists, start there and record its name, version and date. Details below are from each publisher’s own site, read on 7 November 2026. Check each licence yourself before using a mapping commercially.

• NIST OLIR and CSF 2.0 Informative References. NIST’s National Online Informative References Program keeps a catalogue of reference data, including mappings submitted by other organisations, and the CSF 2.0 Informative References can be downloaded as a spreadsheet. The OLIR page states no licence for the catalogue; see NIST’s copyright notice. NIST’s CSF Informative References page says NIST does not test non-NIST submitted mappings for correctness and that a listing does not imply NIST endorsement.
• CIS Controls v8.1 mappings. CIS says the Controls are mapped to and referenced by multiple legal, regulatory and policy frameworks, and names CSF 2.0 as one whose mapping was realigned in v8.1. The page we read states no release date or mapping licence, so check CIS’s terms of use.
• Cloud Security Alliance Cloud Controls Matrix (CCM). CSA’s page describes the CCM as aligned to industry-accepted standards and offers a machine-readable bundle with mappings. It currently refers to version 4.1. CSA says no licence is needed for internal use, but a licence is needed to customise the CCM or to use it commercially, for example in consulting projects, so an MSP should read the terms before building a client deliverable on it.
• Secure Controls Framework (SCF). The SCF says it has used NIST IR 8477 set theory relationship mapping for its crosswalks since release 2024.1, assigning each mapping one of the five relationship types and a strength score from 1 to 10. It is updated quarterly (the page references release 2026.2) and is published under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0), which does not permit distributing modified versions.

Common mistakes

• Assuming mapped means compliant. Satisfying one framework’s requirement does not by itself satisfy another’s. Check the detail.
• Using an undated mapping. Frameworks are revised. Record the version of both ends.
• Copying a mapping from a vendor or a blog without checking. Prefer official mappings or ones you have reviewed.
• Mapping at the wrong level. A mapping from a high-level principle to a single technical control hides detail.
• Forgetting regional or legal scope. Some frameworks apply only to certain entities, regions or sectors. A mapping does not change who must comply.
• Letting the mapping go stale. Assign an owner to review it when a framework version changes.

Frequently asked questions

What is the difference between control mapping and a crosswalk? In everyday use the words overlap. A crosswalk usually means a table that pairs requirements from two frameworks. Control mapping is the wider practice: it also records how strong each link is and which evidence supports it. NIST IR 8477 notes that a mapping with relationship types can be reduced to a plain crosswalk by dropping the types, but not the other way round.

Does a mapped control mean I meet the other framework? Not by itself. “Equal” is the strongest grade, but NIST defines it as “the same, although not necessarily identical”, so confirm that your evidence fits. For “intersects with”, “subset of” and “superset of” pairs, check what the other framework asks for beyond your control.

Can I rely on a published mapping? Use it as a starting point. Some publishers say they do not verify third-party mappings (NIST says this of non-NIST OLIR submissions), and the mapped framework versions may differ from the ones your client is assessed against. Record the version and date, and review the pairs that matter for an audit.

Who decides whether a mapping is good enough? The client’s assessor or certification body. A mapping helps you plan and organise evidence; it does not bind an auditor.

Where GetCybr fits

If you deliver several frameworks to several clients, GetCybr is a platform for holding a shared control library, the mappings between frameworks and the evidence attached to each control, so that one piece of work can be shown against more than one framework. It does not decide whether a partial match is enough for an auditor; that stays with your team and the client’s assessor. You can browse the supported frameworks on the frameworks page.

Sources

• NIST, The NIST Cybersecurity Framework (CSF) 2.0, February 2024. The CSF page lists Informative References as mappings and links to the full document (NIST CSWP 29), which is the source for the description of Informative References.
• NIST Computer Security Resource Center, National Online Informative References (OLIR) Program. Source for the programme description, the reference catalogue and the derived relationship mapping tool.
• NIST Computer Security Resource Center, NISTIR 8278 Rev. 1, National Online Informative References Program: Overview and Uses. Source for the definition of an Online Informative Reference.
• NIST Computer Security Resource Center, NIST IR 8477, Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines, final February 2024; full text at nvlpubs.nist.gov. Source for the five set theory relationship types and the rationale guidance.
• NIST, CSF 2.0 Informative References, with the downloadable reference spreadsheet read on 7 November 2026. Source for PR.AA-05 wording and its listed informative references.
• Cloud Security Alliance, Cloud Controls Matrix, read 7 November 2026.
• CIS, CIS Controls v8.1, read 7 November 2026.
• Secure Controls Framework Council, Set Theory Relationship Mapping (STRM) and SCF download page, read 7 November 2026.