Who approved this mapping? Governing a crosswalk an auditor can trust

If your organisation answers to PISF, ISO 27001 and a sector rule at the same time, you already have a crosswalk. It might be a spreadsheet, a tab in the audit workbook, or knowledge in one person's head. Somewhere, somebody decided that your access review satisfies the ISO clause and the PISF control and the regulator's circular all at once.

That decision is worth a great deal. It is the reason you do the work once instead of three times. It is also, in most organisations, completely ungoverned. Nobody can say who decided it, when, or why, and nobody noticed when one of the frameworks changed underneath it.

We think a mapping deserves the same treatment as any other compliance claim. Here is what that looks like in practice. We explained why reuse matters in one control, many frameworks. This piece is about making the reuse defensible.

A mapping is a claim

When you write that PISF control A satisfies ISO control B, you are making a claim that an auditor may test. Like any claim, it should carry three things.

It should say where it came from. Did a publisher issue it as part of an official crosswalk, did a consultant propose it, did an AI suggest it, or did someone on your team decide it?

It should say who accepted it, and when. A named person who can explain the reasoning if asked.

And it should say what kind of relationship it is, which is the part most spreadsheets leave out entirely.

ControlGraph

Demo environment, sample dataAzbersInnovations

Say how they relate, not just that they do

Two controls can relate in very different ways. They can ask for exactly the same thing in different words. One can fully contain the other. One can ask for more than the other. They can overlap without either containing the other. Or they can simply be related as useful context without being a match at all.

NIST set out exactly these relationship types in NIST IR 8477, its guidance on mapping between documentary standards. Using them makes a crosswalk far more honest, because it stops a partial match from being counted as a full one.

In practice, this is where most inflated coverage comes from. A control that covers half of what the other framework asks is marked as mapped, and the organisation believes it has covered the whole thing. When the relationship type is recorded, the coverage calculation can give full credit where the match is equal or the source contains the target, partial credit where the controls only overlap, and none where the link is informational.

Keep official crosswalks as published

Some publishers ship their own crosswalks. CIS publishes mappings from its Controls to other frameworks, and NIST runs a national programme, OLIR, that publishes reviewed mappings to its frameworks.

Where an official crosswalk exists, bring it in exactly as published and mark it as official. Do not merge it with your own judgement, and do not let anything you do later overwrite it. When an auditor asks where a mapping came from, "the publisher says so" is the strongest answer there is, and it only stays true if nobody edited it.

For PISF, no official crosswalk to ISO 27001 or NIST exists yet. That makes the governance of every PISF mapping more important, not less, until the national body publishes one.

Let AI propose, never decide

Reading two frameworks side by side and finding where they meet is slow, careful work, and it is exactly the kind of work a language model does a good first pass at. We use AI for it ourselves. The danger is not the proposal. The danger is a proposal that becomes coverage without anyone deciding it should.

The rules we built into ControlGraph are simple, and we would recommend them whatever tool you use.

1. Every AI proposal starts as pending, and pending counts for nothing toward coverage.
2. A person approves it, approves it as a partial match, or rejects it, and that decision is recorded against their name.
3. For mappings an organisation relies on itself, two people in two different roles approve.
4. Running the AI again never overwrites a relationship someone has already approved.

These are not about distrusting the model. They are about making sure that when coverage is questioned, the answer is a person who can explain it.

ControlGraph

Demo environment, sample dataAzbersInnovations

Coverage is an estimate, and should say so

Once mappings are governed, you can calculate how far work done for one framework carries toward another. That figure is genuinely useful for planning. It tells you where a new certification is close and where the real gaps are.

It is not, however, an audit opinion. It says that your approved mappings suggest a certain level of carry over. It does not say you are compliant with the target framework. Any tool that presents coverage should say that plainly beside the number, and any report that uses it should too. A crosswalk that overstates what it knows loses its value the first time an auditor tests it.

Where to start

You do not need to rebuild your crosswalk in one go. Start with the mappings you rely on most.

1. Take your twenty most reused mappings and add a source and an approver to each.
2. Record the relationship type for each one, and downgrade any that are really partial matches.
3. Separate anything that came from an official crosswalk and mark it as such.
4. Anything nobody is willing to put their name to should stop counting until someone does.

That last step is uncomfortable, because coverage usually drops. What remains is coverage you can defend, which is the only kind that matters when someone asks.

Common questions

What is a control crosswalk

A crosswalk is a mapping between the controls of two or more frameworks, showing where a control in one satisfies or overlaps a control in another. It lets an organisation do work once and recognise it under several frameworks.

Is there an official PISF to ISO 27001 mapping

Not at the time of writing. No official crosswalk from PISF to ISO 27001 or NIST has been published, so any mapping in use today reflects someone's judgement and should record whose.

What are the relationship types in NIST IR 8477

NIST IR 8477 describes how two controls relate, including whether they are equal, whether one is a subset or superset of the other, whether they intersect, or whether they are not related. Recording the type prevents a partial match from being counted as a full one.

Can AI map controls between frameworks

It can propose mappings quickly and usefully. Those proposals should not count toward coverage until a person has approved them, and the approval should be recorded with their name and the date.