Compliance crosswalk
Control crosswalk tables mapping ISO 27001 Annex A, SOC 2 Trust Services Criteria, NIST CSF 2.0, NIST 800-53, PCI DSS 4.0, and CIS Controls v8 to each other. Use when assessing controls against multiple frameworks, preparing audit evidence, or deciding which frameworks a single remediation satisfies.From its SKILL.md
npx -y skills add KuCh4u/ECC --skill compliance-crosswalkAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
7.9 KB, as published. Nobody here has run it
Compliance Crosswalk
Reference for the grc-analyst agent. Assess a control once, map it to every framework it satisfies. Running parallel control programs per framework is the most common and most expensive GRC mistake.
When to Activate
- Assessing controls against more than one framework
- Deciding what else a planned remediation buys you
- Preparing evidence for an audit or certification
- Scoping a new framework against controls that already exist
How To Use A Crosswalk
Crosswalks map intent, not identical requirements. Two controls that map to each other rarely have identical scope, evidence, or testing depth. The mapping tells you where to look; the framework text tells you what is required.
Always: read the actual clause before claiming coverage. Cite the clause in findings, never the crosswalk.
Core Domain Crosswalk
Access Control
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.5.15 Access control · A.5.16 Identity management · A.5.17 Authentication information · A.5.18 Access rights · A.8.2 Privileged access |
| SOC 2 | CC6.1 logical access · CC6.2 registration/authorization · CC6.3 access modification/removal |
| NIST CSF 2.0 | PR.AA-01…05 (Identity, Authentication, Access) |
| NIST 800-53 | AC-2 Account management · AC-3 Access enforcement · AC-6 Least privilege · IA-2 Identification and authentication |
| PCI DSS 4.0 | Req 7 (need-to-know) · Req 8 (identify and authenticate) |
| CIS v8 | Control 5 Account management · Control 6 Access control management |
Logging and Monitoring
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.8.15 Logging · A.8.16 Monitoring activities · A.8.17 Clock synchronization |
| SOC 2 | CC7.2 monitoring for anomalies · CC7.3 evaluation of security events |
| NIST CSF 2.0 | DE.CM-01…09 · DE.AE-02…08 |
| NIST 800-53 | AU-2 Event logging · AU-6 Audit review · AU-12 Audit generation · SI-4 System monitoring |
| PCI DSS 4.0 | Req 10 (log and monitor all access) |
| CIS v8 | Control 8 Audit log management · Control 13 Network monitoring |
Vulnerability and Patch Management
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.8.8 Management of technical vulnerabilities · A.8.19 Software installation |
| SOC 2 | CC7.1 vulnerability detection · CC8.1 change management |
| NIST CSF 2.0 | ID.RA-01…08 · PR.PS-02 |
| NIST 800-53 | RA-5 Vulnerability monitoring · SI-2 Flaw remediation |
| PCI DSS 4.0 | Req 6 (secure systems and software) · Req 11.3 (scanning) |
| CIS v8 | Control 7 Continuous vulnerability management |
Change Management
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.8.32 Change management · A.8.31 Separation of environments |
| SOC 2 | CC8.1 change authorization, design, testing, approval |
| NIST CSF 2.0 | PR.PS-01 · ID.AM-08 |
| NIST 800-53 | CM-3 Configuration change control · CM-4 Impact analysis · SA-10 Developer configuration management |
| PCI DSS 4.0 | Req 6.5 (changes to systems) |
| CIS v8 | Control 4 Secure configuration |
Incident Response
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.5.24 IR planning · A.5.25 Assessment of events · A.5.26 Response · A.5.27 Learning · A.5.28 Evidence collection |
| SOC 2 | CC7.3 evaluation · CC7.4 response · CC7.5 recovery |
| NIST CSF 2.0 | RS.MA · RS.AN · RS.MI · RC.RP · RC.CO |
| NIST 800-53 | IR-4 Incident handling · IR-5 Monitoring · IR-6 Reporting · IR-8 IR plan |
| PCI DSS 4.0 | Req 12.10 (incident response plan) |
| CIS v8 | Control 17 Incident response management |
Encryption and Key Management
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.8.24 Use of cryptography |
| SOC 2 | CC6.7 transmission and disposal of information |
| NIST CSF 2.0 | PR.DS-01 (at rest) · PR.DS-02 (in transit) |
| NIST 800-53 | SC-12 Key establishment · SC-13 Cryptographic protection · SC-28 Protection at rest |
| PCI DSS 4.0 | Req 3 (protect stored data) · Req 4 (protect in transit) |
| CIS v8 | Control 3 Data protection |
Backup and Resilience
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.8.13 Information backup · A.5.29 Security during disruption · A.5.30 ICT readiness |
| SOC 2 | A1.2 environmental protections and backup · A1.3 recovery testing |
| NIST CSF 2.0 | PR.DS-11 · RC.RP-01…06 |
| NIST 800-53 | CP-9 System backup · CP-10 Recovery · CP-4 Contingency plan testing |
| PCI DSS 4.0 | Req 12.10.1 (as part of IR) |
| CIS v8 | Control 11 Data recovery |
Third-Party and Supply Chain
| Framework | Reference |
|---|---|
| ISO 27001:2022 | A.5.19…A.5.23 Supplier relationships and cloud services |
| SOC 2 | CC9.2 vendor and business partner risk |
| NIST CSF 2.0 | GV.SC-01…10 (Cybersecurity Supply Chain Risk Management) |
| NIST 800-53 | SR-2 Supply chain risk plan · SR-3 Supply chain controls · SA-9 External services |
| PCI DSS 4.0 | Req 12.8 (third-party service providers) |
| CIS v8 | Control 15 Service provider management |
What Does Not Crosswalk
Treat these as framework-specific work; no mapping substitutes for them:
- ISO 27001 — the ISMS itself: scope statement, Statement of Applicability, management review, internal audit programme, continual improvement. Clauses 4–10 are the certifiable part; Annex A is only the control set.
- SOC 2 — the observation period. Type I is a point in time, Type II is operating effectiveness across 3–12 months. Evidence must span the period.
- PCI DSS — scoping the cardholder data environment, network segmentation validation, and quarterly ASV scans.
- GDPR — lawful basis, RoPA, DPIAs, data subject rights, international transfer mechanisms. These are legal obligations; controls alone do not satisfy them.
- HIPAA — the required risk analysis, and Business Associate Agreements.
Evidence Quality Ladder
From weakest to strongest, per control:
- Policy stating the control exists — not evidence
- Screenshot of a configuration — weak, undated, unattributable
- System-generated export for a point in time — acceptable for Type I
- System-generated export covering the full period — required for Type II
- Export plus the exception log showing what happened when the control failed — strongest
Ask for level 4 by default. Level 5 for anything a material finding depends on.
Reusable Evidence
One artifact, many controls. Collect these once:
| Artifact | Satisfies |
|---|---|
| Branch protection + CODEOWNERS config | Change management, segregation of duties |
| CI pipeline definition with required gates | Change testing and approval |
| Quarterly access review export | Access control, privileged access |
| Scanner output history with remediation tickets | Vulnerability management |
| Backup restore test report | Resilience, recovery |
| Onboarding/offboarding tickets | Access provisioning and removal |
| IR tabletop exercise report | Incident response readiness |
| Vendor security reviews and DPAs | Third-party risk |
Related
- Agent:
agents/grc-analyst.md— assessment workflow and reporting - Agent:
agents/vulnerability-analyst.md— technical reality behind the controls - When PHI is in scope: the
hipaa-complianceandhealthcare-phi-complianceskills ship in the separateecc-extrasplugin
Framework clause numbers change between revisions. These reflect ISO 27001:2022, NIST CSF 2.0, PCI DSS 4.0, and CIS v8. Verify against the current published standard before citing in an audit deliverable.