14 frameworks127 controls
CROSSWALKFramework crosswalk
14 compliance frameworks mapped to ATT&CK. Click a cell to see overlapping controls and shared techniques. Authored by Adam Lundqvist.
Cells coloured by Jaccard similarity of technique sets.
01
| DORA | ISO 27001 | PCI DSS v4 | CIS v8 | NIS2 | OWASP API Top 10 | OWASP LLM Top 10 | OWASP Top 10 | ISO 27701 | EU AI Act | GDPR | NIST CSF | EU CRA | TIBER-EU | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| DORA | 0.40 | 0.36 | 0.48 | 0.54 | 0.23 | 0.31 | 0.33 | 0.29 | 0.26 | 0.45 | 0.46 | 0.19 | ||
| ISO 27001 | 0.40 | 0.33 | 0.53 | 0.44 | 0.30 | 0.29 | 0.34 | 0.28 | 0.25 | 0.40 | 0.36 | 0.14 | ||
| PCI DSS v4 | 0.36 | 0.33 | 0.41 | 0.41 | 0.33 | 0.35 | 0.33 | 0.39 | 0.40 | 0.30 | 0.33 | 0.29 | ||
| CIS v8 | 0.48 | 0.53 | 0.41 | 0.54 | 0.33 | 0.33 | 0.39 | 0.29 | 0.30 | 0.51 | 0.48 | 0.19 | ||
| NIS2 | 0.54 | 0.44 | 0.41 | 0.54 | 0.33 | 0.36 | 0.32 | 0.32 | 0.27 | 0.45 | 0.47 | 0.22 | ||
| OWASP API Top 10 | 0.23 | 0.30 | 0.33 | 0.33 | 0.33 | 0.36 | 0.35 | 0.26 | 0.20 | 0.25 | 0.31 | 0.11 | ||
| OWASP LLM Top 10 | 0.31 | 0.29 | 0.35 | 0.33 | 0.36 | 0.36 | 0.39 | 0.39 | 0.31 | 0.37 | 0.39 | 0.21 | ||
| OWASP Top 10 | 0.33 | 0.34 | 0.33 | 0.39 | 0.32 | 0.35 | 0.39 | 0.28 | 0.27 | 0.31 | 0.35 | 0.17 | ||
| ISO 27701 | 0.29 | 0.28 | 0.39 | 0.29 | 0.32 | 0.26 | 0.39 | 0.28 | 0.30 | 0.38 | 0.26 | 0.29 | ||
| EU AI Act | 0.26 | 0.25 | 0.40 | 0.30 | 0.27 | 0.20 | 0.31 | 0.27 | 0.30 | 0.40 | 0.31 | 0.27 | ||
| GDPR | 0.45 | 0.40 | 0.30 | 0.51 | 0.45 | 0.25 | 0.37 | 0.31 | 0.38 | 0.40 | 0.44 | 0.21 | ||
| NIST CSF | 0.46 | 0.36 | 0.33 | 0.48 | 0.47 | 0.31 | 0.39 | 0.35 | 0.26 | 0.31 | 0.44 | 0.18 | ||
| EU CRA | ||||||||||||||
| TIBER-EU | 0.19 | 0.14 | 0.29 | 0.19 | 0.22 | 0.11 | 0.21 | 0.17 | 0.29 | 0.27 | 0.21 | 0.18 |
ISO 27701 ↔ CIS v8 — 20 shared techniques
Clear ✕| Control A | Control B | Shared | Examples |
|---|---|---|---|
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 18 Penetration Testing | 9 | T1566, T1078, T1003, T1005 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 13 Network Monitoring and Defense | 8 | T1005, T1041, T1078, T1071 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 13 Network Monitoring and Defense | 8 | T1078, T1003, T1005, T1041 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 16 Application Software Security | 8 | T1003, T1005, T1041, T1486 |
| A.7.4.1 Limit collection | CIS Control 16 Application Software Security | 7 | T1005, T1041, T1083, T1190 |
| A.7.4.1 Limit collection | CIS Control 18 Penetration Testing | 7 | T1005, T1041, T1566, T1190 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 18 Penetration Testing | 7 | T1005, T1041, T1078, T1071 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 2 Inventory and Control of Software Assets | 7 | T1083, T1041, T1078, T1071 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 1 Inventory and Control of Enterprise Assets | 7 | T1005, T1041, T1486, T1053 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 3 Data Protection | 7 | T1078, T1005, T1039, T1041 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 5 Account Management | 7 | T1078, T1003, T1005, T1041 |
| A.7.4.1 Limit collection | CIS Control 3 Data Protection | 6 | T1005, T1041, T1083, T1530 |
| A.7.4.1 Limit collection | CIS Control 8 Audit Log Management | 6 | T1005, T1041, T1071.001, T1190 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 16 Application Software Security | 6 | T1083, T1005, T1041, T1071 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 2 Inventory and Control of Software Assets | 6 | T1078, T1003, T1041, T1027 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 7 Continuous Vulnerability Management | 6 | T1003, T1041, T1486, T1027 |
| A.7.4.1 Limit collection | CIS Control 13 Network Monitoring and Defense | 5 | T1005, T1041, T1190, T1003 |
| A.7.4.1 Limit collection | CIS Control 1 Inventory and Control of Enterprise Assets | 5 | T1005, T1041, T1190, T1486 |
| A.7.4.1 Limit collection | CIS Control 4 Secure Configuration of Enterprise Assets and S… | 5 | T1041, T1071.001, T1190, T1003 |
| A.7.4.1 Limit collection | CIS Control 5 Account Management | 5 | T1005, T1041, T1071.001, T1003 |
| A.7.4.1 Limit collection | CIS Control 7 Continuous Vulnerability Management | 5 | T1041, T1190, T1003, T1486 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 3 Data Protection | 5 | T1083, T1005, T1041, T1530 |
| A.7.4.5 PII de-identification and deletion at the end o… | CIS Control 5 Account Management | 5 | T1005, T1041, T1078, T1021 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 4 Secure Configuration of Enterprise Assets and S… | 5 | T1003, T1041, T1027, T1068 |
| A.7.5.1 Identify basis for PII transfer between jurisdi… | CIS Control 8 Audit Log Management | 5 | T1078, T1005, T1041, T1486 |
Showing top 25 of 33 control pairs.
Show non-overlap — ISO 27701 techniques NOT covered by CIS v8 (9)
T1025, T1048, T1082, T1119, T1552, T1555, T1560, T1567, T1573
compliance_mappings (127 controls across 14 frameworks). Jaccard computed from the union of applicable_techniques per control. Refreshed hourly via ISR. Curated by Adam Lundqvist, Founder at SQUR.