14 frameworks127 controls

CROSSWALKFramework crosswalk

14 compliance frameworks mapped to ATT&CK. Click a cell to see overlapping controls and shared techniques. Authored by Adam Lundqvist.

Cells coloured by Jaccard similarity of technique sets.

01
DORAISO 27001PCI DSS v4CIS v8NIS2OWASP API Top 10OWASP LLM Top 10OWASP Top 10ISO 27701EU AI ActGDPRNIST CSFEU CRATIBER-EU
DORA
0.400.360.480.540.230.310.330.290.260.450.460.19
ISO 270010.40
0.330.530.440.300.290.340.280.250.400.360.14
PCI DSS v40.360.33
0.410.410.330.350.330.390.400.300.330.29
CIS v80.480.530.41
0.540.330.330.390.290.300.510.480.19
NIS20.540.440.410.54
0.330.360.320.320.270.450.470.22
OWASP API Top 100.230.300.330.330.33
0.360.350.260.200.250.310.11
OWASP LLM Top 100.310.290.350.330.360.36
0.390.390.310.370.390.21
OWASP Top 100.330.340.330.390.320.350.39
0.280.270.310.350.17
ISO 277010.290.280.390.290.320.260.390.28
0.300.380.260.29
EU AI Act0.260.250.400.300.270.200.310.270.30
0.400.310.27
GDPR0.450.400.300.510.450.250.370.310.380.40
0.440.21
NIST CSF0.460.360.330.480.470.310.390.350.260.310.44
0.18
EU CRA
TIBER-EU0.190.140.290.190.220.110.210.170.290.270.210.18

OWASP API Top 10NIS2 28 shared techniques

Clear ✕
Control AControl BSharedExamples
API8:2023
Security Misconfiguration
Art. 21(2)(f)
Policies and procedures to assess the effective…
8T1190, T1068, T1055, T1070.004
API3:2023
Broken Object Property Level Authorization (BOPLA)
Art. 21(2)(g)
Basic cyber hygiene practices and cybersecurity…
6T1078, T1087, T1485, T1003
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(a)
Policies on risk analysis and information syste…
6T1078, T1068, T1046, T1087
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(b)
Incident handling
6T1078, T1059, T1046, T1087
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(f)
Policies and procedures to assess the effective…
6T1190, T1078, T1068, T1046
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(a)
Policies on risk analysis and information syste…
5T1005, T1041, T1133, T1078
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(e)
Security in network and information systems acq…
5T1592, T1041, T1490, T1078
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(g)
Basic cyber hygiene practices and cybersecurity…
5T1005, T1041, T1485, T1133
API3:2023
Broken Object Property Level Authorization (BOPLA)
Art. 21(2)(e)
Security in network and information systems acq…
5T1078, T1087, T1490, T1003
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(e)
Security in network and information systems acq…
5T1190, T1078, T1059, T1068
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(g)
Basic cyber hygiene practices and cybersecurity…
5T1078, T1059, T1110, T1087
API7:2023
Server-Side Request Forgery (SSRF)
Art. 21(2)(f)
Policies and procedures to assess the effective…
5T1190, T1046, T1005, T1071.001
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(b)
Incident handling
4T1005, T1041, T1133, T1078
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(c)
Business continuity and crisis management
4T1005, T1041, T1490, T1078
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(d)
Supply chain security
4T1005, T1041, T1490, T1068
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(f)
Policies and procedures to assess the effective…
4T1005, T1041, T1078, T1068
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(h)
Policies and procedures regarding the use of cr…
4T1005, T1041, T1078, T1083
API1:2023
Broken Object Level Authorization (BOLA)
Art. 21(2)(j)
The use of multi-factor authentication or conti…
4T1041, T1133, T1078, T1552
API3:2023
Broken Object Property Level Authorization (BOPLA)
Art. 21(2)(b)
Incident handling
4T1078, T1087, T1003, T1059
API6:2023
Unrestricted Access to Sensitive Business Flows
Art. 21(2)(d)
Supply chain security
4T1068, T1087, T1005, T1071
API7:2023
Server-Side Request Forgery (SSRF)
Art. 21(2)(c)
Business continuity and crisis management
4T1018, T1005, T1041, T1490
API7:2023
Server-Side Request Forgery (SSRF)
Art. 21(2)(d)
Supply chain security
4T1018, T1005, T1041, T1490
API7:2023
Server-Side Request Forgery (SSRF)
Art. 21(2)(e)
Security in network and information systems acq…
4T1190, T1595.002, T1041, T1490
API7:2023
Server-Side Request Forgery (SSRF)
Art. 21(2)(i)
Human resources security, access control polici…
4T1046, T1018, T1005, T1041
API8:2023
Security Misconfiguration
Art. 21(2)(a)
Policies on risk analysis and information syste…
4T1133, T1068, T1046, T1041

Showing top 25 of 59 control pairs.

Show non-overlap — OWASP API Top 10 techniques NOT covered by NIS2 (29)
T1003.008, T1020, T1059.003, T1074, T1074.001, T1082, T1087.001, T1087.004, T1090.003, T1098.005, T1110.003, T1110.004, T1119, T1136, T1498.001, T1499, T1530, T1537, T1550.001, T1550.004, T1552.001, T1552.007, T1552.008, T1556.006, T1562, T1565.001, T1567, T1572, T1595
Sourced from cs-graph compliance_mappings (127 controls across 14 frameworks). Jaccard computed from the union of applicable_techniques per control. Refreshed hourly via ISR. Curated by Adam Lundqvist, Founder at SQUR.
Framework crosswalk — Jaccard similarity grid | SQUR Knowledge Base