14 frameworks127 controls

CROSSWALKFramework crosswalk

14 compliance frameworks mapped to ATT&CK. Click a cell to see overlapping controls and shared techniques. Authored by Adam Lundqvist.

Cells coloured by Jaccard similarity of technique sets.

01
DORAISO 27001PCI DSS v4CIS v8NIS2OWASP API Top 10OWASP LLM Top 10OWASP Top 10ISO 27701EU AI ActGDPRNIST CSFEU CRATIBER-EU
DORA
0.400.360.480.540.230.310.330.290.260.450.460.19
ISO 270010.40
0.330.530.440.300.290.340.280.250.400.360.14
PCI DSS v40.360.33
0.410.410.330.350.330.390.400.300.330.29
CIS v80.480.530.41
0.540.330.330.390.290.300.510.480.19
NIS20.540.440.410.54
0.330.360.320.320.270.450.470.22
OWASP API Top 100.230.300.330.330.33
0.360.350.260.200.250.310.11
OWASP LLM Top 100.310.290.350.330.360.36
0.390.390.310.370.390.21
OWASP Top 100.330.340.330.390.320.350.39
0.280.270.310.350.17
ISO 277010.290.280.390.290.320.260.390.28
0.300.380.260.29
EU AI Act0.260.250.400.300.270.200.310.270.30
0.400.310.27
GDPR0.450.400.300.510.450.250.370.310.380.40
0.440.21
NIST CSF0.460.360.330.480.470.310.390.350.260.310.44
0.18
EU CRA
TIBER-EU0.190.140.290.190.220.110.210.170.290.270.210.18

NIS2NIST CSF 37 shared techniques

Clear ✕
Control AControl BSharedExamples
Art. 21(2)(f)
Policies and procedures to assess the effective…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
12T1078, T1547.001, T1068, T1055
Art. 21(2)(a)
Policies on risk analysis and information syste…
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
11T1547, T1068, T1027, T1003
Art. 21(2)(a)
Policies on risk analysis and information syste…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
9T1078, T1133, T1068, T1027
Art. 21(2)(b)
Incident handling
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
9T1078, T1133, T1055, T1027
Art. 21(2)(d)
Supply chain security
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
9T1547, T1068, T1027, T1003
Art. 21(2)(b)
Incident handling
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
8T1059, T1027, T1003, T1087
Art. 21(2)(f)
Policies and procedures to assess the effective…
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
8T1190, T1566, T1068, T1027
Art. 21(2)(f)
Policies and procedures to assess the effective…
RESPOND
RESPOND (RS) — Take action regarding a detected…
8T1190, T1547.001, T1068, T1070.004
Art. 21(2)(a)
Policies on risk analysis and information syste…
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
7T1036, T1003, T1046, T1087
Art. 21(2)(b)
Incident handling
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
7T1053, T1036, T1003, T1087
Art. 21(2)(d)
Supply chain security
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
7T1195, T1003, T1087, T1018
Art. 21(2)(g)
Basic cyber hygiene practices and cybersecurity…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
7T1133, T1078, T1003, T1027
Art. 21(2)(g)
Basic cyber hygiene practices and cybersecurity…
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
7T1566, T1003, T1027, T1087
Art. 21(2)(i)
Human resources security, access control polici…
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
7T1003, T1005, T1018, T1021
Art. 21(2)(c)
Business continuity and crisis management
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
6T1041, T1005, T1021.001, T1053.005
Art. 21(2)(c)
Business continuity and crisis management
RECOVER
RECOVER (RC) — Restore assets and operations af…
6T1490, T1498, T1529, T1041
Art. 21(2)(c)
Business continuity and crisis management
RESPOND
RESPOND (RS) — Take action regarding a detected…
6T1486, T1041, T1005, T1021.001
Art. 21(2)(d)
Supply chain security
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
6T1068, T1027, T1003, T1087
Art. 21(2)(e)
Security in network and information systems acq…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
6T1078, T1068, T1070.004, T1003
Art. 21(2)(e)
Security in network and information systems acq…
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
6T1190, T1053, T1003, T1087
Art. 21(2)(e)
Security in network and information systems acq…
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
6T1190, T1068, T1003, T1087
Art. 21(2)(f)
Policies and procedures to assess the effective…
IDENTIFY
IDENTIFY (ID) — Understand organisational cyber…
5T1190, T1003, T1087, T1046
Art. 21(2)(h)
Policies and procedures regarding the use of cr…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
5T1003, T1005, T1027, T1041
Art. 21(2)(h)
Policies and procedures regarding the use of cr…
PROTECT
PROTECT (PR) — Use safeguards to manage cyberse…
5T1003, T1005, T1021, T1027
Art. 21(2)(i)
Human resources security, access control polici…
GOVERN
GOVERN (GV) — Establish and monitor the cyberse…
5T1003, T1005, T1027, T1041

Showing top 25 of 58 control pairs.

Show non-overlap — NIS2 techniques NOT covered by NIST CSF (20)
T1003.002, T1012, T1016, T1037, T1039, T1040, T1047, T1048, T1048.001, T1071.002, T1078.003, T1078.004, T1105, T1110, T1114, T1539, T1552, T1588.006, T1592, T1595.002
Sourced from cs-graph compliance_mappings (127 controls across 14 frameworks). Jaccard computed from the union of applicable_techniques per control. Refreshed hourly via ISR. Curated by Adam Lundqvist, Founder at SQUR.
Framework crosswalk — Jaccard similarity grid | SQUR Knowledge Base