The Crosswalk Library
Every NIST CSF 2.0 subcategory, mapped to 3 frameworks. Identifier-only informative references drawn from NIST CPRT/OLIR. Free, ungated, no email required.
CSF 2.0 → ISO/IEC 27001:2022 (106)
DE.AE-02DE.AE-03DE.AE-04DE.AE-06DE.AE-07DE.AE-08DE.CM-01DE.CM-02DE.CM-03DE.CM-06DE.CM-09GV.OC-01GV.OC-02GV.OC-03GV.OC-04GV.OC-05GV.OV-01GV.OV-02GV.OV-03GV.PO-01GV.PO-02GV.RM-01GV.RM-02GV.RM-03GV.RM-04GV.RM-05GV.RM-06GV.RM-07GV.RR-01GV.RR-02GV.RR-03GV.RR-04GV.SC-01GV.SC-02GV.SC-03GV.SC-04GV.SC-05GV.SC-06GV.SC-07GV.SC-08GV.SC-09GV.SC-10ID.AM-01ID.AM-02ID.AM-03ID.AM-04ID.AM-05ID.AM-07ID.AM-08ID.IM-01ID.IM-02ID.IM-03ID.IM-04ID.RA-01ID.RA-02ID.RA-03ID.RA-04ID.RA-05ID.RA-06ID.RA-07ID.RA-08ID.RA-09ID.RA-10PR.AA-01PR.AA-02PR.AA-03PR.AA-04PR.AA-05PR.AA-06PR.AT-01PR.AT-02PR.DS-01PR.DS-02PR.DS-10PR.DS-11PR.IR-01PR.IR-02PR.IR-03PR.IR-04PR.PS-01PR.PS-02PR.PS-03PR.PS-04PR.PS-05PR.PS-06RC.CO-03RC.CO-04RC.RP-01RC.RP-02RC.RP-03RC.RP-04RC.RP-05RC.RP-06RS.AN-03RS.AN-06RS.AN-07RS.AN-08RS.CO-02RS.CO-03RS.MA-01RS.MA-02RS.MA-03RS.MA-04RS.MA-05RS.MI-01RS.MI-02
CSF 2.0 → PCI DSS v4.0 (101)
DE.AE-02DE.AE-03DE.AE-04DE.AE-06DE.AE-07DE.AE-08DE.CM-01DE.CM-02DE.CM-03DE.CM-06DE.CM-09GV.OC-01GV.OC-02GV.OC-03GV.OC-04GV.OC-05GV.OV-01GV.OV-02GV.OV-03GV.PO-01GV.PO-02GV.RM-01GV.RM-03GV.RM-04GV.RM-05GV.RM-06GV.RR-01GV.RR-02GV.RR-03GV.RR-04GV.SC-01GV.SC-02GV.SC-03GV.SC-04GV.SC-05GV.SC-06GV.SC-07GV.SC-08GV.SC-09GV.SC-10ID.AM-01ID.AM-02ID.AM-03ID.AM-04ID.AM-05ID.AM-07ID.AM-08ID.IM-01ID.IM-02ID.IM-03ID.IM-04ID.RA-01ID.RA-03ID.RA-04ID.RA-05ID.RA-06ID.RA-07ID.RA-09ID.RA-10PR.AA-01PR.AA-02PR.AA-03PR.AA-04PR.AA-05PR.AA-06PR.AT-01PR.AT-02PR.DS-01PR.DS-02PR.DS-10PR.DS-11PR.IR-01PR.IR-02PR.IR-03PR.PS-01PR.PS-02PR.PS-03PR.PS-04PR.PS-05PR.PS-06RC.CO-03RC.CO-04RC.RP-01RC.RP-02RC.RP-03RC.RP-04RC.RP-05RC.RP-06RS.AN-03RS.AN-06RS.AN-07RS.AN-08RS.CO-02RS.CO-03RS.MA-01RS.MA-02RS.MA-03RS.MA-04RS.MA-05RS.MI-01RS.MI-02
CSF 2.0 → NIST SP 800-53 Rev. 5 (106)
DE.AE-02DE.AE-03DE.AE-04DE.AE-06DE.AE-07DE.AE-08DE.CM-01DE.CM-02DE.CM-03DE.CM-06DE.CM-09GV.OC-01GV.OC-02GV.OC-03GV.OC-04GV.OC-05GV.OV-01GV.OV-02GV.OV-03GV.PO-01GV.PO-02GV.RM-01GV.RM-02GV.RM-03GV.RM-04GV.RM-05GV.RM-06GV.RM-07GV.RR-01GV.RR-02GV.RR-03GV.RR-04GV.SC-01GV.SC-02GV.SC-03GV.SC-04GV.SC-05GV.SC-06GV.SC-07GV.SC-08GV.SC-09GV.SC-10ID.AM-01ID.AM-02ID.AM-03ID.AM-04ID.AM-05ID.AM-07ID.AM-08ID.IM-01ID.IM-02ID.IM-03ID.IM-04ID.RA-01ID.RA-02ID.RA-03ID.RA-04ID.RA-05ID.RA-06ID.RA-07ID.RA-08ID.RA-09ID.RA-10PR.AA-01PR.AA-02PR.AA-03PR.AA-04PR.AA-05PR.AA-06PR.AT-01PR.AT-02PR.DS-01PR.DS-02PR.DS-10PR.DS-11PR.IR-01PR.IR-02PR.IR-03PR.IR-04PR.PS-01PR.PS-02PR.PS-03PR.PS-04PR.PS-05PR.PS-06RC.CO-03RC.CO-04RC.RP-01RC.RP-02RC.RP-03RC.RP-04RC.RP-05RC.RP-06RS.AN-03RS.AN-06RS.AN-07RS.AN-08RS.CO-02RS.CO-03RS.MA-01RS.MA-02RS.MA-03RS.MA-04RS.MA-05RS.MI-01RS.MI-02
Bayou Bytes
One email each Tuesday: the week’s threats that matter, one copy-paste hardening step, and the script to explain it to a non-technical stakeholder. Free, no pitch.
One email each Tuesday: the week’s threats that matter, one copy-paste hardening step, and the script to explain it to a non-technical stakeholder. Free, no pitch.
© The Security Gator LLC · These mappings are informative references and a practical starting point — not a compliance determination, audit opinion, or legal advice. Mapping strength varies by environment; review and adapt every mapping to your organization and obligations with a qualified professional. · Source: NIST CSF 2.0 Informative References (CPRT/OLIR). Identifiers only — no copyrighted standard text is reproduced. Framework names and control identifiers are the property of their respective owners. · thesecuritygator.com · AxiomLens — the deck behind the library →