Quick start

You need Crosswalker installed and enabled and a framework file to import: a CSV, XLSX, or JSON export of controls, requirements, or techniques. If you do not have the file yet, use the framework data sources guide to find the publisher download, matching bundled recipe, licence caution, and exact import binding.

Status last verified: 2026-10-03 — The Installed stacks release line was verified against a real-Obsidian run of tests/e2e/mapping-set-envelope.spec.ts. Earlier, 2026-10-02: the Run it again paragraph was verified against fresh real-Obsidian runs of tests/e2e/recipe-run-again.spec.ts and tests/e2e/visual-recipe-library.spec.ts (screenshots in both themes). The Save the setup as a recipe section (Save as recipe, the Your recipe offer, Use a saved recipe, Browse import recipes) was verified against fresh real-Obsidian runs of tests/e2e/recipe-library-flow.spec.ts and tests/e2e/visual-recipe-library.spec.ts (screenshots in both themes). Verified 2026-09-30: The Profile control on the stack picker (Light, Standard, Complete, Custom), its description and hint line, and Light putting every new mapping row on Table at review were verified against a fresh real-Obsidian run of tests/e2e/visual-stack-setup.spec.ts (screenshots in both themes). The Review mappings row action on a table set and the mapping review it opens (search, status filter, one-row and bulk review edits saved to the table and kept across a reload) were verified against a fresh real-Obsidian run of tests/e2e/mapping-review.spec.ts (screenshots in both themes). The Convert to table / Convert to notes row actions, their confirmation, and the Finish / Cancel states of an interrupted conversion were verified against a fresh real-Obsidian run of tests/e2e/mapping-conversion.spec.ts (screenshots in both themes). The Store as choice on mapping rows, its trade-off line, the table completion line and the installed-stack table row were verified against fresh real-Obsidian runs of tests/e2e/visual-stack-setup.spec.ts and tests/e2e/first-run-stack.spec.ts (screenshots in both themes). The rest of the framework stack section was verified 2026-09-28 against fresh real-Obsidian runs of tests/e2e/visual-stack-setup.spec.ts, tests/e2e/first-run-stack.spec.ts, and tests/e2e/installed-stacks.spec.ts (screenshots of every screen). The single-file section was last verified 2026-08-28 against the empty-vault tests/e2e/first-run.spec.ts run.

Not yet verified in real Obsidian (2026-09-21): the vault scan and the worksheet suggestion described below shipped on an unmerged branch without a screenshot run.

Pick your path

You want to…	Use	Section
Bring in several frameworks and the mappings that connect them, in one guided run	Set up a framework stack	Set up a framework stack
Import one spreadsheet or export, or any file Crosswalker does not recognize, and control every column	Import structured data	Import your first framework

Both start from the Start here row on the Crosswalker workspace tab, and both write ordinary notes you can edit.

Set up a framework stack

A framework stack is a set of frameworks your team works with (for example CRI Profile, NIST 800-53, and MITRE ATT&CK) plus the mapping files that link their controls to each other. Crosswalker imports each framework, then each mapping, so the result is one connected graph instead of separate folders.

Open it with the Set up a framework stack button on the workspace tab (or in Settings > Crosswalker), or run Crosswalker: Set up a framework stack from the command palette.

Step	Screen	What you do	What to watch for
1	Set up a framework stack	Tick your frameworks under Frameworks. Choices: CRI Profile v2.2, MITRE ATT&CK techniques, NIST 800-53 Rev 5, NIST CSF 2.0 (CPRT export, nested), CIS Controls v8 (controls), Secure Controls Framework (2026). Connections this stack will import lists the mappings your choices unlock; Optional local mappings lists extras you can tick. Set Detail near the bottom, then choose Next: download checklist	Tick CRI Profile and NIST 800-53 together and NIST CSF 2.0 is ticked for you, because it is the bridge between them. Untick it to leave that route disconnected
2	Download these files	Follow each publisher link and save the files anywhere in the vault. Copy checklist copies the list as plain text. Choose Next: add the files	Rows marked Built in or From file above need no download. Some sources (CRI Profile, CIS Controls) require free registration and are licensed for your own local use: you download them yourself, and Crosswalker never ships them
3	Add the files	Drop files onto the box, click Choose Files, or type a Vault folder and click Choose folder. Choose Next: review once every framework shows a file	Each framework row reads Recognized (with the sheet and header row it found), Might match (click Use anyway if you are sure), Wrong file, or Missing. Wrong-file messages name the fix, for example the ATT&CK STIX bundle instead of the Excel export, or a workbook’s change-log sheet. A file that fits a framework you did not tick is listed as Not in this stack. Two files for one slot offer Use this file or Keep first file
4	Review before import	Check each framework’s one-line summary of what becomes a folder or a note, where it lands, and Import set: New set. Each row shows how many notes and folders it writes, and a total line sums the run. Rename the stack under Stack name if you like. Choose Import stack (N files). Runs above 1,000 files ask you to confirm first; change that under Settings, Advanced. Each mapping that will be a new set has a Store as choice, Notes or Table (source: src/generation/import-set-block.ts MAPPING_FORMS), pre-filled from Default mapping storage under Settings, Advanced. Table writes one file that opens in a spreadsheet and counts as one file in the total	Check for refresh tells you if this exact file was imported before, but never switches to refresh for you. Any mapping still missing its file stops the run before anything is written. With Table selected, a line under the choice says what you give up: those mappings do not appear in Bases views, graph view or backlinks
5	Import runs	Wait	Frameworks import first, then each mapping. If a step fails, the button becomes Retry remaining and finished frameworks are not redone
6	Framework stack imported	Read the counts, then choose Done	Each framework and mapping is listed with its note count and import set id; a mapping stored as a table reads 1 mapping table, N rows instead. A mapping line that could not link to a framework note is kept and reported, never faked. After you import the missing framework, Reconnect mappings links them without re-importing

Profile, above Detail on the first screen, sets detail, mapping storage and optional mappings in one choice: Light (top framework levels as notes, each mapping as one table), Standard (every level as notes, one note per mapping; the default), or Complete (Standard plus the optional mappings); changing any of those by hand shows Custom.

Detail has two settings. It only changes NIST 800-53 and CRI Profile; the other frameworks come out the same either way:

Detail	What you get
Every framework level as notes (default)	Every level becomes a note, including 800-53 control enhancements and CRI diagnostic statements
Top framework levels as notes	800-53 enhancements and CRI diagnostic statements are left out. Mapping lines that point at them stay unlinked on purpose

Running a stack again

After the first run, the workspace tab shows an Installed stacks panel. Each stack card lists every framework and mapping with its state (its set and note count, or for a table its row count, Not imported yet, or a set that is no longer in the vault). A mapping set that carries a release record also shows Release: name version under its line. Each card has three buttons:

Button	What it does
Run again	Reopens the flow with your stack’s choices. On the review screen each row gets an Import set choice: Skip (already imported, unchanged) when the file matches what you imported last time, Refresh set followed by its id to update that set in place, or New set for a separate copy. A changed file defaults to New set; refresh is always your choice, never automatic. A refreshed mapping keeps the storage it was imported with, shown as Stored as; a table refresh keeps each row’s review columns
Export	Downloads the stack definition as JSON and copies it to the clipboard, so a teammate can use Import a stack. Your vault’s import history is not included
Delete	Removes the saved stack only. Its notes and import sets stay in the vault

Each recorded mapping row also has Convert to table or Convert to notes, which switches how that set is stored, carries its reviews over, and moves the old form to the trash only after the new one is verified; an interrupted conversion shows Finish (and Cancel until the old form starts going to the trash) on the row and on the next start, as explained in the mapping storage decision. A mapping stored as a table also has Review mappings, which opens its rows in a searchable grid where you set each mapping’s review status, reviewer and review notes, one row at a time or for a whole filtered selection, and saves them back into the table.

Where to download each file, and the licence terms for each source, are in framework data sources.

Import your first framework

1. Open the Crosswalker workspace tab. Click the network-shaped ribbon icon, click the status bar count, or run Crosswalker: Start here: open workspace from the command palette (Ctrl/Cmd + P). You can also right-click a CSV, XLSX, or JSON file in the file explorer and choose Import into vault with Crosswalker, which skips straight to configuring it.

2. Pick your file. Above the picker, Browse built-in import presets lists every framework Crosswalker recognizes on sight, with a link to where you download each publisher’s file and a link to the matching import instructions. If the file is already in the vault, Find sources in this vault on the workspace tab lists every framework export it recognizes and opens the one you pick where you decide what becomes real. For example, a NIST 800-53 controls export. Large CSVs stream in, so multi-megabyte files are fine. For XLSX you also pick the worksheet and header row; for JSON you pick which list of records to import. Before trusting a recognized-source import, check its verified sheet, header row, count, and silent-failure gotchas.

3. Take the fast path if it’s offered. When your file’s columns match a framework Crosswalker already knows (NIST CSF 2.0, NIST 800-53, MITRE ATT&CK, CIS Controls v8, the Secure Controls Framework, CRI Profile, and crosswalk files), a Recognized source card appears with a summary of what it found. For a recognized workbook, Crosswalker suggests the worksheet and header row, but keeps both controls editable and never advances for you. Choose Import with this configuration to accept it, or Customize to adjust it first.

4. Otherwise, map your columns. Tell Crosswalker what each column is for: which ones become folders, which become note titles, which become note properties, which become links to other notes, and which become body text. A live preview on the right shows a real folder tree and one fully rendered note, updating as you change things.

5. Review and confirm. The review screen shows the destination folder, a recap of every mapping, how many notes, folders, and links you’ll get, and a plain-language warning if some rows don’t fit the pattern you built.

6. Generate. Crosswalker writes the folders and notes into your vault.

Full detail on every screen is on the import wizard page.

Save the setup as a recipe

Once an import looks the way you want, keep its shape so next quarter’s export takes one click.

1. Save it. On the review screen (or after generating), choose Save as recipe, give it a name and an optional one-line description. A recipe saves how columns become folders, notes, properties and links. Your source file is not saved.
2. Reuse it. On the next import, pick the new file. If it matches a recipe you saved, a card labeled Your recipe offers it; nothing is chosen for you. You can also choose Use a saved recipe on the first step and pick one yourself.
3. Browse and share. Run Crosswalker: Browse import recipes (or open Import recipes in settings) to inspect what each recipe does in folder-and-note terms, and to export, import, duplicate, rename or delete recipes. Each recipe is one .json file in _crosswalker/import-recipes/, so you can hand it to a teammate or keep it in version control. Separately, each import keeps a copy of the exact recipe it ran under _crosswalker/import-sets/, so exporting those notes as CSV works even for a recipe you never saved or edited later.

Editing a built-in or saved recipe and saving it again makes a new recipe that records what it was based on. A recipe you saved yourself can also be replaced in place; the old version goes to the trash.

Run it again. Once a recipe has run, its card in Browse import recipes shows when and into which set, and offers Run again (or Import as a new set for a separate copy). Run again refreshes that same set and asks only for the file. The first step names the set and says what will happen to its notes; once you pick the file, it says whether the file matches the last run (nothing new is added; only fields the recipe fills are put back if someone edited them) or has changed since. The review and generate steps name the set again. Start a new import instead leaves Run again and clears its choices. If the set was deleted, Next stays off until you choose Import as a new set.

What you get

One note per row under your output folder (Ontologies by default). The bundled NIST 800-53 setup uses a flat layout, so the notes sit directly in that folder:

Ontologies/
├── AC-1.md
├── AC-2.md
├── AC-2(1).md
└── AU-1.md

Other import setups can use nested folders, headings, tags, links, or a combination. Crosswalker recognizes an imported framework from the identity recorded inside each generated note, not from the folder shape.

Each note carries your mapped columns as Obsidian properties, links to related notes, and a small record of where it came from:

---
curie: "nist-mini:AC-2(1)"
title: Automated System Account Management
aliases:
  - AC-2(1)
tags:
  - framework/nist-mini/ac
family: AC
family_name: Access Control
control_id: AC-2(1)
parent: "[[AC-2]]"
_crosswalker:
  spec_version: "https://crosswalker.dev/spec/tier1.schema.json"
  source_ref:
    file: nist-mini.csv
    source_hash: sha256-380a762cd51be31c9f5d71ef8725a7863d3d07055a54e22dc5be3776088eac8a
  produced_at: "2026-05-04T00:00:00.000Z"
  producer:
    kind: plugin-engine
    name: crosswalker-plugin
    version: 0.1.0
---

# Automated System Account Management

## Description

Support the management of system accounts using automated mechanisms.

The _crosswalker block is how a re-import recognizes its own notes, so it updates them rather than creating duplicates. See the generation engine for exactly what lands in each note.

What a re-import preserves, and what it does not

You can write in a generated note. Crosswalker owns a marked-off region of the body and rebuilds only that. Everything you type outside it survives a re-import exactly as you left it.

The region is delimited by two comment lines, invisible when you read the note and visible while you edit it:

<!-- crosswalker:body:start v=1 -->
# Automated System Account Management
...imported content, rebuilt on every import...
<!-- crosswalker:body:end -->

Our implementation: SSO provisioning via Okta.
Evidence: ticket SEC-4192.

Write below the end marker (or above the start marker). Text you put inside the region is Crosswalker’s to rebuild, and will be replaced.

What each existing-file mode does:

Mode	Effect on a note that already exists
Skip existing (the default)	The note is left completely untouched. Nothing you wrote is at risk
Replace	Frontmatter keys you added are merged back, and only the marked region of the body is rebuilt. Every byte outside it is preserved
Error	The import stops rather than touching the existing note

Notes from before this feature, which have no markers yet, are adopted the first time you re-import them: if the body still matches what the import would generate, Crosswalker adds the two marker lines and changes nothing else. If the body has been edited, Crosswalker leaves the file completely alone and lists it on the results screen as a note it could not safely update. It never guesses.

The same rule covers a note whose markers have been damaged, or one written by a newer version of Crosswalker: the file is not modified at all, and the import continues with the rest.

Status last verified: 2026-08-27 — verified against src/generation/managed-body.ts, src/generation/existing-note.ts, and the tests/e2e/replace-preservation.spec.ts run in real Obsidian.

Where the settings are

Everything configurable lives in Settings > Crosswalker: the output folder, how property names are cased, how multi-value cells become lists, link style, how eagerly saved configurations are suggested, and the toggle for the live mapping workbench under Import behavior. See the settings reference.

Next steps

• For GRC teams — mapping your policies and audit evidence to the controls you just imported
• Import wizard — every screen, the recognized-source fast path, and pausing mid-import
• Config system — save a mapping once, reuse or share it
• The problem — why Crosswalker works the way it does

Related

• Installation
• Framework data sources — publisher downloads, licence posture, bundled recipes, and import gotchas
• Settings reference
• Generation engine
• Terminology