Security & GRC framework corpus

This is the directory of security & GRC frameworks worth crosswalking — scoped to Crosswalker’s launch problem domains: cybersecurity, information security, GRC, risk management, internal audit, and regulatory compliance. Each entry links to a durable home/landing page (not a download URL — those rot), notes its license, and whether usable source data is in hand.

Public mapping binding last verified: 2026-10-30 against the deterministic public demo and tests/cli/demo-smoke.test.ts. This verifies mitigation endpoint resolution only, not other corpus acquisition or licence statuses.

Using these in practice

Having the frameworks is step one. Turning them into a working crosswalk graph — cleaning inputs, importing concepts, mapping across frameworks, and storing the transform logic — is the real work. See: unified risk model · for internal audit · for GRC / risk · for regulatory compliance · ETL & import pipeline.

Scope

Not a general framework catalog — every entry sits in the security / GRC / risk / audit space. Crosswalker’s architecture is general-domain, but this corpus is deliberately narrowed to the compliance & risk problem domains that are the primary launch use case.

The landscape — frameworks worth crosswalking

Status = whether usable source data is in hand: ✅ acquired · ⚠️ partial (a crosswalk or subset) · 📥 still to source. (Whether a framework has been ingested and tested through Crosswalker is a separate status that comes online as we run the ingestion → mapping pipeline — see “Using these in practice” above.) License: 🟢 public / free · 🟡 registration / restrictive-CC · 🔴 purchase / copyrighted. Source links go to durable landing pages, not download URLs.

Threat-informed & adversary frameworks (MITRE family + friends)

Framework	What it is	Lic	Status	Source
MITRE ATT&CK (Enterprise/Mobile/ICS)	Adversary tactics & techniques; public demo imports full Enterprise v16.1 plus a separate mitigation set; Mobile/ICS remain later imports	🟢	✅	attack.mitre.org
MITRE D3FEND	Defensive countermeasures ontology; flat catalog and two mapping tables imported in the public demo	🟢	✅	d3fend.mitre.org
MITRE Engage	Adversary engagement / cyber deception & denial (ex-Shield)	🟢	✅	engage.mitre.org
MITRE Fight Fraud Framework (F3)	Fraud adversary tactics & techniques for financial services; reuses some ATT&CK ids (details)	🟢	✅	ctid.mitre.org/fightfraud
MITRE CAPEC	Common Attack Pattern Enumeration	🟢	✅	capec.mitre.org
MITRE CWE	Common Weakness Enumeration	🟢	✅	cwe.mitre.org
CVE / NVD + CISA KEV	Known + exploited vulnerabilities	🟢	⚠️ ATT&CK↔CVE + KEV↔ATT&CK	nvd.nist.gov
MITRE ATLAS	Adversarial AI/ML threat matrix	🟢	✅	atlas.mitre.org
MITRE CAR	Cyber Analytics Repository (detections)	🟢	✅	car.mitre.org
MITRE VERIS	Incident classification taxonomy	🟢	✅	verisframework.org
CTID resource packs	ATT&CK mappings + threat-informed-defense projects; 800-53 to ATT&CK 16.1 imported in the public demo, other capability packs deferred	🟢	✅	ctid.mitre.org
Lockheed Cyber Kill Chain	7-stage intrusion model	🟡	✅	lockheedmartin.com
Diamond Model	Intrusion analysis model	🟢	✅	activeresponse.org

Security control frameworks (the core)

Framework	What it is	Lic	Status	Source
NIST CSF 2.0	Functions / categories / subcategories	🟢	✅	nist.gov/cyberframework
NIST 800-53 r5	Control catalog + assessment	🟢	✅	csrc.nist.gov
NIST 800-171	CUI protection (→ CMMC)	🟢	✅	csrc.nist.gov
NIST SSDF (800-218)	Secure software development	🟢	✅	csrc.nist.gov/projects/ssdf
NIST 800-207	Zero Trust Architecture	🟢	✅	csrc.nist.gov
NIST Privacy Framework	Privacy risk (CSF-shaped)	🟢	📥	nist.gov/privacy-framework
CIS Controls v8.1	18 controls / 153 safeguards	🟡	✅	cisecurity.org/controls
CIS Benchmarks (~20)	Per-technology hardening (AWS, Azure, GCP, K8s, M365, SQL Server, …)	🟡	✅	cisecurity.org
ISO/IEC 27001 + 27002	ISMS requirements + Annex A control catalog	🔴	✅ 27001:2022 (+Amd 1:2024) + 27002:2022	iso.org
ISO 27701 / 27017 / 27018	Privacy (PIMS) / cloud / PII ISMS extensions	🔴	⚠️ have 27701:2025; 27017/27018 missing	iso.org
Secure Controls Framework	175+ framework hub via STRM (+ maturity & risk models)	🟡	✅	securecontrolsframework.com
CSA Cloud Controls Matrix	Cloud control framework	🟡	✅ CCM 4.1 (via CTID pack)	cloudsecurityalliance.org
AICPA SOC 2 / TSC	Trust Services Criteria	🔴	✅	aicpa-cima.com

Sector, cloud & assurance programs

Framework	What it is	Lic	Status	Source
CRI Profile (v2.0–2.2)	Financial-sector spine + mappings catalog + DORA / 800-53 / ATT&CK crosswalks + FS-AI-RMF	🔴	✅	cyberriskinstitute.org
FFIEC IT Handbook	US FI examination booklets	🟢	✅	ithandbook.ffiec.gov
FedRAMP	US gov cloud authorization	🟢	✅	fedramp.gov
PCI DSS v4.0.1	Payment card security	🔴	✅	pcisecuritystandards.org
HIPAA Security Rule	US healthcare PHI	🟢	✅	hhs.gov/hipaa
CMMC	US DoD contractor maturity	🟢	✅	dodcio.defense.gov/CMMC
CISA CPG	Cross-sector performance goals	🟢	✅	cisa.gov
HITRUST CSF v11.8	Healthcare-centric certifiable framework	🔴	✅	hitrustalliance.net
NERC CIP	Energy / grid critical infrastructure	🟢	📥	nerc.com
SWIFT CSP	Financial messaging security	🔴	📥	swift.com

Regulatory & legal obligations (obligation-centric)

Regulation	Jurisdiction	Lic	Status	Source
DORA	EU financial digital resilience	🟢	✅	EUR-Lex (ELI 2022/2554)
NIS2	EU critical-entity security	🟢	📥	EUR-Lex (ELI 2022/2555)
GDPR	EU data protection	🟢	⚠️ TSC→GDPR crosswalk	EUR-Lex (ELI 2016/679)
NYDFS Part 500	US (NY) financial cyber	🟢	📥	dfs.ny.gov
SEC cyber disclosure (33-11216)	US public-company disclosure (8-K Item 1.05 + Reg S-K Item 106)	🟢	✅	Federal Register (2023-16194)

Risk management & quantification

Framework	What it is	Lic	Status	Source
NIST 800-30 / 800-39	Risk assessment + risk-mgmt process	🟢	📥	csrc.nist.gov
ISO 31000 / 27005	Risk mgmt principles / infosec risk	🔴	⚠️ have 31000:2018; 27005 missing	iso.org
FAIR / Open FAIR	Quantitative cyber-risk taxonomy	🟡	📥	fairinstitute.org
NIST AI RMF	AI risk management (AI 100-1)	🟢	✅	nist.gov
CRI FS-AI-RMF	Financial-services AI risk & control matrix (stages 1–3 + tier 4)	🔴	✅	cyberriskinstitute.org
ISO 42001	AI management system	🔴	📥	iso.org

Application, product & supply-chain security

Framework	What it is	Lic	Status	Source
OWASP Top 10	Web app risk list (Top 10 ↔ CWE via OSIB YAML export)	🟢	✅	owasp.org · GitHub
OWASP ASVS v5.0	App security verification standard	🟢	✅	owasp.org
OWASP SAMM v2	Software assurance maturity	🟢	✅	owaspsamm.org
OWASP MASVS	Mobile app security	🟢	✅	mas.owasp.org
SLSA	Supply-chain integrity levels	🟢	✅	slsa.dev
BSIMM	Software security maturity (descriptive)	🟡	📥	bsimm.com

Internal audit & governance models

Framework	What it is	Lic	Status	Source
IIA Global Internal Audit Standards (2024)	Internal-audit profession standards — 5 domains / 15 principles / 52 standards (PDF only, no structured file)	🔴	✅	theiia.org/standards
IIA Topical Requirements	Mandatory audit requirement sets — Cybersecurity, Third-Party, Org Resilience (crosswalk to NIST/CRI/DORA)	🔴	✅	theiia.org
COSO Internal Control + ERM	Governance / internal-control / ERM	🔴	📥	coso.org
COBIT 2019	IT governance & management (objectives/practices/activities XLSX in the toolkit)	🔴	✅	isaca.org/cobit
IIA Three Lines Model	Risk governance roles	🟢	✅	theiia.org

Pulling the missing ones

Most 📥 items have a free machine-readable door (MITRE on GitHub/STIX, NIST via CPRT/OSCAL, OWASP on GitHub, EU law via EUR-Lex ELI permalinks, US regulations via federalregister.gov JSON/XML). The 🔴 purchase-only ones (ISO, COBIT, COSO, HITRUST, SWIFT) usually have a proxy — SCF’s STRM mapping columns already encode the relationships, so you can crosswalk to them without their copyrighted text.

Public demo coverage

Status last verified: 2026-10-30 — scoped to ATT&CK v16.1, D3FEND and their held public crosswalk source bindings (scripts/demo-build.mjs, the source files named in the data-sources reference, and tests/cli/demo-smoke.test.ts). Other landscape acquisition rows are unchanged.

The demo now uses the full Enterprise v16.1 technique catalog and separate mitigation notes, alongside NIST CSF 2.0, SP 800-53 r5 and F3. D3FEND adds a flat defensive-technique catalog, NIST control mappings and ATT&CK mitigation mappings. CTID’s 800-53-to-ATT&CK set targets 16.1. The CSF concept crosswalk is checked against the existing CSF mapping before deciding whether a separate set adds information. Source counts, download links, licences, transformation rules and the relation-field projection gap live in the canonical source reference.

Public crosswalk input	Demo import status
CTID SP 800-53 Rev. 5 to ATT&CK 16.1	Separate publisher mapping set; exact duplicate and non_mappable rows counted separately
CSF 2.0 concept crosswalk to SP 800-53	Same pairs as the existing CSF-to-800-53 set; not imported separately
D3FEND NIST semantic table	Separate conservative related mappings; publisher relation direction unverified
ATT&CK mitigation-to-D3FEND table	Separate mapping set; empty mapping cells counted and skipped. All endpoints resolve after collision-based identity selection; no publisher identifiers are rewritten

Release follow-up: fetch the current 800-53 rev5 release as a new set. The demo CSV does not record a minor release and lacks IA-13; the held OSCAL archive’s revision history identifies IA-13 as a 5.1.1 addition, and its current catalog is 5.2.0. Reuse that held archive where appropriate rather than guessing the CSV’s version. The separate Mobile ATT&CK import planned with the STIX reader can resolve the publisher’s Mobile-matrix endpoint in its Enterprise mapping. Neither gap authorizes retargeting identifiers or inventing stub concepts (sources: Frameworks/NIST_SP-800-53_rev5_catalog_load.csv, the held nist.gov-SP800-53_rev5 archive metadata, and Frameworks/mobile-attack.json; source-reference context).

Tracked F3 source files

Status last verified: 2026-10-29 — the F3 files below were downloaded from the pinned upstream revision and checked against both worksheets and the demo output. Other landscape rows retain their historical acquisition status; this is not a re-verification of the whole corpus.

The full public F3 v1.2 source now ships in the repository, rather than relying on a local download or the synthetic test fixture. All files are pinned to upstream commit 281be11eed4670e763a2ed57dd2274948f54a523, downloaded 2026-10-29, under Apache-2.0.

Tracked file	Purpose and verified content
Frameworks/f3-excel-v1.2.xlsx	Publisher’s v1.2 workbook: 138 Techniques rows, including 41 multi-tactic rows and 55 sub-techniques; 8 Tactics rows
Frameworks/LICENSES/mitre-f3-LICENSE.txt	Unmodified upstream Apache License 2.0; also copied into the generated F3 demo folder as LICENSE.txt, and as LICENSE.md (same text in a code block) for hosts that accept only Markdown
Frameworks/mitre-f3-source.json	Upstream SHA, download date, source paths, file digests and verified counts

Counts source: the tracked workbook’s Techniques and Tactics sheets, pinned in Frameworks/mitre-f3-source.json and checked by tests/mitre-f3-demo-recipes.test.ts. The data-sources reference explains the shipped linked default and the preserved previous default. The 2026-10-29 follow-up records the move from sample rows to the full linked catalog without changing existing recipe digests.

Licensing & copyright — what Crosswalker can share

This corpus gives broad licence tiers across the landscape. For the supported sources Crosswalker imports today, use the neighbouring framework data sources reference for publisher-specific cautions, exact acquisition routes, and the distinction between obtaining a source and sharing generated notes.

Raw framework sources split three ways for handling:

Tier	Frameworks	Handling
🟢 Public domain / free	NIST, MITRE, FedRAMP, FFIEC, HIPAA, CMMC, CISA, DORA + EU law	commit-safe
🟡 Registration / restrictive CC	CIS (Controls + Benchmarks), Secure Controls Framework	local only
🔴 Copyrighted	CRI, ISO, AICPA / SOC 2, PCI, HITRUST, COBIT, COSO, IIA	local only

The raw corpus lives at repo-root Frameworks/ — local-by-default (fail-closed gitignore); copyrighted source files go in Frameworks/_licensed/ and are never committed.

The part that matters for using them: Crosswalker stores the transform logic (the import recipes + crosswalk mappings) and your derived output (paraphrased concept notes + crosswalk junction notes) — not the raw copyrighted text. So the mapping logic stays shareable even when the source standard isn’t, which is how copyrighted inputs (CRI, ISO, PCI) can feed a crosswalk graph you can still publish. That’s the schema-as-primitive idea.

Open question — being worked out

Exactly how much of each source can be stored and shared (full IDs + titles? structure only? transform recipe only?) depends on the source’s license and is still being worked out. The safe default today: keep copyrighted raw files in _licensed/, share only derived/paraphrased output + mapping logic. Flagged for deeper review before publishing crosswalks built on 🔴 sources.

Related

• ETL & import pipeline — how sources get cleaned, ingested, and mapped (schema-as-primitive)
• Unified risk model — the CRI-centered shared model this corpus feeds
• Using in practice — per-domain implementations (internal audit, GRC/risk, regulatory compliance)
• Control-centric vs obligation-centric compliance — why control frameworks and regulations sit differently
• Registry — each framework’s home page + canonical facts
• Framework data sources — canonical acquisition, licence, bundled-recipe, verified binding, count, and import-gotcha reference