Framework data sources

Crosswalker ships recognized-source imports for the framework files below today. This page is the canonical technical reference for obtaining each source, choosing the matching recipe, selecting the exact worksheet and header row, checking the real record count, and avoiding imports that look successful but are wrong.

Status last verified: 2026-11-03 — F3 and CPRT linked defaults checked against their previous recipe bytes, held-source CLI imports and regression tests: F3 retains 138 row identities with 8 tactic hubs, 55 parent links and 191 memberships; CPRT retains 679 concept identities with 17 folder index hubs. The public demo build validates all generated notes. These checks cover the F3 and CPRT bindings only. Earlier, 2026-11-02: the public demo now uses the linked defaults in recipes/import/; ATT&CK technique identities, dotted parents and tactic hub membership verified by tests/demo-public-sources.test.ts and a passing real-build tests/cli/demo-smoke.test.ts. This re-check covers the demo bindings only. Earlier, 2026-10-30: shared-namespace qualification and endpoint counts checked against src/generation/import-set.ts, the identity-planner regression tests and deterministic public demo builds. ATT&CK v16.1 and flat D3FEND source bindings checked against the held workbook/CSVs and demo recipes; crosswalk transformations checked against tools/lib/demo-public-sources.ts and src/import/stack/mapping-readers.ts. This is scoped verification, not a re-check of other source families. Earlier: the MITRE F3 binding, source bytes and demo links re-checked against the tracked v1.2 workbook, pinned upstream commit 281be11eed4670e763a2ed57dd2274948f54a523, both demo-only recipes and a validated demo build (sources: Frameworks/mitre-f3-source.json, tests/mitre-f3-demo-recipes.test.ts, tests/cli/demo-smoke.test.ts); other rows unchanged since 2026-09-24, when stack mapping sources verified against a local real-file stack run (tests/e2e/local-real-stack.spec.ts); nested stack recipe IDs and layouts verified against recipes/import/nist-800-53-nested.json and recipes/import/cri-profile-v2-2-nested.json; historic source row counts retain their earlier verification.

The bundled recipes live in the Crosswalker plugin repository. Community recipes and contribution guidance live in crosswalker-recipes. Framework content is not bundled in the plugin release: obtain each source from its publisher and confirm that the publisher’s terms fit your use. Selected redistributable sources, including F3, are tracked separately in the repository corpus for offline demo builds.

Silent-failure checklist

Check these before trusting an import

These failures can produce plausible row counts, valid-looking notes, or no error at all.

1. CIS float collapse: safeguard identifiers are numeric cells. A raw-value reader turns 4.10 into the float 4.1, colliding with safeguard 4.1. One note disappears silently. Crosswalker reads formatted cell values to keep the identifiers distinct.
2. CRI header index: the CRI v2.2 header is at row index 2. Index 1 still returns the correct 472 rows, but names every column __EMPTY, so a row-count-only check falsely passes.
3. NIST line counting: the NIST SP 800-53 CSV has about 2,605 physical lines because control text contains embedded newlines, but it has 1,189 records. wc -l does not measure CSV records.
4. Row selection: the CSF workbook has 46 banner rows; the two CIS recipes share one sheet containing two row kinds; and the two CPRT recipes encounter 227 non-concept elements. Pointing a recipe at a collection that mixes row kinds is what silently collapses rows onto empty or duplicate paths. Each of those five bundled recipes now declares its own row predicate, so you can point it at the full source collection and skip the manual prefilter that used to be required. A recipe you write yourself still needs one: a source that mixes row kinds and a recipe that does not say which kind it wants is the failure.
5. SCF width and volume: the SCF workbook is 369 columns wide. Naive automation can throw RangeError while enumerating a row. Its practical scale pressure is about 9 MB of generated body text, not its 1,468-row count.

Verified source bindings

Framework	Source collection	Exact sheet	Header row index	Parsed rows	Bundled recipe
NIST SP 800-53 Rev. 5	CSV lineage	CSV header	0	1,189 records	nist-800-53-flat
NIST CSF 2.0	Core workbook	CSF 2.0	1	231 total: 185 subcategory rows + 46 banner rows	nist-csf-2-flat
NIST CSF 2.0	CPRT JSON	element collection	n/a	906 total: 679 concept elements + 227 non-concept (excluded by the recipe)	nist-csf-2-cprt-linked (default), nist-csf-2-cprt-hierarchical (previous default), nist-csf-2-cprt
NIST CSF 2.0 withdrawal lineage	Derived edge list (recipes/import/crosswalks/nist-csf-2-withdrawal-lineage.csv)	CSV header	0	279 total: 127 successor references + 152 pass-through rows	nist-csf-2-withdrawal-lineage
MITRE ATT&CK Enterprise	Excel export	techniques	0	656	mitre-attack-technique-flat
MITRE Fight Fraud Framework (F3)	Excel export (f3-excel-v1.2.xlsx)	Techniques	0	138	mitre-f3-technique-linked (default), mitre-f3-technique-flat (previous default)
CIS Controls v8.1.2	Controls workbook	Controls v8.1.2	0	171: 153 safeguards + 18 controls	cis-controls-v8-flat, cis-controls-v8-controls
CRI Profile v2.2	Profile workbook	CRI Profile v2.2 Structure	2	472: F 7 / C 28 / S 119 / DS 318	cri-profile-v2-2-flat
Secure Controls Framework 2026.1	SCF workbook	SCF 2026.1	0	1,468 × 369 columns	scf-2026-flat

Stack detail variants

The framework stack selects nist-800-53-r5-nested and cri-profile-v2-2-nested for its NIST 800-53 and CRI slots. Ordinary file recognition continues to propose nist-800-53-r5-flat and cri-profile-v2-2-flat. The nested NIST variant makes family folders, control folder notes, and enhancement notes; family folders have no concept notes, so family-level mapping endpoints remain unresolved pending a separate identity-safe design. The nested CRI variant makes function, category, and subcategory folder notes and diagnostic-statement notes. Both keep their flat counterpart’s source binding, frontmatter, and body projections (source: recipes/import/nist-800-53-nested.json, recipes/import/cri-profile-v2-2-nested.json).

Choose Top framework levels as notes to omit NIST enhancements and CRI diagnostic statements for that run; ATT&CK and CSF are unchanged. This is a row filter, not a rewrite of the bundled recipes (source: src/import/stack/stack-model.ts and src/import/run-recognized-import.ts). Switching detail on an existing import set is not supported yet. Start a new set for a different detail level; refresh an existing set only with its recorded recipe.

Stack mapping sources

Connection	Acquire and recognize	Locality and release
NIST CSF 2.0 to NIST 800-53	Public-domain NIST OLIR-derived SSSOM mapping included with the plugin; a publisher OLIR workbook with Focal Document Element / Reference Document Element headers can be selected as a replacement.	Bundled copy has mapping date 2026-05-04. Compare a newer NIST crosswalk release before refreshing it.
NIST 800-53 to MITRE ATT&CK	Download the *_json.json CTID Mappings Explorer bundle from the publisher. Its mapping_objects entries have capability_id, attack_object_id, and mapping_type; do not use a Navigator layer or STIX bundle in this slot.	Local only. Current stack expects ATT&CK 16.1, shown in the checklist; check the JSON metadata’s attack_version before using another release.
CRI Profile to NIST 800-53	Optional. The CRI to 800-53 OLIR workbook, with Focal Document Element / Reference Document Element headers. Every sheet whose headers appear in its first 50 rows is read; other sheets are listed as skipped. The CRI Profile Mappings Catalog is a different table and is not accepted here.	Local only; check CRI licence terms for the exact use.
CRI Profile to MITRE ATT&CK	Optional. The CTID Mappings Explorer JSON for the CRI Profile, from the publisher; same mapping_objects shape as the 800-53 bundle.	Local only. Exact duplicate rows are skipped and counted.

The framework crosswalk guide describes how the plugin converts these files into linked edge notes. No CTID or CRI mapping rows ship in the bundle.

Private-room demo add-on

Build the public demo first, then run the separate private add-on workflow. demo:build remains public and unchanged. demo:add-licensed reads files you already hold; it downloads nothing and distributes no licensed source content. The acknowledgement is a safety gate, not a licence grant. Keep the enriched vault local or in a private room, and confirm the publisher terms for the intended audience and use.

Private add-on last verified: 2026-10-30 against scripts/demo-add-licensed.mjs, src/import/stack/licensed-workbook-readers.ts, src/import/stack/referenced-frameworks.ts, the recipes below and two byte-identical CRI/CIS/SCF runs against locally held workbooks. The earlier CRI/CIS-only run was also byte-identical across two fresh copies. Counts below are aggregate observations of those releases, not bundled source data.

Acquisition and exact bindings

Default paths resolve from --sources-dir (the checkout root by default). The manifest tries alternatives in order; missing framework or mapping files produce a one-line skip with an acquisition link. --only cri,cis,scf selects framework keys but does not change manifest order. --source overrides a framework workbook only and requires one explicit --only key.

Addition	Local filename under Frameworks/	Acquire	Binding / method
CRI Profile 2.2	CRI-Profile-ver.-2.2.2026-04-27.xlsx; alternative wp-contentuploads202604CRI-Profile-ver.-2.2.2026-04-27.xlsx	CRI Profile	CRI Profile v2.2 Structure, CLI header row 3 (zero-based index 2), unchanged cri-profile-v2-2-nested.json
CRI subject tags	Same workbook	CRI Profile	Join Diagnostic Statements by Tag (CRI Profile Subject Tags, Profile Id) with Subject Tag LIst (CRI Profile Subject Tag); attach sorted, slug-safe cri/subject/ tags after recipe import
CRI 2.2 mappings catalog	wp-contentuploads202604CRI-Profile-ver.-2.2-Mappings-Catalog.2026-04-27.xlsx	CRI Profile	CIS v8.1, MITRE ATT&CK, NIST 800-53r5, NIST CSF v2; headers located by required columns; absent counterpart sheets are listed and skipped
CRI 2.1 to SP 800-53	wp-contentuploads202509CRI-Profile-v2.1-to-SP-800-53-Rev-5.1.1.Final_.2025.xlsx	CRI Profile	Existing OLIR reader; NIST focal endpoint reversed to CRI subject; NIST zero padding normalized
CRI 2.1 to ATT&CK workbook	wp-contentuploads202509MITRE-ATTACK-v16.1-to-CRI-Profile-v2.1-Mapping.2025.xlsx; alternative cri_profile-v2.1_attack-16.1-enterprise.xlsx	CRI Profile	Mappings Explorer Download or Sheet1; capability_id, attack_object_id, mapping_type; existing CTID conversion semantics
CRI 2.1 to ATT&CK JSON	cri_profile-v2.1_attack-16.1-enterprise_json.json	CTID Mappings Explorer	Compare semantic assertion sets with the workbook before endpoint filtering; import only assertions absent from the workbook
CIS Controls 8.1	_licensed/CIS_Controls_Version_8.1_6_24_2024.xlsx	CIS Controls	Controls V8, CLI header row 1. Shipped cis-controls-v8-controls.json plus additive cis-controls-v8-1-safeguards.json; the latter binds Asset Type rather than the older recipe’s Asset Class
CIS v8 to CSF 2.0	_licensed/CIS_Controls_v8_Mapping_to_NIST_CSF_2_2023.xlsx	CIS Controls	All CIS Controls & Safeguards; CIS Sub-Control (fallback CIS Control) and Subcategory
SCF 2026.1.1	Secure.Controls.Framework.SCF.-.2026.1.1.xlsx	SCF download	SCF 2026.1, CLI header row 1; unchanged scf-2026-flat.json. Newline-separated crosswalk columns use the generic referenced-framework adapter

CIS files are also searched under _licensed/ directly beneath --sources-dir. Controls and safeguards share only the exact new framework set minted by this invocation. This keeps one publisher release under one identity namespace; it never guesses an existing refresh target.

Referenced frameworks: identifiers without licensed text

A referenced-framework note holds a target identifier from a publisher’s crosswalk, not the target framework’s title, description or requirements. The private SCF manifest (scripts/lib/private-scf-manifest.mjs) pins its selected column names, labels and ontology keys. It selects current base sources rather than every historical edition, implementation group, assessment variant or national overlay. ISO, AICPA, PCI, cloud, industrial, privacy, AI and jurisdictional sources remain distinct; identical local identifiers in different frameworks never merge.

• Existing CSF, SP 800-53 and CIS notes are used where present. ATT&CK resolves only the public Persistence sample; absent techniques are counted and excluded, never replaced by identifier-only notes. This SCF release has no CRI-named column. CR CMM 2026 is a different source, not an alias for CRI.
• Each distinct source/target pair becomes one mapping using the existing unspecified-relation convention, skos:relatedMatch. No exact, broader or narrower relationship is invented. Source assertions, repeated pairs, missing source identifiers, missing endpoints and identifier-only note counts are reported by column.
• The generic referencedFramework() accepts a selected column, framework label, pinned ontology key and source-id column. The same adapter accepts normalized CRI Catalog rows; a future catalog integration must retain its declared relationship semantics rather than replacing directional OLIR relations with the unspecified default.
• Ontology keys use the fixed referencedOntologyKey() slug rule and are stored literally in the manifest. Non-CURIE characters in identifiers use the engine’s injective identity encoding; original identifiers remain the note’s id and title. Filenames use a separate injective token.
• One muted Referenced, id only graph group selects replaceable recipe provenance, not sticky tags or user properties. SCF has its own stable group. SCF notes link directly to referenced notes; those notes link back to the SCF sources. Start here reports actual counts and opens the adapted Frameworks reached by SCF control Bases query.
• Full-content takeover is deliberate: use the same ontology, original import set, destination and filename mapping. A synthetic real-CLI test (tests/cli/referenced-framework-takeover.test.ts) proves unchanged identities and mapping links, preserved user annotations, and replacement of the identifier-only explanation/provenance with full content. Matching an ontology alone does not authorize refresh or relocation. Automatic arbitrary-layout takeover remains outside this slice.

Resolution and release limits

• Mapping adapters reuse the stack readers, write temporary SSSOM files outside the repository and import them through cw. Each external release explicitly uses set-qualified mapping identities, so overlapping assertions from independent releases coexist. Existing CLI defaults and public demo output do not change.
• Endpoint resolution uses actual note curie properties across the vault, never folder names. Formatting normalization is limited to SP 800-53 zero padding / whitespace and CSF single-digit suffix padding. No CRI version migration is inferred. The older files’ CRI endpoints all resolved as written against the imported 2.2 notes in this verification; this proves identifier presence, not semantic equivalence across releases.
• The public ATT&CK sample is incomplete. Rows without both endpoint notes are excluded and counted by missing subject, missing object or both; blank mapping endpoints and duplicate JSON assertions are reported separately. The catalog logs each absent counterpart sheet instead of pretending to import its mappings.
• Workbook readers preserve displayed identifiers and expand declared merged cells only. They do not generically fill missing mapping endpoints. Subject-tag enrichment is a separate cross-sheet join because the shipped row recipe cannot express that join. Tags assigned by the per-statement sheet are retained even when its tag-list lookup is stale.

Verified addition	Source rows / assertions	Imported result	Exclusions / observations
CRI framework	472 rows	472 notes	None
CIS framework	171 rows	18 control + 153 safeguard notes	None
CRI subject tags	1,545 associations	318 statements tagged, 1,545 associations retained	40 tag-list lookup mismatches retained
CRI 2.2 catalog to CIS	457	457 resolved edges	None
CRI 2.2 catalog to ATT&CK	2,152	171 resolved edges	1,981 absent ATT&CK endpoints
CRI 2.2 catalog to SP 800-53	1,118	1,037 resolved edges	75 absent CRI + 6 absent NIST endpoints
CRI 2.2 catalog to CSF	154	142 resolved edges	12 absent CSF endpoints
CRI 2.1 to SP 800-53	1,039	1,037 resolved edges	2 absent NIST endpoints; all CRI endpoints present
CRI 2.1 to ATT&CK workbook	2,152	171 resolved edges	1,981 absent ATT&CK endpoints; all CRI endpoints present
CRI 2.1 to ATT&CK JSON	2,152	No additional edges	Identical assertion set to workbook
CIS to CSF	234 rows / 166 assertions	166 resolved edges	68 blank mapping endpoints
CRI recipe’s built-in CSF links	433	433 resolved edges	None; shipped recipe unchanged

The earlier CRI/CIS-only vault validated 6,626 Crosswalker notes. All 3,614 newly added mapping edges had both identity endpoints and both note links resolved; two fresh copies of the same public base diffed identically, including .obsidian/graph.json. These are local verification counts for the listed sources, not stable API promises. The add-on refuses a vault inside the repository or one containing symlinks, refuses a framework already present, updates graph colors and Start here.md, and validates at the end. A failed or interrupted run can leave partial output: start again from a fresh public base, not the partial vault.

SCF private-run results

The SCF extension imported 1,468 controls, 8,911 identifier-only notes across 66 selected referenced columns, and 21,650 mapping edges across all 70 selected columns (source: the ordered bindings in scripts/lib/private-scf-manifest.mjs and the 2026-10-30 local run of scripts/demo-add-licensed.mjs). The complete CRI/CIS/SCF vault validated 38,725 Crosswalker notes. These counts describe the locally held release and public Persistence sample, not every edition of these sources.

All rows below have zero missing source identifiers, missing subject endpoints and blank endpoints. Missing target notes are excluded rather than manufactured for the existing full-framework namespaces. Only APAC Australia ISM June 2024 has repeated pairs omitted before resolution. Rows with a nonzero identifier-only count are the exact selected referenced-framework list; no target titles or requirements are copied into those notes.

Selected source column	Source assertions	Resolved edges	Missing target notes	Repeated pairs omitted	Identifier-only notes
NIST CSF 2.0	611	611	0	0	0
NIST 800-53 R5	1,117	1,115	2	0	0
CIS CSC 8.1	429	385	44	0	0
MITRE ATT&CK 16	5,039	274	4,765	0	0
AICPA Privacy Management Framework (PMF)	197	197	0	0	123
AICPA TSC 2017:2022 (used for SOC 2)	1,478	1,478	0	0	399
APEC Privacy Framework 2015	29	29	0	0	25
BSI Standard 200-1	63	63	0	0	22
COBIT 2019	472	472	0	0	230
COSO 2013	155	155	0	0	17
CSA CCM 4.1.0	498	498	0	0	207
CSA IoT SCF 2	459	459	0	0	155
CR CMM 2026	47	47	0	0	40
GovRAMP	548	548	0	0	383
IEC TR 60601-4-5 2021	59	59	0	0	37
IEC 62443-2-1 2024	162	162	0	0	119
IEC 62443-3-3 2013	124	124	0	0	111
IEC 62443-4-1 2018	186	186	0	0	186
IEC 62443-4-2 2019	179	179	0	0	169
IMO Maritime Cyber Risk Management	105	105	0	0	35
ISO/SAE 21434 2021	248	248	0	0	232
ISO 22301 2019	273	273	0	0	259
ISO 27001 2022	316	316	0	0	148
ISO 27002 2022	506	506	0	0	96
ISO 27017 2015	356	356	0	0	118
ISO 27018 2025	522	522	0	0	108
ISO 27701 2025	149	149	0	0	90
ISO 29100 2024	48	48	0	0	11
ISO 31000 2018	105	105	0	0	27
ISO 31010 2009	60	60	0	0	32
ISO 42001 2023	579	579	0	0	140
MPA Content Security Program 5.3.1	325	325	0	0	81
NAIC Insurance Data Security Model Law (MDL-668)	122	122	0	0	85
NIST AI 100-1 (AI RMF) 1.0	309	309	0	0	91
NIST AI 600-1	403	403	0	0	250
NIST Privacy Framework 1.0	284	284	0	0	122
NIST 800-37 R2	72	72	0	0	47
NIST 800-39	27	27	0	0	16
NIST SP 800-66 R2	154	154	0	0	22
NIST 800-160 Vol2 R1	248	248	0	0	196
NIST 800-161 R1	479	479	0	0	308
NIST 800-171 R3	1,012	1,012	0	0	275
NIST 800-172	84	84	0	0	35
NIST 800-207	125	125	0	0	7
NIST 800-218	164	164	0	0	60
OECD Privacy Principles	21	21	0	0	17
OWASP Top 10 2025	300	300	0	0	10
PCI DSS 4.0.1	1,218	1,218	0	0	351
SCF DPMP 2025	256	256	0	0	83
Shared Assessments SIG 2025	128	128	0	0	65
SPARTA	94	94	0	0	53
SWIFT CSF 2025	232	232	0	0	32
TISAX ISA 6.0.3	220	220	0	0	73
UL 2900-1 2017	145	145	0	0	143
UL 2900-2-2 2016	68	68	0	0	57
UN R155	106	106	0	0	55
UN ECE WP.29	107	107	0	0	54
US CJIS Security Policy 6.0	507	507	0	0	319
US CISA CPG 2022	169	169	0	0	38
US GLBA CFR 314 2023	128	128	0	0	52
US HIPAA Administrative Simplification 2013	743	743	0	0	576
US HIPAA Security Rule / NIST SP 800-66 R2	225	225	0	0	87
EMEA EU AI Act	350	350	0	0	279
EMEA EU Cyber Resiliency Act	60	60	0	0	52
EMEA EU DORA	442	442	0	0	241
EMEA EU GDPR	241	241	0	0	227
EMEA EU NIS2	146	146	0	0	30
APAC Australia Essential 8	147	147	0	0	24
APAC Australia ISM June 2024	1,208	1,203	0	5	802
Americas Canada OSFI B-13	278	278	0	0	77

Source assertion totals: 26,466 read, 5 repeated pairs omitted and 4,811 absent target endpoints excluded. No CRI mapping column was present; no SCF-to-CRI relationship was inferred.

The 4,765 ATT&CK misses represent 492 distinct identifiers, all with the technique or sub-technique shape T#### or T####.###; none has another shape. This run used only the older Persistence sample. ATT&CK resolution rises after the public ATT&CK batch merges; re-run demo:add-licensed then. The 2 SP 800-53 misses are enhancements present in the held public OSCAL 5.2.0 catalog but absent in both parenthetical and dot form from the older demo source: a release-coverage gap, not a proven formatting mismatch. The 44 CIS misses represent 18 distinct two-segment numeric identifiers. None occurs in the held 8.1 or 8.1.2 release; all 171 identifiers in the held 8.1 source were imported. No deeper sub-safeguard shape or padding repair explains those misses, so their exact source/version cause remains unknown. No missing endpoint was retargeted.

Both fresh enriched copies contained 39,051 files, including hidden files, with zero byte differences. All 21,650 SCF mapping pairs were unique; every imported edge had both identity endpoints, both note links, its direct SCF reference and the applicable identifier-only reverse link. Exact-value probes against locally held control identifiers, titles and referenced identifiers found no matches in added repository content. No source values are reproduced here.

Licence posture

This is a practical pointer, not legal advice and not a replacement for the publisher’s terms. Importing a file for your own use, redistributing the source, and sharing generated notes are different acts. Confirm the terms for the exact version, fields, audience, and use involved.

Source	Practical posture
NIST publications	NIST describes its US Government works as generally not subject to US copyright; check the NIST copyright policy and any third-party notices in the specific publication.
MITRE ATT&CK	MITRE permits use subject to its ATT&CK terms of use, including attribution requirements. The bundled recipe carries the MITRE notice into generated notes.
MITRE Fight Fraud Framework (F3)	Published under the Apache License 2.0, which permits redistribution with the licence and attribution. The bundled recipe carries MITRE’s notice and the licence link into generated notes.
CIS Controls	The publisher applies restrictive terms, including CC BY-NC-ND language. Registration is required to obtain the workbook. Confirm whether sharing generated notes is permitted for your situation.
CRI Profile	CRI’s Profile FAQ describes restrictive CC BY-NC-ND terms. Confirm whether sharing generated notes is permitted for your situation.
Secure Controls Framework	SCF publishes CC BY-ND language plus separate terms governing use and derivatives. Read the SCF terms and conditions and confirm your intended use.

NIST SP 800-53 Rev. 5

Obtain it: NIST SP 800-53 Rev. 5, Update 1. NIST publishes spreadsheet/CSV material alongside the publication. Machine-readable OSCAL is also available from usnistgov/oscal-content, but it is a different lineage and can produce different counts and hashes.

Bundled recipe: nist-800-53-flat, from the bundled import recipes. It reads the CSV lineage and produces one flat note per control or enhancement.

Exact binding and result

Item	Verified value
Source shape	CSV with header at index 0
Records	1,189
Physical lines	About 2,605 because quoted control text contains embedded newlines
Key columns	Control Identifier; Control (or Enhancement) Name; Control Text; Discussion; Related Controls; Control Family
Result	1,189 notes; related controls become a queryable property and body wikilinks

Identifier format

Pattern: [A-Z]{2}-\d+(\(\d+\))?

• Family: AC, AU, CA
• Control: AC-1, AC-2
• Enhancement: AC-2(1), AC-2(13)

Gotchas

• Do not count records with wc -l. Embedded newlines explain the gap between about 2,605 physical lines and 1,189 CSV records.
• Preserve enhancement parentheses. A custom filename transform that strips rather than sanitizes punctuation can make AC-2(1) and AC-2(13) collide.
• Clean the related-controls field. Empty rows can carry [None], and identifiers can have trailing punctuation. Without cleanup, links such as [[SC-37.]] and [[[None]]] render but do not resolve.
• No row prefilter is needed for this lineage: every record represents a control or enhancement.

Assessment procedures

Source: SP 800-53A Rev. 5 assessment procedures

Assessment identifiers need normalization before joining to controls:

AC-01_ODP[01]  →  AC-1
Pattern: /^([A-Za-z]+)-0?(\d+)/

NIST CSF 2.0

Obtain it: NIST Cybersecurity Framework. The core workbook and a Cybersecurity and Privacy Reference Tool (CPRT) export have different shapes and are not interchangeable.

Bundled recipes:

Recipe	Reads	Output
nist-csf-2-flat	Core workbook, sheet CSF 2.0	One note per subcategory
nist-csf-2-cprt	CPRT JSON	Flat element notes
nist-csf-2-cprt-linked (default)	CPRT JSON	Function and category folders, an index note per folder, and children lists
nist-csf-2-cprt-hierarchical (previous default)	CPRT JSON	Function/category hierarchy
nist-csf-2-withdrawal-lineage	Derived edge list from the core workbook	One superseded_by crosswalk edge per replacement of a withdrawn subcategory

Exact workbook binding and result

Item	Verified value
Sheet	CSF 2.0
Header row	Index 1; row 0 is a banner
Parsed rows	231 total
Importable subcategory rows	185
Banner rows	46
Withdrawal markers	79 of the 185 subcategory rows
Key columns	Function; Category; Subcategory; Implementation Examples; Informative References

Identifier pattern: [A-Z]{2}\.[A-Z]{2}-\d{2}, for example GV.OC-01.

Gotchas

• The workbook mixes banner rows with subcategory rows. Only rows with a non-empty Subcategory are real; the other 46 resolve to empty filenames and collide. The bundled recipe declares that selection itself, so no manual prefilter is needed.
• The CPRT collection includes 227 non-concept elements (225 sort ordering keys and 2 party elements) that must not become concept notes. Both bundled CPRT recipes exclude them by element type, leaving 679 concept elements.
• Withdrawal markers are real rows, and they carry lineage. Of 185 subcategory rows, 79 are withdrawal markers naming the CSF 2.0 subcategories that replaced them. If you count only active outcomes, the total is 106. See Withdrawal lineage below for what the markers look like and how to import them.
• Merged-cell hierarchy columns are empty on subcategory rows. The bundled flat recipe derives function and category from the subcategory identifier rather than trusting those cells.
• Outcome text repeats the identifier. The bundled flat recipe projects the cell verbatim, prefix included. That is now a deliberate choice rather than a grammar limit: {Subcategory|regex(:\s*(.+)$)} recovers everything after the first colon on all 185 rows, but changing the shipped recipe would move its hash and rewrite every already-generated note.
• Informative References is intentionally omitted. It contains newline-separated mappings whose labels and identifiers need per-item cleanup before they can become reliable links.

Known limits: CPRT withdrawal (WR-*) folders appear as top-level entries, and hosted CPRT notes list implementation examples next to subcategories. The preserved CPRT layout does not create parent properties; its navigation uses folders, an index note per folder, and children lists.

Withdrawal lineage

CSF 2.0 does not just mark a v1.1 subcategory as gone: it says what replaced it. That statement is machine-readable, but it is written in prose inside the Subcategory cell.

ID.AM-06: [Withdrawn: Incorporated into GV.RR-02, GV.SC-02]
ID.GV-03: [Withdrawn: Moved to GV.OC-03]
ID.RM-03: [Withdrawn: Moved into GV.RM-02]

Item	Verified value
Withdrawal markers	79 of the 185 subcategory rows
Successor references	127 across those 79 markers
One-to-one replacements	45
Splits (one withdrawn subcategory, several successors)	34 — 25 with two successors, 6 with three, 1 with four, 2 with five
Widest split	ID.SC-01 into GV.RM-05, GV.SC-01, GV.SC-06, GV.SC-09, GV.SC-10
Disposition verbs	Incorporated into (61), Moved to (17), Moved into (1)
Successors that are categories, not subcategories	GV.PO, GV.RR, ID.IM, DE.AE

Source: Frameworks/csf2.xlsx, sheet CSF 2.0, counted 2026-08-28.

Import it as crosswalk edges, not as a field on the concept. A split is the reason. ID.AM-06 was replaced by two subcategories, so one flat previous_ids property would have to hold a list and could never say anything per replacement. As crosswalk edges it is two ordinary assertions, superseded_by, sharing a subject; a merge is N edges sharing an object; and the successor walk that answers “what replaced this control” is the same closure query every other predicate uses.

The bundled nist-csf-2-withdrawal-lineage recipe emits exactly that: 127 edges from nist-csf-1-1:<old id> to nist-csf-2:<new id>, each recording NIST as the mapping provider and preserving NIST’s own disposition verb in lineage_disposition. The subject side is nist-csf-1-1 because the withdrawn identifiers are CSF v1.1 identifiers; CSF 2.0 lists them only to record that they are gone. That is what makes the lineage useful after an upgrade: an approval recorded against nist-csf-1-1:ID.AM-06 in a vault since re-imported at CSF 2.0 has no concept of its own left, and the edges are what turn “this link points at nothing” into “this control was replaced by these two”.

One producer step is required, and it is the only one. The workbook packs up to five successors into a single cell, and a recipe renders exactly one note per source row, so the 79 marker rows cannot become 127 edge notes on their own. tools/lineage-from-csf-workbook.ts does that fan-out and nothing else:

bun tools/lineage-from-csf-workbook.ts \
  --source Frameworks/csf2.xlsx \
  --out recipes/import/crosswalks/nist-csf-2-withdrawal-lineage.csv

It repeats a marker row once per successor and adds one column. It selects no rows, mints no identifiers, and reads no disposition verb; the recipe does all of that, and its source.where picks the 127 lineage rows out of the 279 the file carries. The emitted list is committed alongside the recipe, so importing published CSF lineage needs the recipe only. Re-run the tool when NIST publishes a new release.

The tool refuses anything it does not recognise: a marker whose wording is not one of the three verbs above, or a successor that is not a CSF identifier, aborts the run naming the row rather than importing a partial lineage.

MITRE ATT&CK Enterprise

Obtain it: ATT&CK data and tools. The bundled recipe reads the Excel export, not the STIX bundle.

Bundled recipe: mitre-attack-technique-flat, which produces one note per technique or sub-technique.

Exact binding and result

Item	Verified value
Sheet	techniques
Header row	Index 0
Rows	656
Columns	23
Version compatibility checked	Column set identical between v15.1 and v16.1
Key columns	ID; name; description; tactics; platforms; is sub-technique; url

Identifier pattern: T\d{4}(\.\d{3})?, for example T1059 and T1059.001.

The previous default recipe emits tactics, platforms, and data sources as arrays and carries MITRE’s notice into every generated note. Its optional parent binding expects a sub-technique of column, which the held v16.1 workbook does not contain. The recommended linked recipe (recipes/import/mitre-attack-technique-linked.json) derives a parent only from a dotted technique ID, preserving those arrays and prose while emitting one tag per tactic and hub notes for tactics with multiple members.

Public demo binding

Frameworks/enterprise-attack-v16.1.xlsx supplies the full techniques sheet: 203 techniques + 453 sub-techniques = 656 technique notes, plus generated tactic hub notes (source: that workbook’s ID column; regression: tests/cli/demo-smoke.test.ts). recipes/import/mitre-attack-technique-linked.json supplies conditional parent links, managed children lists and tactic facet hubs, matching the recommended import default. The demo keeps the attack set key and scopes the hierarchy query to that set.

The same workbook’s mitigations sheet has 44 rows (source: that worksheet). recipes/import/mitre-attack-mitigation.json imports them into a separate set under the same mitre-attack ontology, with unchanged M IDs and mitigation_id, not technique_id. Both sets use ATT&CK red in the graph; technique queries do not include mitigations. This catalog import does not invent mitigation-to-technique relationships.

Get the pinned workbook through MITRE’s release spreadsheets. The newer STIX bundle is not interchangeable with this release. CTID mappings target 16.1; other-release endpoints are never silently re-targeted.

Gotchas

• Choose the Excel recipe for the Excel file. A STIX bundle has a different shape and needs another recipe.
• Citation markers remain inline. Text such as (Citation: TechNet How UAC Works) is part of the exported prose and is preserved.
• Mitigations are a separate import. The technique recipe does not import them; the demo uses the mitigation recipe above. Relationship joins remain separate from catalog imports.
• Contributor and date fields are omitted. Contributor delimiters are ambiguous, and source dates are not normalized ISO values.

MITRE Fight Fraud Framework (F3)

What it is: a matrix of fraud adversary behaviours (tactics and techniques), built like ATT&CK but aimed at fraud teams in financial services. Published in 2026 by the MITRE Center for Threat-Informed Defense.

Obtain it: the F3 site or the F3 repository. The repository’s public/ folder holds every published format. The repository has no release tags; its content changelog runs ahead of the data files, which are labelled v1.2.

Tracked source: Frameworks/f3-excel-v1.2.xlsx, downloaded 2026-10-29 from upstream commit 281be11eed4670e763a2ed57dd2274948f54a523. The source record pins file digests and counts; the carried Apache licence permits redistribution with attribution. See the corpus inventory.

Recommended recipe: mitre-f3-technique-linked, which produces one note per technique or sub-technique, links sub-techniques to their parent, and adds a hub note per tactic listing its techniques. mitre-f3-technique-flat remains available as the previous default for existing imports and replay.

Published formats

Format	File in public/	Shape
Excel	f3-excel-v1.2.xlsx	Two sheets, Techniques and Tactics. The bundled recipe reads this one.
JSON	f3-v1.2.json	One flat list of tactic and technique records
STIX 2.1	f3-stix-v1.2.json	A STIX bundle; needs a different recipe
ATT&CK Navigator layer	f3-navigator-v1.2.json	A visualization layer, not a catalog

Exact binding and result

Item	Verified value
Sheet	Techniques
Header row	Index 0
Rows	138 (source: tracked Frameworks/f3-excel-v1.2.xlsx, checked 2026-10-29)
Columns	7: Technique ID; Technique; Description; Tactic ID; Tactic Name; Added Date; Modified Date
Second sheet	Tactics (Tactic ID; Tactic Name; Tactic Description). It is a different shape and is not matched by the technique recipe

The previous flat recipe, mitre-f3-technique-flat (recipes/import/mitre-f3-technique.json), emits tactic_ids and tactics as lists, keeps the description in the note body, and carries MITRE’s notice and the Apache licence link into every generated note.

Shipped linked default

demo:build imports the full Techniques sheet with the shipped recipes/import/mitre-f3-technique-linked.json recipe. The former demo-only linked and Tactics-sheet recipes are retired: facet hubs replace the separate tactic concepts, so all F3 navigation belongs to one import set. It produces 138 technique notes + 8 tactic hub notes, 55 resolved parent links and 191 tactic memberships (sources: the pinned workbook, tests/mitre-f3-demo-recipes.test.ts and tests/cli/demo-smoke.test.ts). Each hub lists its members in identity order; multi-tactic membership makes this a connected graph, not a strict single-parent tree.

The shipped default mitre-f3-technique-linked is used by recognized imports and demo:build. Its dotted-id parent templates omit the empty result for top-level techniques. The previous flat recipe remains byte-identical for existing imports and replay. Tactic hubs list techniques; they do not import the separate Tactics sheet or its tactic descriptions. The 2026-10-29 follow-up log records the earlier demo-specific implementation, now superseded by this shipped recipe.

Known limits: F3 and ATT&CK tactic hub names can coincide in one vault. Navigation disambiguates duplicate basenames within one import, not across separate imports.

Identifier scheme and the ATT&CK overlap

Kind	Pattern	Count in v1.2
Technique new in F3	F plus four digits, dotted for sub-techniques (F1002, F1002.001)	92
Technique reused from ATT&CK	ATT&CK T ids, unchanged	46
Tactic reused from ATT&CK	ATT&CK TA ids	6
Tactic new in F3	FA ids (Positioning, Monetization)	2

(Counts source: tracked Frameworks/f3-excel-v1.2.xlsx, Techniques and Tactics sheets, re-checked 2026-10-29.)

F3 overlaps ATT&CK by shared identifiers, not by a published crosswalk. A reused technique id is the same string in both frameworks, and F3 publishes no mapping file stating how the two relate. Whether a reused id should resolve to the same concept as an ATT&CK import is an open question, recorded in the 2026-10-27 log. Today the recipe mints every F3 note under its own mitre-f3 ontology, and recognition by id pattern claims only the F ids for F3.

Gotchas

• Several tactics share one cell. A technique can sit under more than one tactic. The Excel file writes them as one comma-separated list, in parallel in both tactic columns (TA0001, TA0002, FA0001 beside Initial Access, Execution, Positioning). 41 of 138 rows do this (source: tracked Frameworks/f3-excel-v1.2.xlsx, Techniques sheet). The recipe splits both columns into lists of the same length.
• No parent column. The bundled flat recipe still emits no parent link. The demo-only variant derives it safely from the dotted id using existing filters; it never makes a top-level technique point at itself.
• Dates are omitted. Added Date and Modified Date are filled on only a few rows and are not ISO values.
• Tactic names follow ATT&CK’s newer split. F3 names TA0005 Stealth and uses TA0112 Defense Impairment. Check names against the ATT&CK release you import alongside it.

CIS Controls v8.1.2

Obtain it: CIS Controls. Registration is required. Crosswalker does not distribute the workbook.

Bundled recipes:

Recipe	Required row kind	Result
cis-controls-v8-flat	Safeguard rows	153 safeguard notes
cis-controls-v8-controls	Control rows	18 control notes

Exact binding

Item	Verified value
Sheet	Controls v8.1.2
Header row	Index 0
Rows	171 = 153 safeguards + 18 controls
Columns	9
Key columns	CIS Control; CIS Safeguard; Title; Description; Asset Type; Security Function; IG1; IG2; IG3

Safeguard identifiers follow \d+\.\d+, for example 1.1, 3.5, and 4.10.

Gotchas

Numeric identifier collapse

The workbook stores safeguard identifiers as numbers. A parser reading raw values turns 4.10 into the float 4.1, so it collides with safeguard 4.1. The import then creates 152 distinct safeguard identifiers instead of 153, with no error. Crosswalker reads formatted values to preserve both.

• The two recipes select opposite halves of one sheet. The safeguard recipe keeps the 153 rows with a CIS Safeguard value; the control recipe keeps the 18 without one. Each declares that predicate itself, so both can be pointed at all 171 rows. A recipe over this sheet that selects neither half creates empty or duplicate paths.
• The control descriptions are their own row kind. They are not safeguards and should not be inferred from the safeguard rows.

CRI Profile v2.2

Obtain it: Cyber Risk Institute Profile. Registration is required. Crosswalker does not distribute the workbook.

Bundled recipe: cri-profile-v2-2-flat, which produces one note for each function, category, subcategory, and diagnostic statement row.

Exact binding and result

Item	Verified value
Sheet	CRI Profile v2.2 Structure
Header row	Index 2; row 0 is a banner and row 1 is blank
Rows	472: 7 functions, 28 categories, 119 subcategories, 318 diagnostic statements
Columns	11
Result	472 notes; tier_1 through tier_4 appear only on the 318 diagnostic-statement rows

Gotchas

A correct row count can hide the wrong header

Header index 1 still returns 472 rows, but every column is named __EMPTY, __EMPTY_1, and so on. Use index 2 and verify column names, not just the row count.

• Dots in column names require literal key access. Older Crosswalker builds split names such as CRI Profile v2.2 Diagnostic Statement on every dot, producing 472 bodyless notes without an error. This was fixed in the plugin on 2026-08-26. If CRI notes have empty bodies, update Crosswalker and re-import.
• Seven rows contain embedded CRLF line endings. Crosswalker writes LF. Normalize line endings before byte-for-byte content comparisons.
• Other CRI mapping sheets were not part of the 2026-08-27 verification pass. Use the publisher’s current workbook labels rather than the old v2.0 sheet list previously shown on this page.

Secure Controls Framework 2026.1

Obtain it: SCF download. Crosswalker does not distribute the workbook.

Bundled recipe: scf-2026-flat, which produces one note per SCF control.

Exact binding and result

Item	Verified value
Sheet	SCF 2026.1
Header row	Index 0
Rows	1,468
Columns	369
Generated body volume	About 9 MB

Gotchas

• Prune before passing rows through narrow automation bridges. Enumerating all 369 properties can throw RangeError: Too many properties to enumerate in naive tooling. Keep the columns the recipe references.
• Body volume is the scale pressure. The 1,468-row count is ordinary; about 9 MB of generated prose is what makes indexing and downstream processing noticeably heavier.
• control_weighting is numeric. Preserve it as a number so Obsidian Bases can sort and filter it numerically.

MITRE D3FEND

Obtain it: D3FEND resources, held as Frameworks/d3fend.csv. The publisher’s terms of use apply.

Explicit-file recipe: recipes/import/mitre-d3fend.json (mitre-d3fend-flat); automatic source recognition is not added by this demo batch.

Actual column	Role
ID	Stable D3-… technique identifier
D3FEND Tactic	Tactic tag and property
D3FEND Technique	Sparse technique name at the first source depth
D3FEND Technique Level 0	Sparse technique name at the next source depth
D3FEND Technique Level 1	Sparse technique name at the deepest held source depth
Definition	Optional prose body

The held file has 183 rows (source: Frameworks/d3fend.csv; regression: tests/cli/demo-smoke.test.ts). Each row names one technique in one sparse name column. The recipe combines the nonempty name cells into the title, preserves the sparse source-depth properties, and writes a flat note per ID with a tactic tag. It does not forward-fill names or assert parents that the flat source does not state. D3FEND is teal in the demo graph (source: src/graph/graph-colors.ts).

Public demo crosswalk sources

These files are held inputs, not plugin-bundled content. demo:build --sources-dir <checkout> reads them without modifying that checkout. Derived SSSOM tables are temporary; notes are written only through cw import.

Held file in Frameworks/	Obtain and licence	Demo treatment
nist_800_53-rev5_attack-16.1-enterprise_json.json	CTID Mappings Explorer, Apache 2.0	Existing readCtidJson keeps its predicate rules, skips exact duplicate publisher entries, depads NIST IDs and refuses an ATT&CK release other than 16.1. A separate mapping set and an existing generic mapping query template show the results.
Cybersecurity_Framework_v2-0_Concept_Crosswalk_800-53_final.xlsx	NIST CSF informative references, U.S. government work	Existing readOlirWorkbook, sheet Relationships, header index 0. Diff endpoint pairs against the existing CSF-to-800-53 set; import separately only if pairs are added or relationship-strength values are present. Never merge the two releases.
d3fend_to_nist80053.csv	D3FEND NIST mappings, MITRE terms	Control-to-defensive-technique rows. Resolve names using the catalog; preserve direction of endpoints, but emit skos:relatedMatch for every relation word because the publisher does not define which endpoint “broader” or “narrower” describes.
att&ck_to_d3fend.csv	D3FEND ATT&CK mitigation mappings, MITRE terms	This table names mitigations (M IDs), not techniques. Expand distinct defensive IDs from each formatted cell, use skos:relatedMatch, and count empty cells as no published relationship.

The held CSF concept workbook and the existing demo SSSOM contain the same 740 distinct endpoint pairs, with no added or removed pairs and no strength values, so the demo skips a duplicate set (sources: that workbook, recipes/import/crosswalks/nist-csf-2-to-nist-800-53.sssom.tsv, mappingPairDiff in tools/lib/demo-public-sources.ts).

Resolved endpoint binding: all 89 expanded mitigation-to-D3FEND rows now resolve both their mitigation subject and defensive-technique object (sources: the real-source demo:build report and tests/cli/demo-smoke.test.ts). Techniques and mitigations share the mitre-attack namespace but have disjoint identifiers, so newly built mitigation sets keep mitre-attack:M… identities. Only an exact identity collision scopes a whole new set to its own release. Existing sets keep their recorded identity scheme on chosen refresh; they are not silently migrated. See the shared-namespace identity decision.

Tracked fidelity gap: source relation words are passed to import in both source_relation and standard SSSOM comment (relation=<word>). The current notes-form importer projects neither field into generated edge notes (source: src/import/sssom-importer.ts, buildSyntheticRecipe). No direction claim or duplicate sidecar note substitutes for that missing general projection capability.

Follow-up: d3fend-full-mappings.csv is wide and is not imported. It needs a reshaping decision. The CSF-to-ATT&CK fixture and evidence remain synthetic examples, not publisher coverage claims.

Attribution beside output: when a corresponding local licence file exists in Frameworks/LICENSES/, the demo copies it unchanged into LICENSE.txt and embeds it in LICENSE.md. Without one, it writes only publisher name and the official terms link in LICENSE.md for ATT&CK (techniques and mitigations), D3FEND and CTID mappings. It never reconstructs licence text. F3 continues carrying the held Apache text in both formats.

MITRE ENGAGE

Verification status

This section was preserved from the earlier reference. ENGAGE was not part of the 2026-08-27 real-import verification pass, and it is not one of the current bundled recognized-source recipes.

Source: Engage-Data-V1.0.xlsx

Sheets (multi-sheet merge required)

Sheet	Purpose	Key Column
Activities	Individual engagement activities	ID
Approaches	Grouping of activities	ID
Goals	High-level objectives	ID
Goal Approach Mappings	Goal → Approach links
Approach Activity Mappings	Approach → Activity links
Enterprise ATT&CK Mappings	ENGAGE → ATT&CK crosswalk

Merge pattern

ENGAGE requires a three-level merge to build the full hierarchy:

1. Join Goals with Goal-Approach mappings
2. Join result with Approaches
3. Join result with Approach-Activity mappings
4. Join result with Activities
5. Clean up duplicate columns (use _remove suffix tracking)

---

Crosswalk data sources

Verification status

This section was preserved from the earlier reference and was not part of the 2026-08-27 real-import verification pass. Confirm current source labels and publisher terms before relying on it.

Crosswalks between frameworks require separate mapping files:

Crosswalk	Source
CRI ↔ CSF 2.0	CRI Excel (NIST CSF v2 Mapping sheet)
CSF 2.0 ↔ NIST 800-53	NIST Concept Crosswalk
NIST 800-53 ↔ ATT&CK	Center for Threat-Informed Defense
F3 ↔ ATT&CK	None published. F3 reuses ATT&CK ids directly; see MITRE F3
ATT&CK ↔ D3FEND	d3fend.mitre.org mapping data
CSF 2.0 ↔ CIS v8	CIS Controls Mapping to CSF 2.0
D3FEND ↔ NIST 800-53	D3FEND semantic mappings (d3fend_to_nist80053.csv)

See framework crosswalks for matching methods and configuration details.

---

Related

• Crosswalker recipes — contribute and maintain community recipes
• Bundled import recipes — the recipes shipped with the plugin
• Framework corpus — broader GRC source directory and licence-tier framing
• ETL and import — how structured records become vault notes
• Framework standards and tools — links to framework publishers and related tooling
• Framework crosswalks — crosswalk configuration
• Helper functions — transform implementations
• Config schema design — recipe configuration history