What is a Security Controls Crosswalk?
A control crosswalk helps link two different frameworks by connecting an identical requirement, or control, from one framework to its parallel in another framework.
Compliance and audit teams are well aware that cybersecurity compliance standards have overlapping security control requirements. By identifying similar policies that are required repeatedly over multiple frameworks, the compliance process gets consolidated, managing internal controls becomes simpler, and duplication of security control documentation for audits is eliminated.
Here is a list of requirements that repeat themselves across many frameworks and standards:
- Privacy policies
- Access controls
- Security policies
- Data retention and classification policies
- Business continuity plans
- Incident response procedures
- Change management tickets
- Encryption of data
- Password policy and strength
- Third-party vendor risk assessment
The shared requirements listed above apply to almost every security framework because the tenets of information security, namely confidentiality, integrity, and availability (CIA), are common goals of all information security frameworks. Hence the overlap.
It isn’t extremely complicated to manage a couple of compliance frameworks. But ask any compliance team that needs to comply with a larger number of frameworks and standards, and they will tell you that the compliance process grows exponentially more stressful, redundant, and overwhelming as the framework and controls load is increased.
NIST Crosswalks
NIST has developed and published a highly regarded set of cybersecurity standards which are known as NIST SP 800-53. The standards are mandatory for government organizations and for organizations that do business with the government. The NIST cybersecurity controls are categorized into 18 different families of controls which govern everything from access control management and data protection to secure data transfers and encryption.
“Crosswalks that map the provisions of standards, laws, and regulations to subcategories can help organizations determine which activities or outcomes to prioritize to facilitate compliance,” NIST explains. NIST has published a list of crosswalks on its Privacy Framework website. “These crosswalks are intended to help organizations to understand which Privacy Framework Functions, Categories, and Subcategories may be most relevant to addressing the provisions of the source document. Organizations should not assume implementation of these Privacy Framework activities or outcomes means that they have met the provisions of the source document. There may be other activities that organizations need to undertake.”
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
Following is a list of Regulations, Standards, and Framework Crosswalks published on NIST’s website:
Laws and Regulations
Standards
Frameworks
- Cybersecurity Framework Crosswalk
- Fair Information Practice Principles (FIPPs) Crosswalk
- International Association of Privacy Professionals (IAPP)
- Certified Information Privacy Manager (CIPM) Crosswalk
- NIST Privacy Framework and Cybersecurity Framework to NIST Special Publication 800-53, Revision 5 Crosswalk
Benefits of Crosswalks
- Easy to monitor. Traditionally, compliance was an isolated, siloed process. A company interested in certification through a SOC 2 audit had to comply with SOC 2 with all its requirements and documentation. If it subsequently wanted to enter the European market, it also had to comply with GDPR requirements in a completely separate undertaking. However, with control crosswalks in place, the number of security controls that need to be addressed is minimized. Often, the road to compliance with a second or third framework is just a fraction of the full path to compliance. Indeed, control crosswalks can save hundreds of hours of work.
- Improve security. Mapping controls to their objective, and connecting the dots among different frameworks broadens the scope of your vision beyond the checkbox of each control, allowing teams to focus on the purpose of each control. This allows for a more holistic approach to security and compliance.
- Easy Onboarding. Onboarding another framework is simply a matter of adding it to your existing controls that have been established with previously adopted standards. There are always some new controls with each framework, but that’s instead of hundreds or thousands more if you’d be starting from scratch.
- Cost Reduction. Eliminating redundant controls ultimately saves money and conserves resources. Costly compliance audits are significantly affected when controls are mapped and duplicate tasks are eliminated.
It is rare to find a Risk and Compliance tool or platform that automatically crosswalks controls from one framework to another…
Good News:
Centraleyes is the one platform that crosswalks controls saving you huge amounts of time and effort. You don’t need to start from scratch to create an extensive mapping of frameworks and standards. With Centraleyes, you can crosswalk controls across multiple frameworks automatically to produce evidence of compliance and share security controls. Our automated platform identifies overlapping requirements and maps them to their parallels in other frameworks. Check out these outstanding features and others by learning more about Centraleyes.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
