Coverage is not a single number
How much A covers B differs from how much B covers A in 50 to 73% of mappings. We store both directions and mark where they disagree. Last updated: 2026-08-22
Ask how much NIST 800-53 covers OWASP ASVS and you get one answer. Ask how much ASVS covers 800-53 and you get a different one, 73% of the time. Coverage between two frameworks is not one number. It is two, and they usually disagree. Most published crosswalks hide that.
A mapping has a direction
"800-53 AC-3 fully addresses ASVS V8.2" is a claim about how well one control covers the other. The reverse, "V8.2 fully addresses AC-3," is a different claim, because one of the two is usually broader than the other. We author both directions independently and store both. Across the pairs on the map, between 50 and 73% of coverage mappings carry a different strength in each direction. A single symmetric number would have to average that disagreement away, and the average is where the information goes. The map marks each disagreement with a not-equal sign so you can see it at the individual control level.
This is why a compliance claim depends on which way you read it. "We map to NIST" almost always means "our controls map onto that framework," which is not the same as "that framework's requirements are all met by our controls." The first is about your coverage of them; the second is about their coverage of you. They are different guarantees, and the gap between them is exactly the directional disagreement.
The practical read: when a vendor or a report says they map to a framework, ask which direction. Then ask to see the reverse. If they only have one number, they have averaged away the part you needed.