Security framework cross-walks

A two-way, extent-rated, independently QA'd map between the security frameworks that matter — weaknesses, attack techniques, and controls. Every pairing is rated in both directions on a four-level scale (full / mostly / partial / none), drafted by an LLM, re-rated by a second model, and adjudicated by hand. Several of these mappings have no public equivalent.

New — interactive coverage map → Pick two frameworks and see how well they cover each other — both directions, heat-mapped, with drill-down to the individual control mappings.

514

QA'd directional mappings

framework pairings

frameworks

848

governance links, off the coverage scale

What makes these different

Most published crosswalks give you one number per pairing and stop. Ours do three things none of them do.

Governance, not just coverage

A policy that mandates a control is not the same as a control that provides protection. We mark 848 cross-layer links as governs / implements, off the coverage scale, so a policy never inflates technical coverage. No public crosswalk draws this line, so theirs do.

Both directions, disagreement shown

How much A covers B differs from how much B covers A in 68 to 77% of mappings. We store both and mark where they disagree. A single symmetric number averages away exactly the part you needed.

Direct, never chained

We map weakness to control directly. The public CWE to CAPEC to ATT&CK chain drops most of the signal, reaching zero of the top weaknesses. Ours reach them.

Cumulative coverage

How completely do our mapped controls collectively cover a target framework? We report the strongest single inbound mapping per control (never inflating overlapping partials into "full") plus the breadth behind it.

NIST 800-53 r5

cumulative inbound coverage

≥partial inbound coverage on 7.1% of 324 controls · ≥mostly on 0.3%

CWE

cumulative inbound coverage

179 of 969 items carry higher-evidence coverage

The portfolio

Framework pairing	Mappings	Coverage mix
DISA STIG Oracle Linux 8 → CWE	122
DISA STIG Rhel 8 → CWE	56
DISA STIG Rhel 7 → CWE	54
DISA STIG Oracle Linux 9 → CWE	43
NIST 800-53 r5 → OWASP Web Top 10 (2025)	37
NIST CSF 2.0 ↔ CWEtwo-way	71
DISA STIG Ubuntu 22 04 → CWE	30
DISA STIG Windows 10 → CWE	22
DISA STIG Windows Server 2016 → CWE	22
DISA STIG Ubuntu 24 04 → CWE	21
DISA STIG Windows Server 2019 → CWE	20
DISA STIG Rhel 9 → CWE	16

Counts are higher-evidence mappings only (LLM-drafted → second-model re-rated → hand-adjudicated; unverified drafts excluded). Coverage is directional — a pairing can cover more in one direction than the other.

Use it, freely

The full dataset is open. Download the CSV/JSON: no sign-up, no key, no account. Attribution requested ("Cross-walk mappings: security-resilience.ai"). The mappings are re-QA'd continuously, so:

Stay current
New pairings and re-QA'd mappings are announced in the site feed. Subscribe in your RSS reader; nothing to log in to. Subscribe via RSS →

Programmatic / bulk access
The whole dataset is machine-readable JSON and CSV, per-pair and combined, with a schema. Pull it straight into your tooling, no key required. Get the dataset →

800-53 coverage rollup CWE coverage rollup Explore all mappings Download dataset How ours compare How to read a cross-walk