Security framework cross-walks

A two-way, extent-rated, independently QA'd map between the security frameworks that matter — weaknesses, attack techniques, and controls. Every pairing is rated in both directions on a four-level scale (full / mostly / partial / none), drafted by an LLM, re-rated by a second model, and adjudicated by hand. Several of these mappings have no public equivalent.

New — interactive coverage map → Pick two frameworks and see how well they cover each other — both directions, heat-mapped, with drill-down to the individual control mappings.

3,388

QA'd directional mappings

framework pairings

frameworks

848

governance links, off the coverage scale

What makes these different

Most published crosswalks give you one number per pairing and stop. Ours do three things none of them do.

Governance, not just coverage

A policy that mandates a control is not the same as a control that provides protection. We mark 848 cross-layer links as governs / implements, off the coverage scale, so a policy never inflates technical coverage. No public crosswalk draws this line, so theirs do.

Both directions, disagreement shown

How much A covers B differs from how much B covers A in 68 to 77% of mappings. We store both and mark where they disagree. A single symmetric number averages away exactly the part you needed.

Direct, never chained

We map weakness to control directly. The public CWE to CAPEC to ATT&CK chain drops most of the signal, reaching zero of the top weaknesses. Ours reach them.

Cumulative coverage

How completely do our mapped controls collectively cover a target framework? We report the strongest single inbound mapping per control (never inflating overlapping partials into "full") plus the breadth behind it.

NIST 800-53 r5

cumulative inbound coverage

≥partial inbound coverage on 7.1% of 324 controls · ≥mostly on 0.3%

CWE

cumulative inbound coverage

349 of 969 items carry authoritative coverage

The portfolio

Framework pairing	Mappings	Coverage mix
CAPEC ↔ CWEtwo-way	1,954
MITRE ATT&CK ↔ CWEno public equivalent	527
DISA STIG Oracle Linux 8 → CWE	185
NIST CSF 2.0 ↔ CWEtwo-way	147
DISA STIG Rhel 7 → CWE	86
DISA STIG Rhel 8 → CWE	85
DISA STIG Oracle Linux 9 → CWE	69
NIST 800-53 r5 ↔ OWASP Web Top 10 (2025)two-way	82
DISA STIG Windows Server 2016 → CWE	41
DISA STIG Ubuntu 22 04 → CWE	37
DISA STIG Windows 10 → CWE	35
DISA STIG Windows Server 2019 → CWE	34
DISA STIG Ubuntu 24 04 → CWE	30
DISA STIG Windows Server 2022 → CWE	29
DISA STIG Rhel 9 → CWE	27
DISA STIG Windows 11 → CWE	20

Counts are authoritative mappings only (LLM-drafted → second-model re-rated → hand-adjudicated; unverified drafts excluded). Coverage is directional — a pairing can cover more in one direction than the other.

Use it, freely

The full dataset is open. Download the CSV/JSON: no sign-up, no key, no account. Attribution requested ("Cross-walk mappings: security-resilience.ai"). The mappings are re-QA'd continuously, so:

Stay current
New pairings and re-QA'd mappings are announced in the site feed. Subscribe in your RSS reader; nothing to log in to. Subscribe via RSS →

Programmatic / bulk access
The whole dataset is machine-readable JSON and CSV, per-pair and combined, with a schema. Pull it straight into your tooling, no key required. Get the dataset →

800-53 coverage rollup CWE coverage rollup Explore all mappings Download dataset How ours compare How to read a cross-walk