Draft v0.1.06 frameworks · 29 control themes
Which control answers which control.
Look up a SOC 2, PCI DSS, ISO 27001, NIST CSF, HIPAA or NIST 800-53 requirement and see what it lines up with in the other five, with the evidence an auditor usually asks for.
| Control objective | SOC 2 | PCI DSS 4.0 |
|---|---|---|
| Asset and system inventory | CC6.1Logical access security (inventory of information assets is a point of focus) | 12.5.1Inventory of system components in scope for PCI DSS is maintained12.5.2PCI DSS scope is documented and confirmed at least every 12 months |
| Authentication, unique IDs and multi-factor authentication | CC6.1Logical access security software, infrastructure and architectures | 8.2User identification and related accounts are strictly managed8.3Strong authentication for users and administrators is established and managed8.4Multi-factor authentication is implemented8.5MFA systems are configured to prevent misuse |
| Encryption at rest and key management | CC6.1Logical access security (encryption of data at rest) | 3.5Primary account number is secured wherever it is stored3.6Cryptographic keys used to protect stored account data are secured3.7Key management processes and procedures are defined and implemented |
3 objectives matchLeave the requirement blank to see the full crosswalk.
Every crosswalk
Thirty directions, one page each. Pick a row and a column.
Each number is how many shared control themes connect the two frameworks. Darker cells overlap more.
Control objectives
The common ground. Each square is a framework that covers the objective.
- Security governance and policies
- Security roles and accountability
- Risk assessment and treatment
- Asset and system inventory
- Data classification and handling
- Access provisioning, review and removal
- Least privilege and privileged access
- Authentication, unique IDs and multi-factor authentication
- Encryption at rest and key management
- Encryption in transit
- Network security and segmentation
- Secure configuration and hardening
- Vulnerability scanning and patching
- Penetration testing and independent assessment
- Logging, log review and monitoring
- Intrusion detection and integrity monitoring
- Malware protection
- Incident response and breach notification
- Change management
- Secure software development
- Third-party and vendor risk management
- Business continuity and disaster recovery
- Backup and redundancy
- Capacity and availability management
- Security awareness and training
- Personnel screening, terms and sanctions
- Physical access and facility security
- Data retention, media handling and secure disposal
- Ongoing control monitoring and internal audit
For AI agents
The same data is an API that agents pay for per call, with no signup or key. Payment is USDC over the x402 protocol, from $0.01 a call. llms.txt and openapi.json describe it.
# free: ids and themes curl https://crossfootgrc.com/v1/themes # paid: replies 402 with the price, # then 200 with the mapping once paid curl "https://crossfootgrc.com/v1/crosswalk?from=soc2&to=pci-dss-4&ref=CC6.1"