Skip to content

Cross Compliance

Path: /cross-compliance

Cross Compliance

Cross compliance maps controls across different frameworks. If you've already satisfied SOC 2 CC6.1, this shows which ISO 27001, CMMC, and GLBA controls are also covered — so you only test/write once and comply many.

Key Elements

  • Mapping table — Shows source framework/control mapped to target framework/control.
  • Relationship types — Equivalent (fully satisfies), Partial (some overlap), Related (conceptually similar).
  • Create Mapping — Add your own cross-framework control mappings (persisted per organization).
  • Delta analysis — Given a framework you've already done, see exactly what a new framework still requires (the "delta").
  • Coverage report — Per-framework coverage percentages computed from the real crosswalk plus your custom mappings (mapped controls that resolve to real catalog controls ÷ the framework's real control count) — never a hardcoded number.

Supported frameworks for mapping

SOC 2, ISO 27001:2022, CMMC Level 2, HIPAA, PCI DSS v4.0.1, NIST CSF 2.0, GDPR, GLBA / FTC Safeguards Rule (16 CFR Part 314), and the AI-governance pack (ISO/IEC 42001:2023, NIST AI RMF 1.0, EU AI Act — with 46 curated crosswalk rows into ISO 27001 and each other).

The GLBA content pack covers the required program elements of §314.4(a)–(i): qualified individual, risk assessment, access controls, inventory/data mapping, encryption, secure development, MFA, secure disposal/retention, change management, monitoring & logging, testing, training, service-provider oversight, program evaluation, a written incident response plan, and periodic reporting to the board.

The Delta Engine (reuse gap analysis)

Endpoint: POST /api/v1/orgs/{org_id}/cross-compliance/delta UI: the Framework Delta page at /framework-delta

For a customer already doing one framework who now needs another (e.g. an ISO 27001 shop that must also meet GLBA), the delta engine reports, per target control:

  • target_control — id + title of the framework you now need.
  • mapped_source_controls — the controls from your existing framework that already cover it.
  • coverage — full, partial, or none.
  • delta — a concrete description of what you still have to write up or implement. For full, it tells you which existing evidence to reuse and cite; for partial, the specific gap to author; for none, that it must be written from scratch.
  • confidence + source — see honesty labelling below.

It also returns a headline summary:

{
  "total_target_controls": 16,
  "fully_covered": 13,
  "partial": 3,
  "none": 0,
  "reuse_percentage": 90.6
}

reuse_percentage is a weighted score (a fully-covered control counts as 100% reusable, a partially-covered one as ~50%) — the "you can reuse N% of your ISO work for GLBA" number.

Request

{
  "source_framework": "ISO27001",
  "target_framework": "GLBA",
  "source_assessment_id": null,
  "use_ai": true
}

If you pass an org-scoped source_assessment_id, coverage is refined by which source controls are actually passing in that assessment (implemented) rather than merely mapped, and the delta text says whether you can reuse evidence directly or must implement the source control first.

Honesty: deterministic vs AI-augmented

Every result carries a source and confidence so you always know where a mapping came from:

  • source: "crosswalk" — the curated, industry-standard crosswalk plus any custom mappings you created. Deterministic and high-confidence. This layer is always available and never depends on an LLM.
  • source: "ai" — for target controls with no crosswalk row, the configured LLM is asked to suggest semantically-similar source controls. These are labelled ai, capped at lower confidence, prefixed [AI-SUGGESTED — verify] in the delta text, and must be human-reviewed before use. Any control id the model returns that is not a real control in the source framework is discarded — the engine never fabricates a mapping.

Graceful degradation: if the LLM is disabled, unavailable, times out, or returns unparseable output, the deterministic crosswalk results are returned unchanged with an honest note (ai_augmented: false). AI augmentation never blocks the response and never invents a successful mapping.

How to Use Cross Compliance

  1. Review existing mappings to avoid duplicate audit work.
  2. Run a delta from a framework you've completed to one you now need to see the reuse percentage and the exact gaps to author.
  3. Create custom mappings when you identify control overlap the crosswalk doesn't already have — these persist per organization and feed future delta runs.