Open-sourced the control-to-clause crosswalk mappings I kept rebuilding by hand
I got tired of rebuilding the same compliance crosswalk every time somebody added another framework. We’d finish SOC 2, then they’d want to add a HIPAA rider or something else.
I cleaned up the mapping layer I’d been using and put it out there for anybody to use open-source:
https://github.com/Keel-GRC/compliance-crosswalks
It includes 42 framework-agnostic controls mapped across ISO 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, ISO 9001, NIST 800-171, CIS Controls, GDPR, and ESG. There’s a JSON version and a plain CSV, so you can script against it or just open it in Excel.
Part of the reason I wanted to publish it is that a lot of SMBs are starting their compliance journey without a huge budget to throw at one of the big platforms. Sometimes you just need a solid starting point and a spreadsheet that doesn’t suck.
It’s CC BY 4.0. No copyrighted framework text, just clause references and mappings.
Full disclosure: I’m building a GRC platform (DM me if interested in participating as a pilot), and this is the same mapping data behind it. Still, I’d rather make it useful to people than keep it locked behind a login.
If you think a mapping is off or want another framework added, open an issue or let me know. I’d rather have folks poke holes in it than keep reinventing the same spreadsheet in private. I plan to maintain the crosswalk data as I deep-dive into other frameworks, and as they evolve with new versions.