Pick what you already hold and what you have been told to do.
in the corpus,
531 of those frameworks verified against their source documents.
What the three numbers mean, exactly
- Already covered
- A mapping runs from a control you hold to that control. This is a
lookup in our corpus and you can ask us to show it.
- Likely covered
- No direct mapping exists, but both frameworks map to the same
control in a third standard. That is what a crosswalk is, and it is genuinely useful, but it
is an inference rather than a fact. Every one names the standard that bridges them so you can
judge it yourself.
- New work
- Nothing you hold reaches it, directly or through a shared standard. This
is the list worth taking into a scoping conversation.
We keep those separate rather than adding them into one friendlier
number. Blending them would make every answer look better and would quietly present a two-hop
inference as a verified fact, which is the exact thing this data exists to avoid.
What it does not do
It does not tell you that you are compliant. A control being mapped means the two standards
ask for the same thing, not that you have done it, and not that your auditor will accept the
evidence you produced for one in place of the other. What it replaces is the first two weeks
of a gap assessment, which is the part that is mechanical.
Coverage is not symmetric. Holding a broad framework covers much of a
narrow one; the reverse is rarely true. Swap the two boxes and you will get a different
number, and both are correct.
Structural sections of a standard, the ones headed General, Scope or
Terms and definitions, are excluded. They are not requirements, nothing maps to them, and
counting them would understate every answer.
Some pairs have no mappings between them at all. Where that is true
the page says so rather than showing you a zero without explanation.