.png)
The Gold Standard for Crosswalk Mapping
NIST IR 8477 provides the definitive practice for crosswalk mapping with no technology needed. It can be performed with a pencil and piece of paper.
Children learn the process of diagramming sentences in grade school (e.g., the Reed–Kellogg model) with pencil and paper. This same process of graphically identifying the relationships between elements forms the basis of STRM. What NIST IR 8477 does is formalize this with Set Theory mathematics to produce rigorous, defensible, and IP-protected crosswalk mappings.
STRM is part of NIST’s broader NIST OLIR Program, an effort to facilitate Subject Matter Experts in defining standardized Online Informative References between elements of their creation and NIST publications. The SCF has been participating in the NIST OLIR program for several years now to help make crosswalk mapping easier and more accessible.
You can click on the image to the side to see a PDF version of how the SCF is utilizing STRM, as well as an example for what that looks like with a few NIST CSF 2.0 controls:
The 5 STRM Relationship Types
Every crosswalk mapping in the SCF uses exactly one of these five mathematically-defined relationship types, ensuring precision and consistency across all 200+ mapped LRF.
Subset Of
The LRF requirement is fully contained within the SCF control. The SCF control is broader in scope and coverage.
Intersects With
The LRF requirement and SCF control share partial overlap. Neither is fully contained within the other.
Equal To
The LRF requirement and SCF control are semantically equivalent. They address the same concept at the same scope.
Superset Of
The SCF control is contained within the LRF requirement. The LRF requirement is broader in scope and coverage.
No Relationship
The LRF requirement and SCF control have no meaningful semantic overlap. No mapping is established.
Relationship Strength (1–10)
Relationship Strength (1–10): Each mapping also receives a numeric strength rating. A rating of 1 indicates a nominal relationship, 5 indicates moderately strong, and 10 indicates the strongest relationship, typically reserved for "Equal To" or where the LRF requirement is a "Subset Of" the SCF control.
Expert-Derived Content (EDC) vs. Natural Language Processing (NLP)
The SCF exclusively uses human subject-matter experts to perform STRM crosswalk mapping. This is a deliberate choice with significant IP, legal and quality implications.
SCF: Expert-Derived Content (EDC)
The SCF leverages human SMEs to perform STRM mapping. This produces content that is:
- Copyright-protected as original work by human creators
- Patent-eligible under the “mental steps” doctrine
- Defensible through documented expert judgment
- Consistent with NIST IR 8477 gold standard practices
Other Vendors: Natural Language Processing (NLP)
AI/NLP-based crosswalk solutions face significant IP limitations:
- AI-generated content is not copyright-protectable (no human creator)
- Potentially free to copy under current US copyright rulings
- Patent claims may be invalid under the 2014 Supreme Court “mental steps” doctrine
- Quality depends on training data rather than professional expertise
Why it matters
The SCF's EDC approach means its crosswalk mappings are both higher-quality and legally protected intellectual property, which is exactly how NIST IR 8477 itself was designed to work.
How the SCF Utilizes STRM
The SCF applies STRM to every one of its 200+ mapped laws, regulations and frameworks. Each mapping documents the precise set-theoretic relationship between every LRF requirement and the corresponding SCF control.
Focal Document Element (FDE)
Each LRF requirement is defined as a Focal Document Element with a unique identifier. Without a unique FDE value, no granular mapping is possible because there is nothing to map to.
SCF Control Mapping
Each FDE is mapped to the most appropriate SCF control with a documented relationship type (Subset Of, Intersects With, Equal To, Superset Of, or No Relationship) and a strength score of 1–10.
Multi-Framework Compliance
Because all LRF are mapped to common SCF controls using STRM, a single SCF control can simultaneously satisfy requirements across dozens of laws, regulations and frameworks. This enables true multi-framework compliance efficiency.
Published STRM Mappings
Excel versions of the STRM mappings are available for purchase at the SCF Store. The following STRM mappings are currently published:
How To Submit a Community STRM Mapping
The SCF welcomes community involvement. The SCF Council provides a downloadable Community STRM Template that practitioners can use to perform their own crosswalk mapping and submit for possible inclusion in a future SCF release.
Define the Focal Document
Open the STRM template’s “STRM Overview” tab and complete the two highlighted cells identifying:
- The Focal Document (FD), which is the law, regulation or framework you are mapping
- The Reference Document (RD), which is the SCF (the document being mapped to)
Prerequisites: familiarity with NIST IR 8477 and professional competence to conduct crosswalk mapping.
Perform the STRM Mapping
Complete the “Community STRM submission” tab using these columns:
- FDE number (mandatory unique identifier)
- FDE name (if available)
- FDE description (exact text of the requirement)
- Proposed SCF control name
- SCF control number
- SCF control description
- STRM relationship type (1 of 5 options)
- Relationship strength (1–10 rating)
- Optional notes / justification
Submit to the SCF Council
Once your STRM exercise is complete, email the completed Excel spreadsheet to the SCF Council for review:
support@securecontrolsframework.com
Submissions are evaluated by the SCF Council and may be included in a future SCF release. The SCF Council will contact you if there are questions about your submission.
Explore Further
Included LRF
Browse all 200+ laws, regulations and frameworks mapped in the SCF across 5 global regions.
NIST OLIR Participation
The SCF is a recognized NIST OLIR Program participant with accepted OLIRs for NIST CSF v1.1 and SP 800-171 R2.
SCF Domains
Explore the 33 control domains that form the Common Controls Framework at the heart of the SCF.
Download the SCF
Get the free SCF spreadsheet with all controls, all LRF mappings, and all STRM relationships included.
%20(white).png)