This is for a digital download of the current Excel spreadsheet versions of the Set Theory Relationship Mapping (STRM) used to crosswalk the Secure Controls Framework (SCF).
Included in the 2025.1 STRM mappings in Excel include the following:
- Service Organization Control - Trust Services Criteria (TSC) - SOC2 (2022 points of focus)
- Critical Security Controls (CSC) version 8.1
- IEC TR 60601-4-5:2021
- 27001:2022 - Information Security Management Systems (ISMS) - Requirements
- 27002:2022 - Information security, cybersecurity and privacy protection - Information security controls
- ISO/IEC 42001:2023 - Information technology - Artificial intelligence - Management system
- NIST SP 800-53 R5 - Security and Privacy Controls for Information Systems and Organizations
- NIST SP 800-161 R1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- NIST SP 800-171 R2 - Protecting CUI in Nonfederal Systems and Organizations
- NIST SP 800-171 R3
- NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information
- NIST 800-171A R3
- NIST SP 800-207 - Zero Trust Architecture
- NIST SP 800-218 - Secure Software Development Framework (SSDF) Version 1.1:
- NIST Cybersecurity Framework (CSF) v2.0
- Payment Card Industry Data Security Standard (PCI DSS) v4.01
- Space Attack Research & Tactic Analysis (SPARTA) Countermeasures
- TISAX ISA 6.0.3
- CISA Cross-Sector Cybersecurity Performance Goals (CPG)
- CISA Secure Software Development Attestation Form (SSDAF)
- US DOJ / FBI - Criminal Justice Information Services (CJIS) Security Policy v5.9.3
- Cybersecurity Maturity Model Certification (CMMC) v2.0 Level 1
- DoD Zero Trust Reference Architecture v2
- Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) Trusted Internet Connections 3.0 Security Capabilities Catalog
- Gramm Leach Bliley Act (GLBA) - CFR 314 (Dec 2023)
- HIPAA Administrative Simplification (2013)
- HIPAA Security Rule (includes mapping to NIST SP 800-66 R2)
- Data Privacy Framework (DPF)
- Cybersecurity Final Rule (Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure)
- California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) - November 2022 version
- NY - Cybersecurity Requirements for Financial Services Companies (DFS 23 NYCRR500) - 2023 Amendment 2
- OR - Consumer Privacy Act (SB 619)
- TN - Information Protection Act
- TX - Consumer Data Protection Act (CDPA)
- EU Digital Operational Resilience Act (DORA) (2023)
- General Data Protection Regulation (GDPR)
- ENISA NIS2 (Directive (EU) 2022/2555)
- Saudi Arabia IoT CGIoT-1:2024
- Saudi Arabia Personal Data Protection Law (PDPL)
- BOE-A-2022-7191
- UAE National Information Assurance Framework (NIAF)
- Ministry of Defence Standard 05-138 (14 May 2024)
- Australia Essential Eight
- Australian Government Information Security Manual (ISM) (June 2024)
- China Cybersecurity Law of the People's Republic of China (China Cybersecurity Law) 2017
- India Digital Personal Data Protection Act 2023
- NZ Health Information Security Framework (2022)
- NZ HISO 10029:2024 NZ Health Information Security Framework Guidance for Suppliers
- Canada Protecting controlled information in non-Government of Canada systems and organizations (ITSP.10.171)
Canada B-13
1 Review
-
Excellent value and huge time saver!
We use SCF to map product features to multiple compliance frameworks using control cross-walking. Adding the STRM information, especially the actual requirement text, allows us to tailor our answers specifically to the framework. And for the price, it's a real bargain! Even if you only need to copy and paste requirement descriptions manually, you'll end up paying more in lost work time than buying the whole package. Plus, you'll miss out on the STRM weights, which help to prioritize controls.