← Foundations

Machine-readable: Markdown API guide

Map Your Own Controls

Map your controls to NIST SP 800-53 once, and see where they land in 90 frameworks.

Most organisations write their own security controls. Regulators, auditors and customers then ask about them in their own terms: NIS2, ISO 27001, DORA, PCI DSS, SOC 2 and many more. OSA maps 90 frameworks to NIST SP 800-53, the control catalogue behind every OSA pattern. Map your controls to SP 800-53 once, and OSA lines them up against any of those frameworks, clause by clause, and shows you the gaps.

How it works

  1. Give your AI agent your control list and OSA's skill for agents. The agent maps each of your controls to SP 800-53 and quotes your control text for every match. Where a published crosswalk exists, it checks its work against that too.
  2. You review the agent's table and make any corrections.
  3. Your agent sends the SP 800-53 ids to OSA. For each framework you name, OSA returns the matching clauses and the gaps, with the SP 800-53 controls that map to each gap.
  4. You check each matching clause against the framework's own text to confirm your control covers it in full.

To start, copy this into your agent and fill in your own file and frameworks:

Read https://www.opensecurityarchitecture.org/skills/osa-control-mapping/SKILL.md and follow it. Map the controls in [our control list] to NIST SP 800-53, then line them up against [the frameworks we need, such as NIS2 and ISO 27001:2022] and show me the matching clauses and the gaps.

You can name any of the 90 frameworks OSA maps, as many as you like.

A worked example

OSA's Information Security Policy template uses 63 SP 800-53 controls. Here is how they line up against three of the 90 frameworks:

Framework Clauses Matched Gaps
NIS2 Directive 14 14 0
ISO 27001:2022 117 100 17
EU DORA 68 54 14

For each gap, OSA lists the SP 800-53 controls that map to that clause. In ISO 27001:2022, for example, 10.2 (Nonconformity and corrective action) is a gap, and CA-05, PL-02, PM-04, PM-31 and RA-07 map to it.

ISO 27001:2022: 17 gaps
EU DORA: 14 gaps
  • Art.5(2)Governance and organisation — management body approval of digital operational resilience strategy
    Controls that map to it: CA-06, PL-09
  • Art.6(8)ICT risk management framework — documentation and review availability
    Controls that map to it: AU-01, PT-01
  • Art.9(2)Protection and prevention — ICT system resilience and availability
    Controls that map to it: SC-05, SC-06, SC-24, SI-13
  • Art.11(2)Response and recovery — recovery time and point objectives
    Controls that map to it: CP-10, RA-09
  • Art.15Simplified ICT risk management framework — proportionality for smaller entities
  • Art.16Further harmonisation of ICT risk management tools, methods, processes, and policies
  • Art.17(3)(d)ICT-related incident management process — training and communication
    Controls that map to it: IR-02, IR-07
  • Art.22(1)Supervisory feedback on incident reports
    Controls that map to it: IR-07
  • Art.26Advanced testing — threat-led penetration testing (TLPT)
    Controls that map to it: CA-08, RA-06
  • Art.27Requirements for TLPT testers — qualifications and independence
  • Art.28(7)ICT third-party risk management — incident notification by providers
    Controls that map to it: SR-08
  • Art.28(8)ICT third-party risk management — exit strategies
    Controls that map to it: SR-12
  • Art.30(2)(g)Key contractual provisions — termination and data return
    Controls that map to it: SR-12
  • Art.45(1)Information-sharing arrangements — voluntary sharing of cyber threat intelligence
    Controls that map to it: PM-15, PM-16

The same result as JSON: /api/v1/crosswalk?controls=…&framework=nis2,iso_27001_2022,dora

Reading the result

Each matching clause is a place to check. OSA maps whole controls to whole clauses, so read the framework's own text to confirm your control covers everything the clause asks for. NIS2 is mapped article by article, so a broad set of controls matches most of it. Each gap is worth a look too: you may already meet the clause another way, and the controls listed with it are a good place to start.

Four of OSA's mappings start from a crosswalk registered in NIST's catalogue (OLIR): HIPAA Security Rule, ISO 27001:2022, NERC CIP and NIST CSF 2.0. Each labels the pairs OSA adds.

Use SP 800-53 base controls such as AC-02 rather than enhancements such as AC-2(1). For a control NIST has withdrawn, OSA names the controls that replaced it.

Your data

Your control text stays on your machine. Your agent sends OSA just the SP 800-53 ids, and OSA uses them only to build the answer. Every mapping is also published in osa-data under CC BY-SA 4.0, so you can work out the same result offline.

For agents

Tell us

Spotted a mapping that differs from its source? Please raise an issue with what OSA says and what the source says. And if you map your own controls this way, we'd love to hear how it went.