Framework references and mapping register

Framework references and mapping register

FW-01 — Mapping and source policy

[Organisation] records the sources and relationships used to explain its SSDLC. A mapping identifies a relationship between specific source material and the local activity or control. It does not, by itself, establish that the activity was adopted, implemented or effective. The owner retains the source edition, mapping author, relationship type, scope and limitations.

SP 800-53 Rev. 5 identifiers provide the common control vocabulary. Other frameworks retain their own identifiers and purposes. An engineering outcome, stakeholder need or local capability without an adequate control counterpart remains in the requirements and assurance records. The organisation does not remove necessary work merely to make every row fit a single framework.

The mappings in this document have two sources: published crosswalk pairs identified explicitly below, and Caedist editorial subject relationships between the library documents and the frameworks. Editorial relationships are selected starting points for local control analysis. They are not represented as NIST or ISO endorsements, complete control implementations or one-to-one equivalences. The source review date for this library is 6 September 2026.

FW-02 — Source register

The source owner checks edition changes at [schedule] and records their effect on the adopted policy set. A newer edition does not automatically rewrite local commitments. The owner assesses differences and obtains a change decision. In particular, the ISO 15288:2015 foundation is retained to match the specified NIST systems engineering basis; locally available material based on 2023 is not silently substituted.

FW-03 — Common control and CSF reporting relationships

The following are editorial topic relationships. Control IDs refer to SP 800-53 Rev. 5; CSF references identify outcome categories. The local CO-01 record supplies the exact selected control, enhancements, organisation-defined parameters, implementation and assessment. Category coverage is not an assertion that every subcategory outcome has been achieved.

FW-04 — SSDF practice coverage

This table covers the SSDF 1.1 practice identifiers at practice level. It identifies where to start operating related work in the library; individual tasks, implementation choices and evidence still require local selection. The brief topic labels below are navigation descriptions rather than reproduced practice statements.

SP 800-218A adds AI-specific material to the SSDF context. Its PO.5.3 monitoring addition is addressed in AM-03 and the environment monitoring procedure. Its PW.3.2 provenance addition is addressed in AM-02, including explicit unknown provenance. Its PW.3.3 adversarial-data addition connects to AM-04 and AE-03. These identifiers belong to the AI profile context; PW.3 is not presented as an active SSDF 1.1 practice. The wider AI procedures also address model integration, provider visibility and use-context evaluation.

FW-05 — Privacy Framework to CSF crosswalk

The pairs below were inspected in NIST’s CSF 1.1 / 2.0 / Privacy Framework 1.0 draft crosswalk workbook, linked from its 2024 Privacy Framework workshop resources. They preserve the workbook’s draft status. The “library use” column is an editorial assignment. These selected pairs are not a reproduction of the complete workbook.

Control-P and Communicate-P activities concerning individual participation, processing choices and transparency retain their own privacy requirements even where a CSF relationship is partial. The library does not infer a complete PF-to-SP-800-53 mapping by chaining two different crosswalks. Each local control relationship is reviewed against the actual outcome and implementation. The PF 1.1 project page inspected for this edition still labels the release material as an initial public draft; PF 1.0 is therefore the stated privacy reference here.

FW-06 — NICE workforce relationships

The following identifiers were checked in the local NICE Framework Components v2.1.0 workbook. Their assignment to local responsibilities is editorial. The programme owner uses the NICE change log to track component updates and records the selected release in RO-04.

A Work Role is not a required organisational job title. The same person can hold several local responsibilities, and one responsibility may draw on several NICE roles. The organisation records the actual task, knowledge and skill needed, evidence of competence and any development action. Sponsor accountability, stakeholder representation and other broader system roles remain in the register even when no direct NICE counterpart is selected.

FW-07 — Systems life-cycle coverage

The following is an original navigation view of the ISO/IEC/IEEE 15288:2015 process subjects through the NIST systems engineering foundation. It does not reproduce ISO process clauses or assert that these templates satisfy every task in the standard. Each organisation records the processes and work products it adopts and the evidence supporting its own scope.

SP 800-160 Vol. 2 Rev. 1 contributes resilience considerations to architecture, essential-function requirements and recovery assessment. The RS plan records selected techniques and their trade-offs, and the EV record explains the evidence supporting resilience claims. The existence of a disaster-recovery document alone does not demonstrate the broader ability to withstand and adapt to adverse conditions.

FW-08 — ISO 42001 consideration and source handling

The AI management content is original policy and procedure text grounded in the public NIST engineering and AI resources. The NIST AI Resource Center crosswalk catalogue attributes its AI RMF-to-42001 crosswalk to Microsoft. The linked crosswalk PDF identifies ISO/IEC FDIS 42001. This distinction is retained when considering relationships to the final ISO/IEC 42001:2023 standard.

The library links to that resource without republishing its tables or reconstructing the ISO standard. AG provides governance and review records; AM and AE provide development and evaluation records; AS and IM provide assurance and improvement records. These can inform an organisation’s management-system work, but no complete ISO 42001 conformance or certification claim is made. ISO source material remains subject to its published copyright conditions.

FW-09 — Mapping record and review

Mapping ID: [FW record ID]
Source: [Framework; edition; control/task/outcome; location]
Target: [Local promise/control/requirement; version; scope]
Relationship: [Published crosswalk / editorial relationship / local analysis]
Meaning: [Related subject / partial support / other justified relationship]
Provenance: [Mapping author; publication; review date; draft/final status]
Rationale and gaps: [What is supported; what remains outside the mapping]
Implementation and assurance: [CO, RO, SE, EV and AS records]
Approval and maintenance: [Reviewer; decision; update trigger]

The reviewer checks the source and target wording, scope, edition and intended use before relying on a mapping. Relationships are not assumed to be transitive or reversible. The reviewer identifies any unrepresented requirement and retains it in the local system. A framework change triggers impact analysis on mappings, then on the affected policies, procedures and assurance records through the normal change process.