Review a framework crosswalk

Objectives

A consultant has delivered a crosswalk mapping your internal controls to SOC 2, ISO 27001:2022 and NIST 800-53. Procurement wants it accepted so the mapping can drive evidence reuse.

Some rows are right. Others cite a real reference from the wrong family, quote a superseded ISO numbering, or claim equivalence between controls that only sound alike. Accept the sound rows; reject the rest.

Verdicts are accept or reject. Every rejection needs one reason code from: wrong-family | superseded-numbering | not-equivalent.

X-1  MFA on production console  ->  SOC 2 CC6.6 | ISO A.5.17 | NIST IA-2
X-2  Encryption of backups at rest  ->  SOC 2 CC6.1 | ISO A.8.24 | NIST SC-28
X-3  Leaver access removal  ->  SOC 2 CC6.2 | ISO A.9.2.6 | NIST AC-2
X-4  Change approval before deploy  ->  SOC 2 CC8.1 | ISO A.8.32 | NIST CM-3
X-5  Vendor risk assessment  ->  SOC 2 CC9.2 | ISO A.5.19 | NIST IA-5
X-6  Security awareness training  ->  SOC 2 CC1.4 | ISO A.6.3 | NIST AT-2

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Read the request before the artefact

   A crosswalk is load-bearing: once accepted, one piece of evidence starts satisfying three obligations. Review it as you would a join key, not as prose.

2. Step 2

   Judge every line, including the boring ones

   Judge all six rows. A crosswalk with an unreviewed row is an unreviewed crosswalk: evidence reuse will follow whichever row nobody checked.

   Every line in the fixture carries a verdict

3. Step 3

   Separate what is wrong from what is merely ugly

   For each row, test the weakest of the three references, not the strongest. A row is only as good as its worst mapping.

   Two signals to watch: a reference whose family letters do not match the subject of the control, and a reference whose numbering shape belongs to an older revision of the standard.

   Accept and reject land on the right lines

4. Step 4

   Say why, in the vocabulary the programme uses

   Distinguish a citation that is merely out of date from one that points at the wrong subject entirely, and both of those from two controls that are genuinely about different obligations.

   Each rejection cites a valid reason code

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.