You have already done more of it than you think
You hold SOC 2. Now a customer wants ISO 27001. Most of that work is already sitting in evidence you collected last year, and the expensive part is finding out which parts. A coverage crosswalk tells you exactly which controls you already satisfy, which are genuine gaps, and the reasoning behind every claim so you can check it rather than take it on trust.
What you already hold, added up
No organisation holds one certification. Tick everything you already have and pick the one you need, and this works out what they cover together, and what each one adds that the others do not already give you. The second number is usually far smaller than the first, because certifications overlap heavily, and it is the one that decides where the money goes.
Pairs ready now
Every mapping is judged against both control sets, argued against, and kept only if it survives. Each pair states its level of review on the report itself. Buy one and it is emailed to you immediately.
Showing 24 of 594 pairs
Any other pair
162 frameworks in the graph are complete enough to sell against, which is 26,082 possible pairs. Any pair can be built at the same price. The ones listed above are pre-built and arrive immediately; anything else is generated when you order it and usually lands within minutes.
Occasionally a pair does not pass its checks, almost always because the two frameworks genuinely have little in common and a crosswalk would not help you. If that happens we tell you and refund it, rather than send a number worth nothing.
- Every evidenced control, with its reasoning
- Every gap, with what it requires
- Its level of review stated plainly, not a bare number
How the mappings are made
Grounded in the source
Both frameworks are read from the issued standard held in our source corpus, not from a summary. Correcting one wrong control title in ISO 27001 changed a coverage figure by more than sixty points.
Argued against, then kept
Every candidate mapping goes through a second pass whose job is to refute it. Across the catalogue that has removed thousands, and one pair alone lost 198 of 279. Your report shows the count for the pair you buy. What survives is what you get.
Its level of review, stated
Refutation is a machine check and does not replace a reader. Every report says which level of review it has had, names who did it, and carries the limitation in full. Ask and a practitioner will review your pair.
What this is not
A crosswalk narrows the work. It does not replace an audit, and your assessor may take a different view on individual controls. Mappings between frameworks are judgements, not text printed in either standard, which is why every claim in the report shows its reasoning.
On the first released pair, two independent review passes each removed eight mappings and they overlapped on none. A third reader would probably still find something. That is in the report too, because you verify claims for a living and a stated limitation is worth more to you than a confident number.
Building an agent? The crosswalk is an MCP tool so an agent can find a pair and buy it without a human in the loop.