Skip to main content

Crosswalks

Most frameworks ask overlapping questions. An access-control requirement in one standard usually has a close cousin in the next, and re-proving the same practice framework by framework is wasted work. Crosswalks are how SolveGRC removes that waste: framework requirements are mapped to a shared catalog of unified controls, so implementing one control can satisfy its equivalents in every framework you have activated. Map once, satisfy every framework.

Where crosswalk credit shows up​

When controls in a framework are satisfied through the crosswalk rather than a direct assessment, the compliance score card shows a chip: how many controls are satisfied via crosswalk, and how many of those are also evidenced. These are already included in the score above the chip and are never double-counted against a direct assessment. Expand a control in the framework tree to see the mapping it was satisfied through and the evidence behind it.

A framework's compliance score card showing the satisfied-via-crosswalk and evidenced counts under the score
The compliance score card with its crosswalk chip: the 'satisfied via crosswalk' and 'evidenced' counts sit under the score, already folded into the headline percentage — here 129 controls satisfied via crosswalk and 39 evidenced.

Adopt suggested controls​

Inside an active framework's control tree, requirements that the crosswalk maps to unified controls show them as suggested controls. Each suggestion carries an Adopt action: adopting brings the unified control into your organization's register, where implementing and evidencing it earns credit against every requirement it maps to.

Each requirement row also shows its coverage at a glance: how many mapped controls it has, how many are fulfilled, and whether fresh evidence is attached.

The Framework Controls tree with a requirement family expanded into its sub-controls, each showing an item count
The Framework Controls tree inside an activated framework: each requirement family (here Access Control) expands into its sub-controls, and each control expands further to its crosswalk mappings and the unified controls that satisfy it.

AI-suggested mappings are reviewable​

The mappings themselves come from a crosswalk engine, and the system is honest about which ones a person has confirmed. A requirement whose path to satisfaction relies on a mapping not yet human-approved carries a purple AI-suggested badge, so you always know whether a piece of crosswalk credit rests on a reviewed equivalence or a machine's proposal. Where the engine finds requirements no existing unified control addresses, it drafts additions to the catalog, and those drafts go through human approval before they exist at all.

Equivalence is a claim, and claims get reviewed

Treat the AI-suggested badge the way you treat any unreviewed claim: fine as a lead, not yet proof. The badge disappears once the mapping is approved.

See equivalents while you work​

When you are looking at a single control, a related-controls banner lists its equivalent controls in other frameworks, each tagged with the relationship type: Equivalent, Superset, Subset, or Related. Clicking one jumps to that control, which makes it easy to check how the same practice is faring across standards.

Sync a verdict across frameworks​

Crosswalks also work at assessment time. After an AI analysis, a control card that has counterparts elsewhere shows a related count and a collapsible Cross-Framework Sync panel listing them. From there you can apply your verdict to the eligible equivalent controls in your other activated frameworks, behind a confirmation dialog, with per-control results reported back. One decision, recorded everywhere it genuinely applies.

The Unified Controls Catalog listing shared controls mapped across frameworks
The Unified Controls Catalog: the shared control vocabulary your frameworks map through. Assessing a unified control once lets every framework that recognizes it take the credit — the mechanism behind map-once, satisfy-every-framework.

Browse the unified catalog​

The Unified Controls tab on the Frameworks page is the reference view: the global catalog of unified controls and the framework requirements each one maps across. Use it when you want to understand the mapping fabric itself rather than any one framework's score.

Crosswalk credit, like everything else in the module, ultimately rests on evidence. The verdicts you sync and the controls you adopt are only as strong as what you attached in Assess controls — and that evidence is what flows onward into audit engagements and the answers you give in security questionnaires.