Mapping Frameworks about ciso-assistant-community

[42mst]

@ab-smith
Yes makes sense. Are you planning to do it on a subset first? There are also ready-to-use mappings. I will list a couple of them in here:
NIS2 - ISO 2.pdf
sp800-53r4-to-r5-comparison-workbook.xlsx
Zuordnung_ISO_und_IT_Grundschutz.pdf
27002 2013 2022 Controls Mapping.xlsx
C5_2020_Referenztabelle.xlsx
Copy of CCF-VER2.xlsx
CyFun mapping Public_v20231106.xlsx

Doing this in combination with the #240 will be a gamechanger.

[ab-smith]

Hey, we will use the existing mappings as a starting point and keep the same approach of letting the community review and enrich them

[42mst]

@ab-smith
As already mentioned in the discussion sector: What about this case;

Do you think this documentation/data-model.md model is sufficient enough in the long run?

Initial situation:

ISO27001 <-> NIST
ISO27001 <-> CCB
Client A is currently NIST compliant

Goal:

Client A needs to implement the latest CCB requirements to be NIS2 compliant.

Current Model:

Currently that means in your model that each control needs to be mapped against each other control which would create a huge overhead.
Maybe ( I´m not sure about that) it would make more sense to have a - let´s say - top level framework, like the ISO27001
All controls need to be mapped to that
To achieve the described goal you would have/need to implement a transitive relationship between the frameworks and by that the controls
--> NIST <-> ISO27001 <-> CCB
By that the top-level framework will always be the connecting element.

[ab-smith]

Hey, sorry @42mst I missed your comment on this one. As a matter of fact, what we are building currently is pretty close to what you're describing using a graph representation; for instance:

we will set the filled arrows, and the dashed ones will be deduced.

makes sense?