Appearance
Control Crosswalk
Where to find it: Controls & Assurance, then Control Crosswalk (/crosswalk).
The Crosswalk is the governed record of which controls address which obligations, and in what way.
What a mapping record represents
A crosswalk mapping is a governed assertion that:
This control (or one of its elements) bears this semantic relationship to this obligation, on this basis, proposed by this person, approved by that person, valid over this period.
It is a statement about design intention. It is not a statement about implementation, operation, effectiveness or compliance.
Hard rule: a crosswalk never means automatic compliance
Mapping a control to a requirement does not satisfy the requirement, does not create evidence, does not change any compliance percentage, and does not close anything.
If mapping implied compliance, importing a crosswalk catalogue would produce instant fictional compliance across an entire standard. This rule is what makes bulk import safe.
What a mapping carries
| Element | Purpose |
|---|---|
| Business reference | Immutable human-facing identifier for the mapping |
| Source | The obligation or requirement being addressed |
| Target | The control, or a specific control element |
| Relationship type | The semantic relationship. See Relationship Types |
| Mapping source | Where the mapping came from |
| Source version | The version of the catalogue it came from, where applicable |
| Confidence state | unspecified, low, medium, high or verified |
| Status | proposed, approved, rejected, review_required or retired |
| Validity window | valid_from and valid_until, driving historical reconstruction |
| Provenance | Who or what produced it, including AI provider, model and confidence where relevant |
| Rationale | Why this relationship holds |
Mapping sources
| Source | Meaning |
|---|---|
manual | Proposed by a person in the application |
curated | From a curated catalogue |
scf | From a common controls framework catalogue |
regulator | From a regulator-published crosswalk |
framework_crosswalk | From a framework-to-framework crosswalk |
imported | Bulk imported from an external dataset |
ai_suggested | Produced by an AI comparison pass |
Mapping source is not a quality judgement — it is a provenance fact. A regulator mapping is authoritative about what the regulator said; it is still your decision whether the control in your register genuinely does what the mapping claims.
Confidence state
| State | Meaning |
|---|---|
unspecified | No confidence assessment recorded |
low, medium, high | The proposer's or model's assessed confidence |
verified | A human has verified the relationship holds |
Confidence is advisory. A high confidence proposal still requires approval, and approval is what makes a mapping authoritative — not its confidence value.
Control elements
A control frequently contains several distinct obligations of its own. A privileged access control might state that access is approved, is time-bound, is reviewed quarterly, and is revoked on termination.
OrviQ supports mapping at the element level so an obligation can be mapped to the specific clause that addresses it, rather than to the whole control. Element kinds include approval, restriction, review, revocation, monitoring, reconciliation, reporting, escalation, training, communication, resourcing, oversight, recordkeeping and remediation.
See Common Control Layer.
Reading the crosswalk register
The register lists mappings with filters for mapping source, relationship type, status, target type, source type and an as-of date.
Validity is displayed rather than a fabricated "active as of today" claim:
| Display | Meaning |
|---|---|
| Open-ended | The mapping has no end date and remains valid |
| Ended (date) | The mapping's validity ended on that date |
| Ended, date not recorded | The mapping is in a terminal status but carries no recorded end date |
That third case is deliberately visible rather than hidden. A retired mapping with no end date cannot be placed on a timeline, and pretending otherwise would corrupt historical reconstruction.
Crosswalk statistics
The crosswalk provides aggregate telemetry: totals by status, by relationship type and by mapping source. Use it to answer questions such as:
- How many obligations have no approved mapping at all?
- How much of our crosswalk is imported versus authored?
- How many AI-suggested proposals are awaiting review?
- Which frameworks have the thinnest coverage?
Permissions
| Action | Permission |
|---|---|
| View mappings, matrices and control elements | mapping.read |
| Propose a mapping | mapping.propose |
| Approve, reject, adjust or retire a mapping | mapping.review |
| Import external crosswalk mappings | mapping.import |
| Export crosswalk datasets | mapping.export |
| Retrieve ranked control candidates (retrieval only) | mapping.discover |
| Run AI comparison and persist proposals | mapping.ai_propose plus the AI entitlement |
mapping.review cannot be exercised on your own proposal. See Segregation of Duties.
Example
An obligation requires: "Multi-factor authentication shall be enforced for all remote and administrative access to critical systems."
Three mappings are proposed against it:
| Control | Relationship | Rationale |
|---|---|---|
CTL-2026-0041 Multi-Factor Authentication Standard | equivalent | Directly requires MFA for remote and administrative access to systems classified critical |
CTL-2026-0044 Privileged Access Management | supporting | Enforces MFA at the session broker for privileged sessions; secondary layer |
CTL-2026-0019 Network Access Control | related | Restricts network paths but does not itself require MFA |
The Compliance Manager approves the first two and adjusts the third from related to no_match, with the comment: "Network segmentation is a different control objective. Mapping it here inflates apparent coverage without addressing the MFA obligation."
That adjustment is worth more than it appears. no_match is an explicit, recorded assessment that a plausible-looking control does not address the obligation — which prevents the same suggestion being re-proposed and re-debated every quarter.
Troubleshooting
"My mapping does not appear in the Statement of Applicability." Only approved mappings appear. Check its status.
"I cannot approve my own mapping." Correct. Maker-checker segregation of duties applies.
"A duplicate mapping was rejected." A second mapping for the same obligation and control pair is blocked while an existing one is proposed, approved or review_required. Adjust the existing mapping instead of creating a second.
"An imported mapping has no rationale." Imported catalogue mappings frequently carry only a source reference. Add rationale during review — the review is where the mapping becomes yours.
"Control Crosswalk is not visible." Requires the control_assurance entitlement and mapping.read.