Appearance
Crosswalk Relationship Types
A mapping does not simply say "these two things are related". It says how they relate. That distinction is what turns a crosswalk from a list of links into an assessable statement about coverage.
The eight relationships
| Type | Shorthand | Meaning |
|---|---|---|
equivalent | Control equals requirement | Direct one-to-one functional and objective equivalence |
subset | Control is narrower | The control covers part of the requirement; more is needed |
superset | Control is broader | The control satisfies this requirement and others besides |
intersection | Partial overlap | The control and requirement overlap partially; gaps exist on both sides |
compensating | Alternative mechanism | A different mechanism mitigating the same underlying risk |
supporting | Defence in depth | A secondary or foundational control that reinforces the primary one |
related | Thematic reference | Contextually connected, but not addressing the objective |
no_match | Explicitly assessed as not matching | A considered conclusion that this control does not address this requirement |
Legacy values equal and full normalise to equivalent; partial normalises to intersection.
Choosing the right relationship
equivalent
Use when the control does exactly what the requirement asks — no more, no less.
Requirement: "Passwords for privileged accounts shall be at least 14 characters and rotated every 90 days." Control: "Privileged account password policy: minimum 14 characters, forced rotation every 90 days."
If satisfying the control fully satisfies the requirement and nothing else is needed, it is equivalent.
subset
Use when the control is genuinely narrower. This is the most under-used relationship and the most valuable one.
Requirement: "Access rights shall be reviewed at planned intervals and after any change of employment." Control: "Quarterly access recertification is performed for all production systems."
The control handles the planned interval. It does not handle after any change of employment. That is a subset, and marking it equivalent would hide a real gap behind a green link.
A subset mapping is a finding waiting to be written
When you record subset, you are stating that something else is still needed. If nothing else is mapped, the obligation is genuinely incompletely addressed — and the crosswalk now says so, explicitly, in a way anyone can query.
superset
Use when the control is broader than the requirement and satisfies it as a consequence.
Requirement: "Critical server configurations shall be baselined." Control: "All infrastructure, including servers, network devices and cloud resources, is baselined against CIS benchmarks and drift-monitored continuously."
The control addresses more than this obligation. Recording superset is also how you find your high-leverage controls: a control mapped as superset against many obligations is one whose failure has wide consequences.
intersection
Use when neither is contained in the other and the overlap is partial.
Requirement: "Security events shall be logged and retained for 12 months." Control: "SIEM ingests authentication and network events with 90-day hot retention and 13-month cold retention."
Overlap: retention duration is met, and some event types are covered. Gaps: not all security event types are ingested. Neither subset nor superset describes this honestly.
compensating
Use when a different mechanism mitigates the same underlying risk because the prescribed mechanism is not feasible.
Requirement: "Passwords shall be rotated every 90 days on all systems." Control: "The legacy trading platform does not support enforced rotation. Access is restricted to eight named users on dedicated hardened terminals, all sessions are recorded, and credentials are rotated manually with dual control on a documented monthly schedule."
Compensating is a mapping, not a waiver
Recording a compensating control states that an alternative mechanism exists. It does not by itself excuse the deviation from the prescribed control. Where the deviation needs formal acceptance, raise a governed exception — the exception carries the approval, the validity period and the reassessment date that a compensating mapping does not.
supporting
Use for defence in depth: a control that reinforces the primary control without addressing the objective on its own.
Requirement: "Multi-factor authentication shall be enforced for administrative access." Primary control: MFA Standard, mapped
equivalent. Supporting control: Privileged Access Management, which brokers privileged sessions and enforces MFA at the broker, mappedsupporting.
related
Use sparingly. It means thematically connected but not addressing the objective.
related is the relationship to reach for when you want to record a connection for navigation or context. It is not the relationship to reach for when you are unsure — if you are unsure, work out which of the others applies.
A crosswalk mostly made of related is not a crosswalk
If most of your mappings are related, the crosswalk is recording adjacency rather than coverage, and no coverage question can be answered from it. Review and reclassify.
no_match
Use to record a considered negative conclusion: this control was assessed against this requirement and does not address it.
This looks pointless and is not. A no_match record:
- Prevents the same plausible-but-wrong mapping being re-proposed each quarter
- Documents that the question was asked
- Stops AI suggestion passes resurfacing a relationship a human has already rejected
- Gives an assessor evidence that your crosswalk is the result of analysis rather than optimism
How relationship type affects the compliance picture
Relationship type is a semantic fact carried on the mapping. It does not itself drive satisfaction — satisfaction comes from evidence, coverage and effectiveness. But it drives how a human reads the coverage picture, and it drives what questions get asked.
| If an obligation's only mapping is... | The honest reading is |
|---|---|
equivalent, approved, control effective | The obligation is addressed by design and operating |
subset | Part of the obligation is unaddressed by design |
intersection | Both a coverage gap and a scope mismatch exist |
compensating | A deviation exists; check whether it is formally accepted |
supporting only, with no primary mapping | Nothing addresses the objective directly |
related only | Nothing addresses the objective at all |
no_match only | The obligation is deliberately unmapped |
The fifth and sixth rows are the ones worth auditing your crosswalk for. An obligation whose only mappings are supporting or related looks mapped on a count and is unaddressed in substance.
Worked example: one obligation, five mappings
Obligation: "The institution shall maintain, test and be able to restore backups of critical data within defined recovery objectives."
| Control | Relationship | Why |
|---|---|---|
| Backup Policy | subset | Requires backups be maintained; silent on testing and restoration objectives |
| Nightly Backup Operations | subset | Performs backups; does not test restoration |
| Quarterly Restore Testing | subset | Tests restoration; does not perform backups |
| Recovery Objective Definition (BIA) | supporting | Defines the objectives against which restoration is measured |
| Data Retention Schedule | related | Governs how long data is kept, not whether it can be restored |
Three subset mappings, together, address the obligation. None does alone. The crosswalk states that accurately, and the assurance picture depends on all three controls operating — which is the truth of the arrangement.
A crosswalk that recorded all five as related, or the first as equivalent, would tell you nothing useful about either.
Permissions
| Action | Permission |
|---|---|
| View relationship types on mappings | mapping.read |
| Propose a mapping with a relationship type | mapping.propose |
| Adjust a relationship type on review | mapping.review |