Skip to content
Crosswalker
🚧 Early alpha — building the foundation. See the roadmap →

Checkpoint — framework corpus + GRC tooling landscape (set up camp)

Created Updated

Where we are

Section titled “Where we are”

After v0.1.6’s query substrate landed (8 Layer A primitives, streaming variants, join/set-op/diff, benchmark + bundled-fixture commands), the next practical step is realistic crosswalking in practice — feeding actual framework data through the import → query → crosswalk pipeline instead of toy fixtures. This checkpoint sets up the corpus + the legal handling for that.

The URO goal (context)

Section titled “The URO goal (context)”

The driving use case (from 2026-05 financial-institution stack research): a Unified Risk Ontology that lets Internal Audit, GRC/ISRM, and Compliance operate on the same shared entities — risks, controls, frameworks, assets, vendors, processes, findings, evidence, incidents — with CRI Profile as the authority-of-record for the GRC/InfoSec team and every other framework crosswalked to it (via OLIR / STRM). The load-bearing joints are the control and the crosswalk: one control hangs off multiple framework requirements → assess once, comply many.

Crosswalker’s role in that model: the control-centric control + crosswalk spine (see control-centric vs obligation-centric compliance), kept as plain-text notes you own. The shared model itself is the unified risk model.

1. Framework corpus — what to get + copyright handling

Section titled “1. Framework corpus — what to get + copyright handling”

Full get-these list + per-framework licensing + clickable download links lives in the corpus manifest: test-vault/Frameworks/PROVENANCE.md (committed). Summary:

StatusFrameworksHandling
🟢 Public domain — commit freelyNIST CSF 2.0, 800-53 r5, 800-171, FFIEC, HIPAA, CMMC, NYDFS 500, DORA, MITRE ATT&CK (attribute), NIST OSCAL catalogsFrameworks/public/
🔴 Copyrighted — local onlyCRI Profile (the spine), ISO 27001:2022, SOC 2 / AICPA TSC, PCI DSSFrameworks/_licensed/ (gitignored)
🟡 Restrictive CC — gitignore to be safeCIS Controls v8.1, Secure Controls FrameworkFrameworks/_licensed/ (subset OK)
Section titled “Download links (quick grab)”

Landing/download pages — verify version + registration/purchase terms at download time:

The handling pattern (set up 2026-05-29)

Section titled “The handling pattern (set up 2026-05-29)”
test-vault/Frameworks/
├── public/      ← committed (public-domain + laws/regs + your generated notes)
└── _licensed/   ← GITIGNORED (raw copyrighted vendor files — never committed)

.gitignore carries test-vault/Frameworks/_licensed/. Drop copyrighted source files there; they stay local. Crosswalker’s generated output (your own paraphrased concept notes + crosswalk junction notes) is derived work — it can live in public/ and be committed. The raw vendor text (CRI/ISO/SOC2/PCI diagnostic statements) stays in _licensed/ only.

Rule of thumb: US-government frameworks + actual laws/regs are public domain → commit. Proprietary vendor frameworks → _licensed/. You can still test with them; just don’t commit their raw text.

Existing test fixtures (already in repo)

Section titled “Existing test fixtures (already in repo)”

Small subsets already live at tools/fixtures/realistic/ (synthetic-shape-correct, safe to commit): NIST CSF 2.0 (Govern+Identify), 800-53 AC family, ISO 27001:2022 subset, SOC 2 subset, CIS Controls v8 subset, MITRE ATT&CK Persistence subset, + 3 crosswalks (CSF→800-53, ISO→SOC2 SSSOM, CSF→ATT&CK SSSOM). These power the Phase 6.1 integration tests and the Crosswalker: Import bundled test fixture (dev) command. For real crosswalking, replace/augment with full files per the table above.

2. Related tooling + unified risk model — now in the KB

Section titled “2. Related tooling + unified risk model — now in the KB”

Two concept pages capture the FI stack research:

Related tooling (GRC, audit, compliance, risk) — the adjacent platforms across these problem domains + where Crosswalker fits among them (NOT Crosswalker’s own ecosystem):

  • Control-centric vs obligation-centric compliance — obligation-centric (regulatory/CMS, atomic unit = obligation) vs control-centric (control/framework ops, atomic unit = control). Crosswalker is control-centric. (Informal framing — not the IIA Three Lines Model.)
  • Tooling tiers — FI-specialized / enterprise GRC / open-source, with TCO + run-burden tradeoffs.
  • Standards-based-crosswalking differentiator — the durable company Crosswalker keeps: CISO Assistant (OLIR), RegScale (OSCAL), SCF (STRM).
  • Named roster — control-centric spines, FI-specialized, enterprise GRC/IRM, internal-audit engines, crosswalk metaframeworks.

Unified risk model — the shared data model IA / GRC / compliance operate on together around any of these tools, with CRI Profile at the center: the shared-entity table (control, requirement, framework, asset, vendor, process, finding, evidence, incident) with per-team ownership roles, and the “assess once, comply many” backbone.

The full multivariate analysis (coverage matrix, TCO table, role-fit) lives in the user’s private research session; the KB captures the load-bearing framing + positioning.

How to work out of here (the camp)

Section titled “How to work out of here (the camp)”
  1. Obtain framework files per PROVENANCE.md — public ones into Frameworks/public/, proprietary into Frameworks/_licensed/. Log each in the PROVENANCE per-file table.
  2. Import concepts: Crosswalker: Import structured data (CSV/XLSX/JSON) → Tier 1 concept notes.
  3. Import crosswalks: Crosswalker: Import SSSOM mapping file (or the bundled-fixture dev command) → junction notes in _crosswalker/mappings/.
  4. Query/crosswalk: Crosswalker: Insert query into note → pick a recipe → pivot/coverage views render over the junction data.
  5. Benchmark/observe: Crosswalker: Run primitives benchmark (perf) for scale; cat crosswalker-debug.log | jq 'select(.category=="view" or .category=="perf")' to trace.
Section titled “Related”