Skip to content
Crosswalker
🚧 Early alpha — building the foundation. See the roadmap →

For regulatory compliance

Updated

Where you connect to the model

Section titled “Where you connect to the model”

Regulatory compliance’s value in the unified risk model is the down-map: each regulatory obligation maps to the same control objects GRC/ISRM maintains. Then when a regulation changes, you can trace which controls (and which evidence) are affected — instead of re-deriving it by hand.

EntityYour role
Authority / Framework● active (you bring the regulatory authorities)
Requirement / Obligation● active
Control● relies on (GRC/ISRM owns the library)
Finding / Issue● shared register
Evidence● relies on

How it works in practice

Section titled “How it works in practice”
  1. Your CMS owns reg-change (obligation-centric, separate tool). It tells you “Reg E amended — effective date X, here’s the redline.”
  2. Map the obligation to controls. In the shared model, that obligation links down to the control(s) that satisfy it.
  3. Trace impact. A reg change now surfaces the exact controls + evidence affected — the join the unified model gives you for free.
  4. Crosswalker’s part: holding the control + crosswalk layer that the obligation maps onto, as plain-text notes shared with audit and GRC.

The control-shaped subset Crosswalker does help with

Section titled “The control-shaped subset Crosswalker does help with”

Some regulatory expectations are control-shaped — “you must have these safeguards” (GLBA 501(b) Safeguards, FFIEC IT examination expectations, NCUA cyber guidance). Those express cleanly as controls + evidence, and Crosswalker handles them well via the same crosswalk machinery. The consumer/transactional regulatory pile (lending, deposits, disclosures) is not control-shaped and stays entirely in the obligation-centric CMS.

Section titled “Related”