1 — Mapping method hierarchy

Every edge in the crosswalk dataset carries a method tag. Methods are used in this order of preference:

1. olir — NIST OLIR machine-readable Informative References (CSF 2.0 ↔ SP 800-53 r5, etc.). Authoritative.
2. enisa-guidance — ENISA's technical implementation guidance for NIS2 Implementing Regulation (EU) 2024/2690.
3. dora-l2 — Direct correspondence between DORA Level 1 articles and the Delegated / Implementing Regulations (RTS 2024/1774, RTS 2024/1772, ITS 2024/2956).
4. editorial — Industry-consensus mappings authored here. Always carries a rationale per edge; not official guidance from any standards body.

You can filter by method in the API: GET /api/v1/crosswalk?method=olir.

2 — Edge strength & coverage formula

Each crosswalk edge has a strength band:

Coverage of target framework T given implemented source set S:

coverage(T | S) = (1 / |T|) · Σ_{t ∈ T} min(1.0, max_{s ∈ S} factor(edge(s, t)))

That is: for each target control, take the strongest applicable edge from the implemented set, cap at 1.0, then average across the target framework.

3 — Benchmark k-anonymity rule

The Anonymous Benchmarking module (when live) only returns aggregates for slices where n ≥ 20. Below that, the query falls back to the parent aggregate (e.g. NACE top-level instead of NACE division). This is stated publicly so consultants and clients can interpret the comparison correctly.

4 — Review cadence and corrections

• Every dataset is reviewed at least quarterly.
• Out-of-band updates are made whenever a new RTS/ITS or NIST CSF revision is published.
• To suggest a correction, email hello@cyberramen.com with subject [GRC dataset], the source URL, and the proposed change.

5 — Paraphrase rules

• EU legislation (DORA, NIS2, GDPR, CRA, ENISA): reusable with source noted. Datasets paraphrase article requirements and always link to EUR-Lex.
• NIST documents (CSF 2.0, SP 800-53 r5, SP 800-30): US Government works, public domain.
• ISO standards: copyright ISO/IEC, paywalled. Only control numbers and short titles are stored; the normative text is never reproduced. Always buy the standard from iso.org.

6 — Dataset manifest

Live snapshot of every dataset with its current version, last review date, and source list:

7 — Read-only API & llms.txt

The datasets are exposed as a read-only JSON API at /api/v1/. The dataset licence is CC BY 4.0 with the attribution string "CyberRamen.com GRC datasets". The /llms.txt file describes the site for AI crawlers.