← All Tools
Control Mapper: CSF ↔ ISO ↔ DORA
Search across NIST CSF 2.0 outcomes, ISO/IEC 27001:2022 Annex A controls, and DORA articles. Filter by function, theme or framework pair, and export as CSV, JSON or Markdown.
100% client-side. The mapping dataset is loaded in your browser. No queries, telemetry, or data leave your device.
How to read these mappings. The CSF 2.0 taxonomy (NIST CSWP 29) and the ISO/IEC 27001:2022 Annex A control list are authoritative. The crosswalk itself is an indicative, editorial cross-reference — it is not reproduced from an official, attributable crosswalk, and there is no official CSF-to-DORA-article mapping at all. Treat every relationship as “informs”, not “satisfies”, and validate against the original framework text before filing an evidence claim. This is a reference aid, not legal or audit advice. Each row shows its Source so an exported mapping is never mistaken for an official one.
| CSF 2.0 | CSF outcome | ISO 27001:2022 Annex A | DORA articles | Source |
|---|
Indicative
Editorial cross-reference — not an official crosswalk. Every mapping in this tool is indicative.
How to use the mapping
- Start from the framework you have (e.g. ISO 27001) and find the row(s) where it matches your control objective.
- Use the linked controls / outcomes / articles as candidate evidence. Cross-check the original framework wording — these mappings are indicative, not contractual.
- Where multiple controls map, treat the relationship as “informs” rather than “satisfies”.
- Export filtered rows (CSV / JSON / Markdown) to seed an evidence-mapping spreadsheet for ISO 27001 internal audit, DORA Article 6 ICT risk framework, or NIS2 Article 21 measures. The export always includes the Source column so provenance travels with the data.
About the Subcategory Browser
This browser uses the canonical NIST CSF 2.0 taxonomy from CSWP 29 (6 Functions, 22 Categories, 106 Subcategories). Each subcategory shows its full text. Where the cross-walk contains an ISO 27001:2022 / DORA mapping for that subcategory, the corresponding chips appear below — those mappings are indicative (editorial), as explained above.