One control model
Every framework's controls are mapped into one model of what good security looks like, so a requirement asked in different words lands in the same place.
Compliance & Control Galaxy
One control. Every framework it counts for.
Every framework we support, mapped at control level in one model. Pick something you already do, and see everywhere it counts.
37 frameworks · 2,976 controls · 2,300+ control-level cross-mappings · threat layer: MITRE ATT&CK and the Unified Kill Chain
Mapping the universe…
Badge = framework (glyph = type, size = controls) UKEUGCCUSInternational ring colour = region Square = capability Outer ring = threat layer Gold line = shared controls Dashed = cross-mapping coming soon Ctrl + scroll to zoom · drag to move · Esc to reset
How the map works
Evidence gathered once counts everywhere it applies
Collect the evidence for a control once, and it counts for every framework that genuinely asks for it, not just the one you started with.
Honest by default
No signal means unknown, never compliant. Every link says where it comes from, an official crosswalk or a reviewed mapping, and frameworks still being linked say so.
Every framework on the map
37 compliance frameworks, plus the threat layer. Each links to its own page.
UK
- Cyber Essentials
- Cyber Essentials Plus
- NHS DSPT cross-mapping coming soon
- UK GDPR
GCC
US
- CJIS
- HIPAA Security Rule
- NIST SP 800-53 cross-mapping coming soon
- SOC 2 readiness cross-mapping coming soon
International
- CIS Controls
- IEC 62443
- ISO 27001
- ISO 27701 cross-mapping coming soon
- ISO 42001 cross-mapping coming soon
- NIST CSF
- PCI DSS 4.0.1
Threat layer
Questions
What is the Compliance & Control Galaxy?
A map of every framework 786 Cyber supports, linked at control level in one model, with the MITRE ATT&CK threat layer around it.
What does "one control, many frameworks" mean?
Many frameworks ask for the same thing in different words. Map them to one control and the evidence you gather for it counts everywhere it genuinely applies.
Where do the mappings come from?
Some come from official published crosswalks; the rest are reviewed mappings in our own control model. Each link shows which it is.
Do I need an account to use it?
No. The Compliance & Control Galaxy is open to everyone. To see it against your own systems, book an onboarding session.
See it against your own systems.
One session to set up, then a scoped 30-day evaluation.
Book your onboarding