Projects / Case study
Turning compliance frameworks into an interactive research tool
Technical case study: the NIST SP 800-53 control crosswalk.
- Project type
- Independent technical writing and software development
- Technologies
- Next.js, React, TypeScript, Tailwind CSS, a Node.js build script, NIST OSCAL data, SVG
- Role
- Application design, technical research, documentation, and development
- Status
- Pilot, in development. Mappings are unreviewed drafts.
The challenge
Frameworks overlap, but they are not interchangeable
Security and governance professionals work with several frameworks at once, including NIST SP 800-53, the NIST AI Risk Management Framework, and CMMC. They address related goals, but their requirements do not line up one for one. Finding the real relationships takes research, interpretation, and careful documentation.
Crosswalk spreadsheets are hard to navigate when you need to filter, explore gaps, or hand a subset to someone else. I wanted a tool that makes the relationships easy to explore while keeping the differences between frameworks visible.
The solution
A self-service explorer
The page lets a visitor:
- Search controls and framework references by keyword, such as AU-6, account, GOVERN 1.4, or 3.11.2.
- Filter by control family, baseline (Low, Moderate, High), and whether a control has an AI RMF or CMMC mapping.
- Open any control to read its NIST statement and the reasoning behind each mapping.
- Collapse the table by family, and see a chart of controls per family by baseline.
- Export the filtered rows as CSV, or print a clean version of the page.
How it works
From NIST's data files to the page
Step 1
Source data
NIST's published OSCAL files: the SP 800-53 Rev 5 catalog and the Low, Moderate, and High baseline profiles.
Step 2
Build script
A Node script trims the roughly 10 MB catalog to the fields the page needs and checks its own output against the catalog before writing it.
Step 3
Data files
A small JSON file of controls, and a separate mapping file in which every row carries a source, a confidence label, and a reviewed flag.
Step 4
Page
The page joins the two files and does all filtering in the browser. No server calls and no third-party scripts.
Step 5
Output
Table, detail view, SVG chart, CSV export, and a print stylesheet.
Design decisions
Choices that shaped the build
Native page instead of an embedded notebook
My original plan embedded a Python notebook app in an iframe. This site sends a strict Content Security Policy that blocks third-party frames, and loosening it did not fit a site about security and governance. The tool is built natively. Because the data lives in plain JSON, a notebook companion for deeper analysis remains an option later.
Data as files, not code
Keeping controls and mappings in separate JSON files means the mappings can be reviewed and corrected without touching the interface.
Honest labels everywhere
A draft banner, per-column confidence labels, and CSV headers that say the mappings are unreviewed keep the limits visible wherever the data travels.
Documentation and information design
Written for people new to cross-framework work
The interface should work for an experienced GRC professional and for someone seeing a control catalog for the first time. Design choices that serve that goal:
- A built-in guide that opens from a question-mark button, written for people who have never done cross-framework analysis.
- A hint under the search box and a specific empty-results message, added after testing showed a search for "password" returned nothing because that topic sits in a family not yet loaded.
- Plain column names, consistent labels, and short explanations of baselines and enhancements.
- Labeled form controls, table semantics, expandable rows that report their state, and a text alternative for the chart. A formal accessibility audit has not been done.
Challenges
What made this harder than it looked
Similar is not the same
A security control can support an AI governance goal without fully addressing the AI-specific risk behind it. The tool labels each mapping as derived from a NIST table or as judgment, and shows the reasoning, so a reader can disagree with it.
There is no official AI RMF to 800-53 crosswalk
NIST's AI RMF crosswalk page lists mappings to ISO standards and other documents, but none to SP 800-53. The AI RMF column is therefore my own judgment, marked as such on the page and in the exported CSV, and it is the first thing to review.
Two revisions of the same catalog
NIST's SP 800-171 Rev 2 table, which underlies CMMC Level 2, maps to Rev 4 control IDs, while the catalog in the tool is Rev 5. Every mapped ID was checked against Rev 5. Two controls that Rev 5 withdrew were dropped, which leaves one requirement without a Rev 5 control.
Merged cells in the source table
Where NIST merges one cell across several requirements, the tool stores the mapping for the whole group, and says so in the detail view, instead of claiming a one-to-one match.
Errors in the starting data
The first sample dataset in my implementation notes contained mapping errors. For example, it linked risk assessment (RA-3) to a security assessment requirement. Rebuilding the mappings from the published sources replaced it.
A mapping gap is not a compliance failure
A control with no mapping does not mean an organization has failed to implement anything. The page says so, and it makes no compliance determinations.
Current results
What exists today
- 131
- controls loaded: 69 base controls and 62 enhancements that appear in a baseline
- 4 of 20
- control families in the pilot: AC, AU, RA, and SI
- 35 / 83 / 110
- pilot controls in the Low, Moderate, and High baselines
- 51
- requirement-to-control pairs derived from NIST SP 800-171 Rev 2 for CMMC Level 2
- 55
- base controls mapped to 32 of the 72 AI RMF subcategories, as judgment
Limitations
What is not yet established
- The mappings have not been reviewed. Both columns are drafts.
- No user testing has taken place, and I have no data on how it affects analyst productivity.
- Only four families and only enhancements that appear in a baseline are included.
- The page has not been through a formal accessibility audit, and the print layout still needs a check.
- It is not an official NIST product and is not compliance, audit, or legal advice.
Next steps
Before it is more than a pilot
- Review and correct the AI RMF and CMMC mappings, then mark reviewed rows.
- Verify CMMC practice identifiers against the official assessment guide.
- Add the remaining control families, starting with Identification and Authentication.
- Test with representative users and record what they find hard.
- Consider a notebook companion for gap analysis and report generation, reusing the same data.
Skills demonstrated
What this shows
- Technical research and analysis
- Compliance framework interpretation
- Data pipeline design and validation
- Interactive information design
- Technical documentation and user guidance
- Front-end development with TypeScript and React
- User-centered technical communication
See it working
The tool is a pilot, so treat its mappings as drafts. Feedback on the mappings is welcome.