How I built the Security Lab’s governance crosswalks: what was mapped, what each grade means, how the rows were checked, and what the data does not claim.
Open the governance crosswalks in the Security Lab
Why a crosswalk is only as good as its method
A crosswalk says that a control in one framework lands on a control in another. A chief information security officer (CISO) who relies on one is not buying a spreadsheet. They need mappings they can defend when someone asks why a row says Direct and not Partial, or why a cell is blank.
That defence rests on the method: the texts read, the grades used, the checks run, and what changed when a check failed. Every crosswalk row carries its reason, so you can test the reading against the source.
What was mapped
The main crosswalk starts from ECC-2:2024, the current edition of the Essential Cybersecurity Controls (ECC) from the National Cybersecurity Authority (NCA). It maps 38 ECC-2 controls one way to ISO/IEC 27001:2022, from the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). A second column grades the same rows against the Cyber Security Framework (CSF) v1.0 of the Saudi Central Bank (SAMA).
ECC-2 has 108 main controls in 4 domains and 28 subdomains. The 38 are a curated subset across all four domains, not full-framework coverage.
The lineage map follows ECC-1:2018 into ECC-2:2024. It has 114 rows: the 108 ECC-2 controls plus 6 ECC-1 controls with no ECC-2 control. The statuses are 96 retained, 12 changed, 4 moved out and 2 deleted.
A third dataset compares SAMA CSF, the SAMA Information Technology Governance Framework (ITGF) and ECC-2 across the same 38 controls.
The mapping vocabulary
Direct, Partial, None
In the 38-row crosswalk, the ISO grades are 15 Direct and 23 Partial. The SAMA grades are 19 Direct, 18 Partial and 1 None.
The grades use these definitions. Direct is the same core obligation at the cited control’s level, not identical wording. Partial is a material scope gap, a bundled obligation, or an obligation split across controls.
ECC-2 2-12-3 shows Partial in practice. Its SAMA reason says CSF 3.3.14 “specifies neither ECC’s 12-month retention minimum nor its explicit privileged/remote-access logging requirements.”
None means different things in different places. In the 38-row crosswalk it appears once, on 2-1-3, after a check. In the lineage data 76 ISO cells are blank: 70 rows outside the curated pass and 6 rows with no ECC-2 control. The lineage table names the cause of each blank: “not in curated pass”, “no equivalent identified” or “no ECC-2 control”.
One way
Each row starts from one ECC-2 control and names one ISO reference and at most one SAMA CSF reference, with None where no equivalent was found. It never says which ECC control covers a given ISO or SAMA control. A control that no row points to does not appear, and that says nothing about whether ECC has an equivalent. Coverage is counted out of the 38 ECC controls, never as a percentage of ISO Annex A or SAMA CSF.
Why one control has no SAMA equivalent
ECC-2 2-1-3 requires an acceptable-use policy to be defined and communicated. It is Direct to ISO A.5.10 and the only None in the SAMA column. Before a re-map on 6 September 2026, four rows were None. Three were re-mapped against the SAMA Rulebook text. Only 2-1-3 stayed None.
A reviewer pointed out that a blank reason on a None row is its own defect. A reader cannot tell “checked, genuinely no equivalent” from “not looked at”. So the row carries negative evidence: “Checked 3.1.3, 3.1.4, 3.1.6, 3.3.1, 3.3.3 and 3.3.10: no explicit requirement to define, document, approve and communicate an organization-wide acceptable-use policy.” The finding is narrow. It does not say SAMA is silent on acceptable use.
Lineage statuses
Retained is the same obligation, possibly renumbered. Changed is materially reworded, expanded or narrowed. Moved-out left ECC entirely. Deleted was dropped with no ECC-2 successor. The legend also defines split, merged and new, but no row uses them.
Statuses follow the official ECC-2:2024 Appendix C List of Updates where it itemises a change. Otherwise they come from a direct comparison of the English texts. Row 2-10-3 is one of those.
How the rows were produced and checked
Artificial intelligence (AI) models drafted and reviewed the rows. I set the scope of each review and approved the September change set before it shipped.
July. On 22 July 2026, on my instruction, Claude, an AI model, drafted the ECC-2 re-map. It checked the draft line by line against the official English texts of ECC-1:2018 and ECC-2:2024. Codex reviewed it adversarially. That review found Appendix C, which then drove the statuses, and 6 Direct grades were lowered to Partial. The re-map was published the same day, before the later checks below.
August. On 5 August 2026 a four-reviewer council, with a second Codex pass, corrected carried-over mappings against the ECC-2 control text. On 9 August 2026 the three-way dataset passed its publish gate after checks against the SAMA Rulebook text.
September. A review found that the reason on row 2-3-1 described its subdomain, not the control. I asked for an audit of all 38 rows against the ECC-2 English text, the ISO Annex A titles and the SAMA Rulebook CSF text.
Two AI reviewers marked 18 rows FIX and 9 rows CHECK, a question for me to decide. The most common defect, in 7 rows, was subdomain content written into the reason for a subdomain’s first control.
A second model reviewed that audit and did not accept it wholesale. Some replacement texts overclaimed, and one penetration-testing citation came from a different SAMA framework. It amended 13 FIX items, rejected one CHECK item and found edits needed in 9 of the 11 rows marked OK. The resulting apply list covered 34 rows.
A third pass read every row’s ECC-2 control sentence and SAMA CSF text next to the proposed values and located every citation verbatim. It found all 34 edits valid, with one limit: ISO was checked against published Annex A titles, not the ISO control text. I approved the change set.
The edits shipped on 8 September 2026 in theme version 1.54.4, and the data records that date as its re-verification date. No lineage status changed. Six ISO grades and four SAMA grades went from Direct to Partial. One SAMA grade, on 1-2-1, went from Partial to Direct.
What drifted. The three-way dataset took its SAMA CSF columns from the 38-row crosswalk, copied by script. After the September edits, six rows kept older SAMA CSF values: 1-2-1, 2-11-1, 2-12-3, 4-1-2, 4-1-3 and 4-2-1, and the examination evidence index kept the old reference on 2-11-1. The provenance note still said the columns were copied. A live check of every lab tool on 16 September 2026 caught the drift, and the dataset and both published pages were brought back in line with the checked values that day.
The publication switch. The lineage table’s rows render publicly only when the dataset’s verified flag is true. Otherwise visitors get a draft banner, and only a logged-in administrator sees the rows. The gate is only as strict as the decision to set the flag. The data records verified_at as 22 July 2026, the day the AI-drafted, AI-reviewed re-map was published. The August council and the September audit came later.
Still open. ECC-2 1-3-1 is marked changed, but Appendix C lists no update for it. The Codex second opinion left its lineage unverified, so the status stands provisionally. The July release followed Appendix C on this row and on ECC-1 2-7-3; both were changed in the August review, committed on 12 August 2026. The published table does not yet flag 1-3-1 as provisional.
Corrected on 13 October 2026. ECC-1 2-7-3 had been labelled moved-out, although Appendix C records “Deletion Control 2-7-3”, and its reason said classification and labelling continue under ECC-2 2-1-5. It is now labelled deleted, as Appendix C records, and the lineage rows for ECC-1 2-7-3 and ECC-2 2-7-2 no longer carry that claim. The counts above are the corrected ones.
What it is not
Not a regulator’s view. These are my mappings, not NCA’s or SAMA’s interpretation. The transition map is not an NCA-published crosswalk. SAMA CSF section 1.6 reserves interpretation to SAMA. Nothing here means a regulator reviewed or endorsed a row.
Not legal advice. Where a mapping differs from the NCA or SAMA text, the official text prevails. For ECC the Arabic edition is binding, and the checks here used the English texts. Independently verify before use.
Not client data. The examination evidence column in the three-way dataset holds no bank-specific or client-specific facts, no examination outcomes and no findings. Nothing here shows that any organisation used these mappings.
Not full coverage. The crosswalk holds 38 of 108 main controls. The ISO checks compared Annex A titles; two rows cite information security management system (ISMS) clauses 5.3 and 6.1.2 instead, and no ISO control text is quoted. The SAMA mappings track CSF v1.0 and will be re-based when SAMA publishes a successor.
Where it lives
All of this sits in the governance section of the Security Lab. It holds the ECC-2 to ISO 27001 crosswalk and the transition map. The three-way comparison and the examination evidence index sit next to them.
Saqr, the assistant on this site, has its own portfolio entry.
Hiring for a security leadership role?
Replies within two business days, in English or Arabic.