Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.
Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.
license
Apache-2.0
compatibility
Compatible with any Agent Skills-compatible assistant (Claude Code, OpenAI Codex, Cursor, Gemini CLI, GitHub Copilot, and others). Run your AI assistant from the repository root so relative paths resolve correctly.
metadata
{"author":"austinsonger","version":"2.0.0","methodology":"NIST IR 8477","standard":"agentskills.io"}
NIST IR 8477 STRM Mapping — GRC Toolkit Skill
When to Activate
Activate this skill whenever the user asks to:
Map, crosswalk, align, or compare any two frameworks, catalogs, or control sets
Create a STRM CSV output file between any two documents
Perform a gap analysis between any source and target document
Extend or verify an existing STRM mapping file
Working Directory
All work must be performed inside the working-directory/ folder at the repository root.
Start your AI assistant from the repository root so relative paths resolve correctly.
working-directory/
Read input files from this directory or from knowledge/ and examples/ in the repo root.
Write all in-progress and output files here.
Never write output to the repo root or any other location.
Saving Completed Mappings
When a mapping is fully complete, create a dated artifact folder inside:
working-directory/mapping-artifacts/
Artifact Folder Naming Convention
YYYY-MM-DD_<FocalFramework>-to-<TargetFramework>
Use the same short framework names as the CSV file naming convention. Examples:
Mapping
Folder Name
NIST CSF 2.0 → ISO 27001:2022
2025-06-01_NIST-CSF-2.0-to-ISO-27001-2022
FFIEC CAT → NIST SP 800-53
2025-06-01_FFIEC-CAT-to-NIST-SP-800-53
ISO 27017:2015 → CIS Controls v8
2025-06-01_ISO-27017-2015-to-CIS-Controls-v8
CMMC 2.0 → NIST SP 800-171
2025-06-01_CMMC-2.0-to-NIST-SP-800-171
PCI DSS v4.0 → SOC 2 TSC
2025-06-01_PCI-DSS-v4.0-to-SOC2-TSC
Use today's date (YYYY-MM-DD) at the time the mapping is completed.
Artifact Folder Contents
Place the following inside the dated folder:
File
Description
<csv-filename>.csv
The completed STRM CSV output (renamed per file naming convention)
Any supporting notes or working files
Optional
Runtime Parameters
Before beginning any work, confirm both parameters with the user if they were not
already specified in the request:
If the user provides only one document, ask which document it should be mapped to.
Either document can be a proprietary catalog, a regulatory framework, an audit
questionnaire, or any structured list of controls or requirements.
node scripts/bin/strm-init-review-log.mjs --focal "<Focal>" --target "<Target>" --csv "<output.csv>" (optional scaffold), then review every row and correct relationship/confidence/rationale/notes before validation.
node scripts/bin/strm-gap-report.mjs --file "<output.csv>" --focal "<Focal>" --target "<Target>" --working-dir working-directory — then expand the gap report per the Gap Analysis Content Standard below
1. Gather Source Files
Locate and read the relevant input files before generating any output:
medium when interpretation or jurisdictional ambiguity exists; low when significant inference is required
NIST IR-8477 Rational
semantic
functional when controls achieve the same outcome through different mechanisms. When mapping across different regulatory domains (for example healthcare → law enforcement, financial → defense), default to functional unless control wording and scope are substantially identical. Use syntactic only when word-for-word similarity is the primary justification (rare).
Observed Distribution Reference (calibration only)
Relationship
Approx %
equal
43 %
intersects_with
39 %
subset_of
17 %
superset_of
1 %
Rationale
Approx %
semantic
63 %
functional
37 %
syntactic
< 1 %
4. Write the Output CSV
File Naming Convention
Set Theory Relationship Mapping (STRM)_ [(<FocalFramework>-to-<BridgeFramework>)-to-<TargetFramework>] - <FocalFramework> to <TargetFramework>.csv
When the focal and bridge frameworks are the same (direct mapping), repeat the focal name in both slots: (NIST_CSF-to-NIST_CSF).
Substitute actual framework names for <FocalFramework>, <BridgeFramework>, and <TargetFramework>.
Examples:
Set Theory Relationship Mapping (STRM)_ [(NIST_CSF_2.0-to-NIST_CSF_2.0)-to-ISO_IEC_27001_2022] - NIST CSF 2.0 to ISO_IEC 27001 2022.csv
Set Theory Relationship Mapping (STRM)_ [(FFIEC-to-FFIEC)-to-NIST_SP_800-53] - FFIEC to NIST SP 800-53.csv
Set Theory Relationship Mapping (STRM)_ [(ISO_IEC_27017_2015-to-ISO_IEC_27001_2022)-to-CIS_Controls_v8] - ISO_IEC 27017 to CIS Controls v8.csv
Required CSV Structure (12 columns)
Row 1: FDE#,FDE Name,Focal Document Element (FDE),Confidence Levels,NIST IR-8477 Rational,STRM Rationale,STRM Relationship,Strength of Relationship,<Target> Requirement Title,Target ID #,<Target> Requirement Description,Notes
Row 2+: <data rows>
Column definitions:
Col
Header
Content
A
FDE#
Source control ID
B
FDE Name
Short human-readable label for the source control
C
Focal Document Element (FDE)
Full control text or requirement from the source document
D
Confidence Levels
high / medium / low
E
NIST IR-8477 Rational
semantic / functional / syntactic
F
STRM Rationale
Narrative explaining both controls and why the relationship holds
Target document short title (replace <Target> with actual target name)
J
Target ID #
Target document control ID
K
<Target> Requirement Description
First sentence of target control text (replace <Target> with actual target name)
L
Notes
Scope differences, gaps, or caveats
5. Rationale Writing Pattern
The STRM Rationale field (Column F) must follow this structure:
<Source Framework> <FDE#> requires <what the FDE requires>. <Target Framework> <Target ID#> requires <what the target control requires>. Both <shared objective>.
Example (FFIEC → NIST SP 800-53):
FFIEC D3.PC.Am.B.4 requires periodic user access reviews for all systems. NIST SP 800-53 AC-2 requires managing information system accounts including periodic review of account authorizations. Both address periodic access review requirements.
For intersects_with mappings, conclude with the divergence:
Both address . additionally covers ; additionally covers .
6. Manual Adjudication Pass (Required Before Declaring Done)
Script-generated rows are a starting point only. Before validation and completion:
Review every mapping row manually.
Confirm STRM Relationship is defensible for the pair.
Re-check equal rows first:
If scope/mechanism differs materially, downgrade to intersects_with or subset_of/superset_of.
Re-check intersects_with rows:
If wording and scope are substantially identical, promote to equal.
Re-check subset_of/superset_of rows:
Verify containment direction is correct.
Ensure Notes explain why the grading was chosen for that row (no placeholder boilerplate).
Recompute strength using the formula after any relationship/confidence/rationale-type changes.
Save a manual-review log in the artifact folder:
Manual_Review_<Focal>-to-<Target>.md
Include at minimum: rows reviewed, rows changed, and the list of changed FDE IDs.
For every changed row, include a one-line rationale explaining why the relationship/confidence/rationale-type was changed.
When deriving indirect mappings (A→C via A→B and B→C):
A→B
B→C
Derived A→C
equal
equal
equal
equal
X
X
X
equal
X
subset_of
subset_of
subset_of
superset_of
superset_of
superset_of
not_related
anything
not_related
anything
not_related
not_related
intersects_with
anything
indeterminate
Indeterminate = do not create a derived row; flag for manual review.
Inverse Relationships
When generating reverse mappings (Target → Source):
Forward
Inverse
equal
equal
subset_of
superset_of
superset_of
subset_of
intersects_with
intersects_with
not_related
not_related
Gap Analysis Content Standard
The script strm-gap-report.mjs generates a minimal stub. After running it, always overwrite the generated file with a fully expanded gap analysis. The expanded report must contain all of the following sections:
Target control fully satisfies the source requirement (equal or subset_of)
🟡 Partial Coverage
N
%
Some overlap; supplemental controls likely needed (intersects_with)
🟠 Source Exceeds Target Scope
N
%
Source requirement is broader; target only partially addresses it (superset_of)
🔴 No Coverage
N
%
No meaningful target control found (not_related)
Replace "Source" and "Target" labels with the actual focal and reference framework names.
3. Relationship Distribution table
Counts and percentages for all five STRM relationship types.
4. Per-tier regulation/control tables
For each of the four tiers, include a table listing every FDE in that tier with:
FDE ID and title
Mapped target control ID and title
STRM relationship
Strength of Relationship score
For the No Coverage tier, add a Notes column explaining why no control exists or what kind of supplemental evidence would be needed.
5. Recommended Actions section
Prioritized by tier:
Priority 1 — Address No Coverage gaps: list each FDE with a concrete recommended action (new control, policy, or evidence artifact)
Priority 2 — Strengthen Partial / Exceeds Scope: list specific FDEs with strength ≤ 4 and suggest supplemental controls or documentation
Classification Logic
Classify each FDE by its best relationship across all its mapped rows:
Best relationship present
Tier
equal or subset_of
✅ Full Coverage
intersects_with (no equal/subset_of)
🟡 Partial Coverage
superset_of (no equal/subset_of/intersects_with)
🟠 Source Exceeds Target Scope
only not_related
🔴 No Coverage
Quality Rules
Never leave Column F (Rationale) empty — every row needs a narrative.
Strength score must match the formula — do not guess; compute explicitly.
One FDE can map to multiple target controls — create one row per target control.
not_related rows are rare — only use when there is genuinely zero overlap.
Do not invent target control IDs — every Target ID # must come from the actual target document provided.
Confidence defaults to high — use medium only when interpretation or jurisdictional ambiguity exists; use low only when the mapping requires significant inference.
Focus on Baseline maturity first — when a framework has maturity tiers, prioritize baseline/foundational controls before advanced ones.
Adapt column header labels — replace <Target> in columns I and K with the actual target document name (e.g., ISO 27001 Requirement Title, ISO 27001 Requirement Description).
Run a relationship distribution self-check after all rows are complete:
If subset_of + superset_of = 0%, review equal rows; many may actually be subset_of.
If equal > 50%, review each equal row and confirm neither control explicitly requires more than the other.
If one control says "SHALL" and the other says "SHOULD", this is typically subset_of, not equal.
Manual QA is mandatory — never declare completion from script output alone.
Validation and gap report run after manual QA only — do not run post-completion checks in parallel with row generation.
Gap analysis must be fully expanded — the stub produced by strm-gap-report.mjs is not the final output. Always replace it with the full expanded report per the Gap Analysis Content Standard above, including per-regulation tables for all four coverage tiers and a Recommended Actions section.
Optional: Risk and Threat-Enriched Mappings
These inputs are ONLY used when the user explicitly requests risk or threat data.
Do not load, reference, or incorporate these files in any standard framework-to-framework
or control-to-control mapping unless the user specifically asks for it.
When to Activate
Activate this section only when the user says something like:
Each risk (risk_id) links to controls via mapped_controls and to threats via threat_ids
Each threat (threat_id) links to risks via mapped_risk_ids
Risks already carry embedded STRM set_theory_relationships — use these when available
Specialized Mapping Types
Risk-to-Control
Use when the user wants to map risks from the library to framework controls.
FDE = risk entry from risks.json (risk_id as FDE#, title as FDE Name, description as FDE text)
RDE = target framework control
Use the embedded set_theory_relationships[].relation and confidence_alignment from the risk record as starting points; override with independent analysis if needed
Include likelihood and impact scores in the Notes column
Threat-to-Risk
Use when the user wants to map threats to risks.
FDE = threat entry from threats.json (threat_id as FDE#, title as FDE Name, description as FDE text)
RDE = risk entry from risks.json
Derive the STRM relationship from the threat's materiality and the risk's scope
Note threat_grouping (Natural, Manmade, Technical) in the Notes column
Threat-to-Control
Use when the user wants to map threats directly to framework controls (skipping the intermediate risk layer).
FDE = threat entry from threats.json
RDE = target framework control
Traverse threat → risk → control chain to derive the relationship
Apply transitivity rules — if any intermediate relationship is intersects_with, mark derived as indeterminate and flag for review
Output Naming for Risk/Threat Mappings
Follow the same artifact folder convention but reflect the mapping type:
Mapping Type
Folder Name Example
Risk-to-Control
2025-06-01_SCF-Risks-to-NIST-SP-800-53
Threat-to-Risk
2025-06-01_SCF-Threats-to-SCF-Risks
Threat-to-Control
2025-06-01_SCF-Threats-to-CIS-Controls-v8
Quality Rules (Risk/Threat specific)
Never auto-include risk or threat files — wait for explicit user request
Respect embedded STRM data in risks.json — do not contradict without justification
Flag unmapped threats (mapped_risk_ids: []) in Notes — they require manual risk derivation
Materiality fields in threats (pre_tax_income_5_percent, etc.) are informational — include relevant values in Notes if present
Existing Mappings in This Repository
Before starting a new mapping, search for existing files to avoid duplication.
Run a glob across the project root and working-directory/ for any CSV whose name
contains Set Theory Relationship Mapping or STRM. The file name pattern
encodes both source and target, so it is the fastest way to check for prior work.
Template Reference
A blank STRM template lives at:
TEMPLATE_Set Theory Relationship Mapping (STRM).csv
Copy (do not modify) that file as the starting point, then rename the copy
according to the file naming convention above.
Related Resources
Resource
Purpose
TEMPLATE_Set Theory Relationship Mapping (STRM).csv
