Compliance crosswalk
A compliance crosswalk maps one technical control to every regulatory framework requirement it genuinely addresses, so evidence gathered once counts across SOC 2, PCI DSS, GDPR, ISO 27001, and NIST 800-53 instead of being re-proven per regime. Caisson's computeCrosswalkRollup joins canonical controls to these regime crosswalks, deriving each cell's claim mechanically from evidence status and review depth, never editorially.
In code
const cells: CrosswalkRollupCell[] = [];
for (const { framework, reference, contributions } of byRef.values()) {
const canonicalControlIds = [
...new Set(contributions.map((c) => c.controlId)),
].sort(cmp);
const status = contributions.reduce<ControlStatus>(
(acc, c) => worstStatus(acc, c.status),
"ready",
);
const allReady = contributions.every((c) => c.status === "ready");
const allReviewed = contributions.every((c) =>
isReviewedAndFresh(c.verification),
);
const regimeId = FRAMEWORK_LABEL_TO_REGIME[framework];
const regime =
regimeId === undefined
? undefined
: input.regimeCrosswalks.find((rc) => rc.regime === regimeId);
const regimeRow = regime?.rows.find((r) => r.control === reference);
const regimeImplements = regimeRow?.claim === "implements";
const claim: "maps-to" | "implements" =
allReady && allReviewed && regimeImplements ? "implements" : "maps-to";How it holds
Restates, never originates
A cell only promotes to implements when every contributing canonical control is ready, every crosswalk reference it draws on carries a reviewed-or-better, non-stale verification record, AND the matching regime-crosswalk row (where one exists) is already implements, any one gap and the cell defaults to maps-to.
A pure join over existing pointers, not a new catalog
computeCrosswalkRollup takes catalogs, controlStatuses, and regimeCrosswalks as injected input and walks each canonical control's own crosswalk[] array, the dual-catalog OSCAL spine ADR-0333 first wrote as a deferred fork was descoped from v1's rollup because this pointer join already answered the evidenced demand.
Five regimes, two join shapes
SOC 2, PCI DSS, GDPR, ISO 27001, and NIST 800-53 all live in regimeCrosswalks. ISO and NIST rows join by canonicalControlId instead of a crosswalk[] pointer, but that join never attaches a verification record, so it can't single-handedly promote a cell to implements.
Deterministic and OLIR-flagged
Cells sort by (framework, reference) regardless of input order, and any contribution seeded from NIST's OLIR SP 800-53 <-> ISO/IEC 27001:2022 mapping carries a note repeating NIST's own subjective/incomplete warning rather than a stronger claim.