What Is Framework Mapping? See Supplier Alignment Without The Manual Work

Most security and risk teams are held to an external standard. For some it is a regulator's requirement, such as the NSCS Cyber Assessment Framework (CAF). For others it is a recognised benchmark like ISO 27001, or a board that asks how supplier assurance compares to the NIST Cybersecurity Framework (CSF). These standards are rarely the problem. The challenge is that your suppliers' security information does not arrive in the shape those standards need.

What is framework mapping, and why does it matter?

Framework mapping is the work of connecting the two: taking what a supplier has told you and showing which of a framework's requirements it speaks to.

It matters because it turns supplier information into something you can act on. You can see where a supplier already meets the requirements you work to, and where to ask for more.

Across our customer base, we found a strong need for this across government, financial services, insurance, investment, utilities and local councils. CAF alone applies to roughly 370 UK councils and fire services, who are expected to complete CAF returns.

How teams do this today, and where it breaks down

From speaking to users, we learned that teams set up various workarounds to see how suppliers align with the frameworks they work to.

Reading it across by hand

A reviewer takes a supplier's answers and cross-references them against a framework, control by control. While this approach works for a few suppliers, it does not scale as your supplier base grows. One UK public sector team told us that outcome-based frameworks like CAF work well for high-risk suppliers but manually assessing each supplier is not scalable as your supplier base grows.

Sending suppliers a standard-specific spreadsheet

One council we spoke to said their entire assurance process is CAF-based and therefore they send suppliers a spreadsheet of CAF questions.

Building a mapping tool themselves

Some clients take on the work. One client built their own spreadsheet mapping Risk Ledger's Standardised Assessment Framework (SAF), the method we use to collect security data from suppliers, against Cyber Essentials Plus and ISO 27001. Another asked ChatGPT to map it against ISO, NIST and NCSC CAF.

However, a mapping like this is only as reliable as the person who built it and needs rebuilding whenever the supplier assessment is updated, or the target framework changes.

Whichever route a team takes, the same problems follow:

• It's slow - Every supplier review repeats the cross-referencing, and the work grows exponentially with every supplier you add.
• It's hard to maintain consistency and collaborate The logic behind each judgement lives in a reviewer's head or a private spreadsheet meaning your team may not be working from the same shared context.
• It's hard to keep current - Frameworks and assessments change, and a home-built mapping does not change with them.
• It adds to suppliers' workload - Extra questionnaires ask suppliers to restate what they have already told you. One supplier told us they complete a CAF-based assessment for some clients on top of their standard one, and another explained that their customers send "so many different requests for information", often "bespoke in different templates".

We built Framework Mapping to take that work off your team.

‍

What we built

Framework Mapping lets you apply a pre-built policy to your suppliers and see how their existing Risk Ledger assessment aligns with a framework. For now, it covers five frameworks:

• ISO/IEC 27001 (Annex A)
• NCSC Cyber Assessment Framework (CAF)
• NCSC Cyber Essentials
• NCSC Cloud Security Principles
• NIST Cybersecurity Framework (CSF)

In the platform, we've added Pre-Built Industry Framework Policies, where each policy includes the controls relevant to each industry framework. Apply the policy to relevant suppliers to see how they perform against the mapped controls, using their existing assessment responses. Framework Mapping does not change how supplier compliance scores are calculated.

We have also published a mapping sheet that shows how our controls address each requirement within each framework, accompanied by notes on where and why coverage is partial.

You can skip the manual cross-referencing, and in many cases the extra questionnaire too. You use what your suppliers have already provided, and suppliers don't have to answer multiple assessments from the same client.

A few things make this more useful than doing it by hand:

• The mapping is consistent. Every supplier is reviewed against the same mapped controls.
• You can find the gaps quickly. See which mapped controls a supplier has in place and which they do not, so you know where to follow up.
• You stay in control. Policy controls are locked by default, which preserves our standard mapping. You can unlock and adjust requirements to suit your organisation, in which case you maintain those changes.
• Benchmark suppliers against well known frameworks. Compare supplier assessments to the frameworks your auditors, regulators and board ask about, including ISO 27001, NIST CSF and the NCSC CAF.

What to expect from Framework Mapping

Framework Mapping shows how Risk Ledger controls map to and align with a framework. It points you to what a supplier is asked in the assessment, not how a supplier has answered.

It is not a certification, and it is not audit or regulatory evidence. A supplier's answers show how they align with a standard, but that does not mean they hold its certification or have passed a formal assessment.

How we built it

We started where we found the strongest need. The five frameworks are the ones our users asked for most, through customer conversations and feedback from our commercial teams.

We then worked with an external cyber security consultant to map each framework requirement against all 285 controls in Risk Ledger's Standardised Assessment Framework (SAF), with an explanation of how our controls meet it.

Every requirement is rated Fully, Partially or Not covered. We have erred on the side of caution: where there was any doubt about full coverage, we recorded Partially.

Here is how the SAF covers each framework:

‍

We have not tried to reach 100% for its own sake. Some requirements are commercial or contractual commitments that a supplier security assessment cannot establish. Other requirements are so detailed that asking every supplier about them would slow down assessments and unlikely change your decision.

Where a control needs a threshold, such as how often a supplier runs vulnerability scans, the industry frameworks do not set a number. We set a baseline, informed by our own policies and by what clients most commonly require. You can adjust these thresholds within the platform.

How is Risk Ledger's framework mapping different from DIY and general-purpose tools?

While an LLM, a spreadsheet, a generalist GRC tool, or procurement tool can produce a mapping, keeping it right is the harder part.

Here is what a specialist mapping adds.

• It is built by specialists and shaped by clients. An external cyber security consultant mapped every requirement, and the frameworks covered are the ones our clients and prospects asked for most.
• The reasoning is visible. Every requirement carries a rating, comments on how our controls meet it, and a reason for any remaining gap. You can challenge any row.
• It sits on a shared supplier profile. Suppliers keep one Risk Ledger profile that all their customers can see, so the mapping applies to answers that are already there.
• It is reviewed on a schedule. We review the SAF every six months, and the mapping is updated alongside it. In contrast, a mapping you build yourself is a snapshot of one person's reading, on the day they made it.
• It follows the regulations, not only our framework. We will also update the mapping when regulators publish changes, such as a new version of the NCSC CAF.

Get started

Framework Mapping is available now in the platform. To add a policy, see our help article. To request the mapping sheet, contact support@riskledger.com or speak to your Customer Success Manager.

Not yet a Risk Ledger client? Book a demo call with us to learn more.

‍