Review first draft of compliance matrix alignments

[SecurityCRob]

We have created a Compliance Crosswalk Matrix(1) - to help see where our baseline criteria aligns with global frameworks, standards, and regulations. I started us off with looking at the EU CRA, NIST's SSDF, NIST's CSF, Security Insights and I'm working through BP Badges. Eventually we'll need to do things like NIST 800-53, EU DORA, EU NIS/NIS2, ISO 2700x, etc.

I'd like feedback on the initial alignments from the community to ensure or correct my perspective. Did I account for and align things appropriately?

• The "Crosswalk" tab is where everything ultimately is aggregated and will be displayed (until we debate the best ways to show our data....a future conversation). This is where the meat of what I am looking for feedback on. Here I am keying off the OSPS criteria and showing "If you fulfill OSPS-AC-01. then you also get credit for SSDF requirement PO3.2 or CRA Annex 1.2d, etc.)
• Each framework/standard/reg has it's own tab where I key off that standard to the OSPS. As we pull in more regs/frameworks, a tab such as this is where the mapping will start and ultimately it will get added back into the "Crosswalk" tab. The data should be identical to the alignments in the 1st tab.

I'd love it if folks could look at this and ponder it, and then we can coordinate a live working session to work through the feedback together. I propose doing this in early January '25.

Thanks for your time, expertise, and collaboration on this!

(1) - https://docs.google.com/spreadsheets/d/1an5mx3rayoz3JRFUepD56zgprpwXBXBG70fVZvIMCpA/edit?gid=769418932#gid=769418932

[SecurityCRob]

Let's hash out the ultimate display method/location in this issue: #99

[TheFoxAtWork]

I've shared this with a number of folks hoping to get more eyes on this. Thank you so much @SecurityCRob and others for your efforts putting together this very large cross walk.

[SecurityCRob]

We'll add SLSA and S2C2F to the matrix once criteria are firm

[SecurityCRob]

We're still not sure what the ultimate final form for this will be. Markdown tables are terrible, external gsheets are also not great.

[eddie-knight]

@SecurityCRob FWIW, we do have the yaml field for this—allows us to store a 1->n list of mappings for each criteria.

[SecurityCRob]

We've place the initial mappings inside the Baseline yaml file(s). We'll continue the mapping process with additional frameworks and regs as time and interest allows. If there are additional frameworks/regs the community feels we should do sooner, please let us know here!