Standards·Policies and clauses·Crosswalk
Policies and clauses
Policies and clauses: crosswalk to external standards
The external standards in the crosswalk domains of policies and clauses, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
Policies and clauses
- Nexus Standards: NS-10, NS-11, NS-14.
- Open standards: ODRL Information Model 2.2; Common Expression Language (CEL); Open Policy Agent Rego policy language; LegalRuleML Core Specification 1.0; NIST Open Security Controls Assessment Language (OSCAL); JSON Schema 2020-12.
- Data and feeds: EUR-Lex Cellar SPARQL endpoint; legislation.gov.uk API.
- Couples with: Commons and command rooms; Verification and monitoring; Conformance and crosswalk to external.
01Process
The process.
Crosswalk graph · policies and clausesNexus Standards registry
Nexus StandardsDomainsExternal standardsIssuing bodiesImplementing repositories
The crosswalk as a table: 30 external standards by domain
| Domain | External standard | Issuing body | Relation |
|---|---|---|---|
| Digital and AI regulation | CEN-CENELEC JTC 21 harmonised standards in support of the… | CEN-CENELEC JTC 21 | cite |
| Digital and AI regulation | Directive (EU) 2022/2555 (NIS2) | European Parliament and Council | cite |
| Digital and AI regulation | OECD Recommendation of the Council on Regulatory Policy… | OECD | cite |
| Digital and AI regulation | Regulation (EU) 2016/679 (General Data Protection… | European Parliament and Council | cite |
| Digital and AI regulation | Regulation (EU) 2024/1689 (Artificial Intelligence Act) | European Parliament and Council | crosswalk |
| Digital and AI regulation | Regulation (EU) 2024/2847 (Cyber Resilience Act) | European Parliament and Council | cite |
| Digital and AI regulation | United Nations Global Principles for Information Integrity | United Nations | crosswalk |
| Digital and AI regulation | Universal Digital Public Infrastructure Safeguards Framework | UN Office of the Secretary-General’s Envoy on Technology and UNDP | crosswalk |
| Enterprise and organisational risk | COSO Enterprise Risk Management – Integrating with… | Committee of Sponsoring Organizations of the Treadway Commission (COSO) | crosswalk |
| Enterprise and organisational risk | IEC 31010:2019 Risk management – Risk assessment techniques | IEC TC 56 with ISO/TC 262 (double logo) | cite |
| Enterprise and organisational risk | ISO 31000:2018 Risk management – Guidelines | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 31022:2020 Risk management – Guidelines for the… | ISO/TC 262 | cite |
| Enterprise and organisational risk | ISO 31050:2023 Risk management – Guidelines for managing… | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 31073:2022 Risk management – Vocabulary | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 37000:2021 Governance of organisations – Guidance | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 37001:2025 Anti-bribery management systems… | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 37301:2021 Compliance management systems… | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 45001:2018 Occupational health and safety management… | ISO/PC 283 | crosswalk |
| Standards development and governance | ISO/IEC 17029:2019 Conformity assessment – General… | ISO/CASCO | cite |
| Standards development and governance | ISO/IEC 17065:2012 Conformity assessment – Requirements… | ISO/CASCO | cite |
| Standards development and governance | ISO/IEC Directives, Part 1 (procedures) with Consolidated… | ISO and IEC | cite |
| Standards development and governance | OASIS Technical Committee Process and IPR Policy | OASIS Open | cite |
| Standards development and governance | OGC Technical Committee Policies and Procedures | Open Geospatial Consortium | cite |
| Standards development and governance | Regulation (EU) No 1025/2012 on European standardisation | European Parliament and Council | cite |
| Standards development and governance | RFC 2026 The Internet Standards Process – Revision 3 (BCP 9) | IETF | cite |
| Standards development and governance | RFC 6852 Affirmation of the Modern Paradigm for Standards… | IAB, IEEE-SA, IETF, Internet Society, W3C | adopt |
| Standards development and governance | UK Government Open Standards Principles | UK Cabinet Office | cite |
| Standards development and governance | W3C Process Document (2025) | World Wide Web Consortium | cite |
| Standards development and governance | Web Content Accessibility Guidelines (WCAG) 2.2 | W3C | adopt |
| Standards development and governance | WTO TBT Agreement Annex 3: Code of Good Practice for the… | World Trade Organization | adopt |
Nexus Standards in the graph: NS-10. A relation is a register entry, never a compliance claim.
1 Nexus Standards · 3 domains · 30 external standards · 20 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph54 nodes and 63 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 3
- NS-10, NS-11, NS-14
- Open standards
- 6
- named, never copied
- Data and feeds
- 2
- listed for reference
- Couplings
- 3
- with other areas
02Enterprise and organisational risk
Enterprise and organisational risk
10 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO 31000:2018 Risk management – Guidelines | ISO/TC 262 | 2018 (second edition; revision at working-draft stage) | compatibility profile (restricted) | paywalled | verified |
| IEC 31010:2019 Risk management – Risk assessment techniques | IEC TC 56 with ISO/TC 262 (double logo) | 2019 (edition 2.0) | cite | paywalled | verified |
| ISO 31022:2020 Risk management – Guidelines for the management of legal risk | ISO/TC 262 | 2020 (first edition) | cite | paywalled | verified |
| COSO Enterprise Risk Management – Integrating with Strategy and Performance | Committee of Sponsoring Organizations of the Treadway Commission (COSO) | 2017 (released 6 September 2017) | compatibility profile (restricted) | paywalled | unverified |
| ISO 37301:2021 Compliance management systems – Requirements with guidance for use | ISO/TC 309 | 2021 | cite | paywalled | unverified |
| ISO 37000:2021 Governance of organisations – Guidance | ISO/TC 309 | 2021 | cite | paywalled | verified |
| ISO 37001:2025 Anti-bribery management systems – Requirements with guidance for use | ISO/TC 309 | 2025 (published 28 February 2025; replaces 2016 edition with 2024 amendment) | cite | paywalled | verified |
| ISO 31073:2022 Risk management – Vocabulary | ISO/TC 262 | 2022 | compatibility profile (restricted) | paywalled | unverified |
| ISO 31050:2023 Risk management – Guidelines for managing an emerging risk to enhance resilience | ISO/TC 262 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO 45001:2018 Occupational health and safety management systems | ISO/PC 283 | 2018 | compatibility profile (restricted) | paywalled | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
03Digital and AI regulation
Digital and AI regulation
8 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| Regulation (EU) 2024/1689 (Artificial Intelligence Act) | European Parliament and Council | in force 1 August 2024; staged application | crosswalk | open | verified |
| CEN-CENELEC JTC 21 harmonised standards in support of the EU AI Act (incl. prCEN/CLC/TR 18347) | CEN-CENELEC JTC 21 | in development; EN 18286 reported at public enquiry (30 October 2025) and later approval by differing sources | cite | paywalled | unverified |
| Regulation (EU) 2024/2847 (Cyber Resilience Act) | European Parliament and Council | in force 10 December 2024; reporting obligations from 11 September 2026; main requirements 11 December 2027 | cite | open | unverified |
| Directive (EU) 2022/2555 (NIS2) | European Parliament and Council | transposition deadline 17 October 2024 | cite | open | unverified |
| Regulation (EU) 2016/679 (General Data Protection Regulation) | European Parliament and Council | 2016 | cite | open | unverified |
| OECD Recommendation of the Council on Regulatory Policy and Governance | OECD | 2012 | cite | open | unverified |
| Universal Digital Public Infrastructure Safeguards Framework | UN Office of the Secretary-General’s Envoy on Technology and UNDP | 2024 | crosswalk | open | unverified |
| United Nations Global Principles for Information Integrity | United Nations | 2024 | crosswalk | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
04Standards development and governance
Standards development and governance
12 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| OGC Technical Committee Policies and Procedures | Open Geospatial Consortium | 05-020r29 | cite | open | verified |
| RFC 6852 Affirmation of the Modern Paradigm for Standards (OpenStand principles) | IAB, IEEE-SA, IETF, Internet Society, W3C | Informational RFC (January 2013); affirmation signed 29 August 2012 | adopt | open | verified |
| ISO/IEC Directives, Part 1 (procedures) with Consolidated ISO Supplement, and Part 2 (drafting) | ISO and IEC | Part 1 and ISO Supplement edition 2024 (V01/2024); Part 2 edition year UNVERIFIED | cite | open | verified |
| RFC 2026 The Internet Standards Process – Revision 3 (BCP 9) | IETF | RFC 2026 (1996) with BCP 9 amendments; draft-ietf-procon-2026bis in progress (2026) | cite | open | verified |
| W3C Process Document (2025) | World Wide Web Consortium | effective 18 August 2025; Proposed Recommendation phase removed | cite | open | verified |
| OASIS Technical Committee Process and IPR Policy | OASIS Open | current TC Process; IPR Policy adopted 20 January 2005 with later revisions | cite | open | verified |
| Regulation (EU) No 1025/2012 on European standardisation | European Parliament and Council | 25 October 2012 (UK retained copy at IP completion day) | cite | open | verified |
| UK Government Open Standards Principles | UK Cabinet Office | 2012, updated 4 May 2018 | cite | open | unverified |
| WTO TBT Agreement Annex 3: Code of Good Practice for the Preparation, Adoption and Application of Standards | World Trade Organization | 1995 | adopt | open | unverified |
| ISO/IEC 17065:2012 Conformity assessment – Requirements for bodies certifying products, processes and services | ISO/CASCO | 2012 | cite | paywalled | unverified |
| ISO/IEC 17029:2019 Conformity assessment – General principles and requirements for validation and verification bodies | ISO/CASCO | 2019 | cite | paywalled | unverified |
| Web Content Accessibility Guidelines (WCAG) 2.2 | W3C | 2.2 | adopt | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
05Relations
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
06Questions
Questions and answers.
Does a crosswalk establish that a policies and clauses artefact conforms to these standards?
A crosswalk is a mapping. A relation is displayed as clauses derived from the external standard and their current results; any determination of conformity with an external standard rests with the body entitled to make it.
Why are some relations shown as compatibility profile (restricted)?
The standard is paywalled. Its text is not reproduced, and a compatibility profile of it is published only under an institutional arrangement with the issuing body.
Why are some entries marked unverified?
An unverified entry rests on a secondary source for at least one of name, body, version or year; NS14-R5 requires it to be shown as unverified.
Related
Around policies and clauses.
Standards
Shape the standards for policies and clauses.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.