Nexus Standards · Identity, authorization and zero trust · Crosswalk

Identity, authorization and zero trust

Identity, authorization and zero trust: crosswalk to external standards

The external standards in the crosswalk domains of identity, authorization and zero trust, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).

Back to Identity, authorization and zero trustAll programme areas
01Canvas

The process.

Crosswalk graph · identity, authorization and zero trustNexus Standards registry
Identity, authorization and zero trust: crosswalk32 nodes on four orbits (Nexus Standards and implementing repositories at the centre, then domains, external standards and issuing bodies), joined by 42 recorded relations.
Nexus StandardsDomainsExternal standardsIssuing bodiesImplementing repositories

2 Nexus Standards · 2 domains · 19 external standards · 9 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.

Crosswalk graph32 nodes and 42 links from the registry of external standards, programme areas and implementations (registry/external-standards.yaml, registry/consumers.yaml. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.

02Zero trust and identity

Zero trust and identity

3 register entries.

StandardBodyVersionRelationAccessVerified
NIST SP 800-207 Zero Trust ArchitectureNISTFinal (11 August 2020)adoptopenverified
CISA Zero Trust Maturity Model Version 2.0CISA (US Cybersecurity and Infrastructure Security Agency)2.0 (April 2023)profileopenverified
OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0IETF and OpenID FoundationRFC 6749 (2012); OpenID Connect Core 1.0adoptopenunverified

Unverified entries rest on a secondary source for at least one field, as indicated in the register.

03Canvas

Crosswalk evidence.

Canvas · crosswalk evidenceProcess diagram
Identity, authorization and zero trust: how a relation to an external standard is evidencedRegister entries for the area by domain and relation. NS-14 specifies the evidence each relation requires and the form in which a claim may be displayed. Names and standards remain with their stewards.

Fig.Relations recorded for the area and the evidence NS-14 requires before a relation is displayed.

04Earth observation

Electrified and connected activity worldwide

The map is framed on the world as context for identity, authorization and zero trust. Shown at first: night-time lights, daily (VIIRS Black Marble, VNP46A2, NASA LAADS DAAC) and population density, 2020 (Gridded Population of the World v4.11, NASA SEDAC, CIESIN, Columbia University). The layer drawer adds true colour (VIIRS NOAA-20 corrected reflectance). NASA products are served through NASA GIBS under NASA's open data policy, with acknowledgement; population density is GPW v4.11 by CIESIN, Columbia University, under CC BY 4.0; coastlines, boundaries and place names come from NASA GIBS reference layers (© OpenStreetMap contributors, ODbL) and Natural Earth (public domain). Each layer shows its own observation date; full credits are given under the map. Other sources of the profile, such as FIDO Metadata Service (MDS3) and CISA Known Exploited Vulnerabilities catalogue, are listed for reference.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Connected activity, framed on World. Layers as NASA publishes them, each with its own date.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural EarthSources and licences

  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
  • VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
  • Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
  • © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
  • Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
  • Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
  • Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
  • NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
  • Optional layers (3 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

  • Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
  • Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
  • True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

05Security and cyber

Security and cyber

16 register entries.

StandardBodyVersionRelationAccessVerified
ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection - Information security management systems - RequirementsISO/IEC JTC 1/SC 272022 (edition 3.0, 25 October 2022)compatibility profile (restricted)paywalledverified
ISO/IEC 27005:2022 Guidance on managing information security risksISO/IEC JTC 1/SC 272022 (replaces 2018 edition)citepaywalledverified
ISO/IEC 27701:2025 Privacy information management systemsISO/IEC JTC 1/SC 272025 (standalone edition; 2019 edition was an extension of 27001/27002)citepaywalledverified
NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)NIST2.0 (26 February 2024)crosswalkopenverified
NIST SP 800-37 Rev. 2 Risk Management Framework for Information Systems and OrganizationsNISTRevision 2citeopenunverified
NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and OrganizationsNISTRev. 5 (September 2020) with Release 5.2.0 (27 August 2025)crosswalkopenverified
NIST Open Security Controls Assessment Language (OSCAL)NIST1.1.x (1.1.2 confirmed in tooling; 1.1.3 UNVERIFIED)adoptopenverified
OASIS STIX Version 2.1 (Structured Threat Information Expression)OASIS Cyber Threat Intelligence TC2.1 (OASIS Standard, 10 June 2021)citeopenverified
OASIS TAXII Version 2.1 (Trusted Automated Exchange of Intelligence Information)OASIS Cyber Threat Intelligence TC2.1 (OASIS Standard, 10 June 2021)citeopenverified
Common Vulnerability Scoring System v4.0FIRST CVSS Special Interest Group4.0citeopenunverified
FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism StandardNIST2024adoptopenunverified
FIPS 204 Module-Lattice-Based Digital Signature StandardNIST2024adoptopenunverified
FIPS 205 Stateless Hash-Based Digital Signature StandardNIST2024adoptopenunverified
IAEA Safety Standards (nuclear, radiation, transport and waste safety)International Atomic Energy Agencycurrentciteopenunverified
United Nations Global Counter-Terrorism StrategyUnited Nations General Assemblycurrentciteopenunverified
RFC 8032 Edwards-Curve Digital Signature Algorithm (EdDSA)IETF2017adoptopenunverified

Unverified entries rest on a secondary source for at least one field, as indicated in the register.

06Relations

Relation types and their evidence

RelationMeaningEvidence
citeThe Nexus Standard refers to the external standard as context.Identifier, version and URL in the register.
profileThe Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP).Conformance tests against the external standard's own validator where one exists.
crosswalkElements of the external standard map to Nexus elements (clauses, record fields).A crosswalk table in the register entry; each row cites the external clause by number, never by text.
adoptThe Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR).Validation of values against the external scheme.
extendA Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks.The extension is a Nexus clause or field; the external standard is cited as the baseline.
gapNo external standard covers the concern; a Nexus Standard specifies it.The gap statement in the landscape study.
07Questions

Questions and answers.

Does a crosswalk establish that a identity, authorization and zero trust artifact conforms to these standards?
A crosswalk is a mapping. A relation is displayed as clauses derived from the external standard and their current results; any determination of conformity with an external standard rests with the body entitled to make it.
Why are some relations shown as compatibility profile (restricted)?
The standard is paywalled. Its text is not reproduced, and a compatibility profile of it is published only under an institutional arrangement with the issuing body.
Why are some entries marked unverified?
An unverified entry rests on a secondary source for at least one of name, body, version or year; NS14-R5 requires it to be shown as unverified.
NRNexus Reports gateway · GW-STD

Contribute to Nexus Reports from this page.

Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Nexus Standards

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Across the Consortium

The same subject across the Consortium.

Related

Around Identity, authorization and zero trust.

Nexus Standards

Shape the standards for identity, authorization and zero trust.

Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.

Propose a change Roadmap to 2030Adopt and implement

Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artifact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.

Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.

Skip to toolbar