Verification services: crosswalk to external standards
The external standards in the crosswalk domains of verification services, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
- Nexus Standards: NS-10, NS-11, NS-14.
- Open standards: Verifiable Credentials Data Model v2.0; in-toto Attestation Framework; PROV-O: The PROV Ontology; Bitstring Status List v1.0; SCITT Architecture (Internet-Draft).
- Data and feeds: Rekor public transparency log; STAC JSON Schemas; DataCite REST API (DOIs).
- Couples with: Conformance test suites; Verified intelligence and transparency; Capital pathway, The Global Risks Alliance (GRA).
The process.
The crosswalk as a table: 9 external standards by domain
| Domain | External standard | Issuing body | Relation |
|---|---|---|---|
| Provenance and evidence | C2PA Content Credentials specification | Coalition for Content Provenance and Authenticity (Joint Development Foundation) | adopt |
| Provenance and evidence | IETF SCITT architecture (Supply Chain Integrity… | IETF SCITT working group | profile |
| Provenance and evidence | in-toto Attestation Framework | in-toto project (CNCF) | adopt |
| Provenance and evidence | Sigstore (Cosign, Fulcio, Rekor) | OpenSSF (Linux Foundation); graduated project March 2024 | adopt |
| Provenance and evidence | W3C PROV-O: The PROV Ontology | W3C Provenance Working Group | adopt |
| Provenance and evidence | W3C Verifiable Credentials Data Model v2.0 | W3C Verifiable Credentials Working Group | crosswalk |
| Zero trust and identity | CISA Zero Trust Maturity Model Version 2.0 | CISA (US Cybersecurity and Infrastructure Security Agency) | profile |
| Zero trust and identity | NIST SP 800-207 Zero Trust Architecture | NIST | adopt |
| Zero trust and identity | OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0 | IETF and OpenID Foundation | adopt |
Nexus Standards in the graph: NS-11, NS-14. A relation is a register entry, never a compliance claim.
2 Nexus Standards · 2 domains · 9 external standards · 9 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph22 nodes and 22 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 3
- NS-10, NS-11, NS-14
- Open standards
- 5
- named, never copied
- Data and feeds
- 3
- listed for reference
- Couplings
- 3
- with other areas
Zero trust and identity
3 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| NIST SP 800-207 Zero Trust Architecture | NIST | Final (11 August 2020) | adopt | open | verified |
| CISA Zero Trust Maturity Model Version 2.0 | CISA (US Cybersecurity and Infrastructure Security Agency) | 2.0 (April 2023) | profile | open | verified |
| OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0 | IETF and OpenID Foundation | RFC 6749 (2012); OpenID Connect Core 1.0 | adopt | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Provenance and evidence
6 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| Sigstore (Cosign, Fulcio, Rekor) | OpenSSF (Linux Foundation); graduated project March 2024 | project; Rekor v2 general availability reported October 2025 | adopt | open | verified |
| in-toto Attestation Framework | in-toto project (CNCF) | 1.0 (stable per in-toto.io) | adopt | open | verified |
| W3C PROV-O: The PROV Ontology | W3C Provenance Working Group | W3C Recommendation 30 April 2013 | adopt | open | verified |
| W3C Verifiable Credentials Data Model v2.0 | W3C Verifiable Credentials Working Group | W3C Recommendation 15 May 2025 | crosswalk | open | verified |
| C2PA Content Credentials specification | Coalition for Content Provenance and Authenticity (Joint Development Foundation) | 2.1 | adopt | open | unverified |
| IETF SCITT architecture (Supply Chain Integrity, Transparency and Trust) | IETF SCITT working group | draft | profile | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
Questions and answers.
Does a crosswalk establish that a verification services artefact conforms to these standards?
Why are some relations shown as compatibility profile (restricted)?
Why are some entries marked unverified?
Around verification services.
Shape the standards for verification services.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.