The external standards in the crosswalk domains of cyber and digital risk, from the register, with the relation each has to the Nexus Standards; every row links the source body, and relations are evidenced by attestations with their own UNIs (Unique Nexus Identifier). Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
5 Nexus Standards · 5 domains · 50 external standards · 25 issuing bodies · 1 consumers. Relations are register entries (adopt, profile, crosswalk, cite), never compliance claims; names belong to their stewards.
Crosswalk graph86 nodes and 128 links from registry/external-standards.yaml, registry/subsites.yaml and registry/consumers.yaml. Relations (adopt, profile, crosswalk, cite) are register entries, never compliance claims.
Unverified entries rest on a secondary source for at least one field; the register says which.
Fig.Register relations for the area and the evidence NS-14 requires before a claim is displayed. Design, not a record.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| NIST SP 800-207 Zero Trust Architecture | NIST | Final (11 August 2020) | adopt | open | verified |
| CISA Zero Trust Maturity Model Version 2.0 | CISA (US Cybersecurity and Infrastructure Security Agency) | 2.0 (April 2023) | profile | open | verified |
| OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0 | IETF and OpenID Foundation | RFC 6749 (2012); OpenID Connect Core 1.0 | adopt | open | unverified |
Unverified entries rest on a secondary source for at least one field; the register says which.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO/IEC 27036-2:2022 Cybersecurity - Supplier relationships - Part 2: Requirements | ISO/IEC JTC 1/SC 27 | 2022 (Part 1 2021, Part 3 2023, Part 4 cloud) | cite | paywalled | verified |
| NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations | NIST | Rev. 1 (May 2022), Update 1 (1 November 2024) | cite | open | verified |
| OASIS Common Security Advisory Framework (CSAF) Version 2.0 | OASIS CSAF TC | 2.0 (OASIS Standard, November 2022) | cite | open | verified |
| OpenVEX specification | OpenVEX community (OpenSSF project) | draft | cite | open | unverified |
| Supply-chain Levels for Software Artifacts (SLSA) | OpenSSF (Linux Foundation) | 1.1 (April 2025, Approved Specification); site states 1.2 is current | adopt | open | verified |
| ISO 28000:2022 Security and resilience - Security management systems | ISO/TC 292 | 2022 | compatibility profile (restricted) | paywalled | unverified |
| WCO SAFE Framework of Standards to Secure and Facilitate Global Trade | World Customs Organization | 2021 | cite | open | unverified |
Unverified entries rest on a secondary source for at least one field; the register says which.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| Regulation (EU) 2024/1689 (Artificial Intelligence Act) | European Parliament and Council | in force 1 August 2024; staged application | crosswalk | open | verified |
| CEN-CENELEC JTC 21 harmonised standards in support of the EU AI Act (incl. prCEN/CLC/TR 18347) | CEN-CENELEC JTC 21 | in development; EN 18286 reported at public enquiry (30 October 2025) and later approval by differing sources | cite | paywalled | unverified |
| Regulation (EU) 2024/2847 (Cyber Resilience Act) | European Parliament and Council | in force 10 December 2024; reporting obligations from 11 September 2026; main requirements 11 December 2027 | cite | open | unverified |
| Directive (EU) 2022/2555 (NIS2) | European Parliament and Council | transposition deadline 17 October 2024 | cite | open | unverified |
| Regulation (EU) 2016/679 (General Data Protection Regulation) | European Parliament and Council | 2016 | cite | open | unverified |
| OECD Recommendation of the Council on Regulatory Policy and Governance | OECD | 2012 | cite | open | unverified |
| Universal Digital Public Infrastructure Safeguards Framework | UN Office of the Secretary-General's Envoy on Technology and UNDP | 2024 | crosswalk | open | unverified |
| United Nations Global Principles for Information Integrity | United Nations | 2024 | crosswalk | open | unverified |
Unverified entries rest on a secondary source for at least one field; the register says which.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO/IEC 23894:2023 Information technology - Artificial intelligence - Guidance on risk management | ISO/IEC JTC 1/SC 42 | 2023 (edition 1, February 2023) | compatibility profile (restricted) | paywalled | verified |
| ISO/IEC 42001:2023 Artificial intelligence - Management system | ISO/IEC JTC 1/SC 42 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 42005:2025 AI system impact assessment | ISO/IEC JTC 1/SC 42 | 2025 (28 May 2025 per secondary sources) | cite | paywalled | unverified |
| NIST AI Risk Management Framework (AI RMF 1.0, NIST AI 100-1) | NIST | 1.0 (26 January 2023) | crosswalk | open | verified |
| NIST AI 600-1 Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile | NIST | Final (July 2024) | cite | open | verified |
| IEEE 7000-2021 Standard Model Process for Addressing Ethical Concerns during System Design | IEEE Standards Association | 2021 | cite | paywalled | unverified |
| IEEE 7001-2021 Standard for Transparency of Autonomous Systems | IEEE Standards Association | 2021 | cite | paywalled | verified |
| IEEE 7010-2020 Recommended Practice for Assessing the Impact of Autonomous and Intelligent Systems on Human Well-Being | IEEE Standards Association | 2020 | cite | paywalled | unverified |
| Model Cards for Model Reporting | Mitchell et al. (FAT* 2019) | 2019 paper (arXiv 1810.03993) | profile | open | unverified |
| OECD AI Principles | OECD | 2024 update | crosswalk | open | unverified |
| UNESCO Recommendation on the Ethics of Artificial Intelligence | UNESCO | 2021 | crosswalk | open | unverified |
| ISO/IEC 5338:2023 AI system life cycle processes | ISO/IEC JTC 1/SC 42 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 5259 Data quality for analytics and machine learning | ISO/IEC JTC 1/SC 42 | 2024 | compatibility profile (restricted) | paywalled | unverified |
| ISO/IEC 24029 Assessment of the robustness of neural networks | ISO/IEC JTC 1/SC 42 | 2023 | cite | paywalled | unverified |
| ISO/IEC 25059:2023 Quality model for AI systems | ISO/IEC JTC 1/SC 7 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| Model Context Protocol specification | Agentic AI Foundation (Linux Foundation) | 2025-06-18 | profile | open | unverified |
Unverified entries rest on a secondary source for at least one field; the register says which.
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | URL and identifier in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard's own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The ecosystem uses the external standard as-is for a function (ISO 3166, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | Nexus adds machine-readable, real-time or provenance elements the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; Nexus specifies it. | The gap statement in the landscape study. |
Risk Academy disciplines that teach Cyber and digital risk, with their courses; the GCRI Canada, The Global Risks Forum (GRF) and The Global Risks Alliance (GRA) subsites that carry those disciplines; and the Nexus Foundry systems the standards name. Mappings are proposed for review (Risk Academy standards map, 2026-10-17); a link says a page on the same subject exists, never an endorsement or a conformance statement; framework names in course titles are named and linked, never reproduced.
Every standard here is proposed. Changes enter as proposals under NS-13; conformance is shown by attestations under NS-11; nothing on this site is a certification, an approval or a readiness statement.
Nexus Standards documents CC BY 4.0 · tooling Apache-2.0 · counsel review pending (DEC-2026-10-16-NEXUS-STANDARDS-OPEN-LICENCE). External standards are named and linked under their own licences; a UNI (Unique Nexus Identifier) identifies, it never certifies. · Generated from the Nexus Standards corpus at commit 437ae044c5cb (2026-10-17); proposed and open.