Conformance programme: crosswalk to external standards
The external standards in the crosswalk domains of conformance programme, from the register, with the relation of each to the Nexus Standards. Each row links to the issuing body, and each relation is evidenced by attestations identified by UNIs (Unique Nexus Identifier).
- Nexus Standards: NS-11, NS-14.
- Open standards: Open Security Controls Assessment Language (OSCAL); in-toto attestation framework; Verifiable Credentials Data Model 2.0; Supply-chain Levels for Software Artifacts (SLSA) 1.1; OpenStand principles (RFC 6852).
- Data and feeds: GLEIF Golden Copy (LEI Level 1 and Level 2 data); ROR data dump.
- Couples with: Verification services; Conformance and crosswalk to external; the Global Centre for Risk and Innovation (GCRI Canada) evidence pathway; Institutional adoption pathway.
The process.
The crosswalk as a table: 13 external standards by domain
| Domain | External standard | Issuing body | Relation |
|---|---|---|---|
| Enterprise and organisational risk | COSO Enterprise Risk Management – Integrating with… | Committee of Sponsoring Organizations of the Treadway Commission (COSO) | crosswalk |
| Enterprise and organisational risk | IEC 31010:2019 Risk management – Risk assessment techniques | IEC TC 56 with ISO/TC 262 (double logo) | cite |
| Enterprise and organisational risk | ISO 31000:2018 Risk management – Guidelines | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 31022:2020 Risk management – Guidelines for the… | ISO/TC 262 | cite |
| Enterprise and organisational risk | ISO 31050:2023 Risk management – Guidelines for managing… | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 31073:2022 Risk management – Vocabulary | ISO/TC 262 | crosswalk |
| Enterprise and organisational risk | ISO 37000:2021 Governance of organisations – Guidance | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 37001:2025 Anti-bribery management systems… | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 37301:2021 Compliance management systems… | ISO/TC 309 | cite |
| Enterprise and organisational risk | ISO 45001:2018 Occupational health and safety management… | ISO/PC 283 | crosswalk |
| Zero trust and identity | CISA Zero Trust Maturity Model Version 2.0 | CISA (US Cybersecurity and Infrastructure Security Agency) | profile |
| Zero trust and identity | NIST SP 800-207 Zero Trust Architecture | NIST | adopt |
| Zero trust and identity | OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0 | IETF and OpenID Foundation | adopt |
Nexus Standards in the graph: NS-11, NS-14. A relation is a register entry, never a compliance claim.
2 Nexus Standards · 2 domains · 13 external standards · 8 issuing bodies · 0 implementing repositories. Relations (adopt, profile, crosswalk, cite) are as recorded in the register; names and standards remain with their stewards.
Crosswalk graph25 nodes and 30 links from the registry of external standards, programme areas and implementations (the external standards register, the consumers register. Relations (adopt, profile, crosswalk, cite) are shown as recorded in the register.
- Nexus Standards
- 2
- NS-11, NS-14
- Open standards
- 5
- named, never copied
- Data and feeds
- 2
- listed for reference
- Couplings
- 4
- with other areas
Enterprise and organisational risk
10 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| ISO 31000:2018 Risk management – Guidelines | ISO/TC 262 | 2018 (second edition; revision at working-draft stage) | compatibility profile (restricted) | paywalled | verified |
| IEC 31010:2019 Risk management – Risk assessment techniques | IEC TC 56 with ISO/TC 262 (double logo) | 2019 (edition 2.0) | cite | paywalled | verified |
| ISO 31022:2020 Risk management – Guidelines for the management of legal risk | ISO/TC 262 | 2020 (first edition) | cite | paywalled | verified |
| COSO Enterprise Risk Management – Integrating with Strategy and Performance | Committee of Sponsoring Organizations of the Treadway Commission (COSO) | 2017 (released 6 September 2017) | compatibility profile (restricted) | paywalled | unverified |
| ISO 37301:2021 Compliance management systems – Requirements with guidance for use | ISO/TC 309 | 2021 | cite | paywalled | unverified |
| ISO 37000:2021 Governance of organisations – Guidance | ISO/TC 309 | 2021 | cite | paywalled | verified |
| ISO 37001:2025 Anti-bribery management systems – Requirements with guidance for use | ISO/TC 309 | 2025 (published 28 February 2025; replaces 2016 edition with 2024 amendment) | cite | paywalled | verified |
| ISO 31073:2022 Risk management – Vocabulary | ISO/TC 262 | 2022 | compatibility profile (restricted) | paywalled | unverified |
| ISO 31050:2023 Risk management – Guidelines for managing an emerging risk to enhance resilience | ISO/TC 262 | 2023 | compatibility profile (restricted) | paywalled | unverified |
| ISO 45001:2018 Occupational health and safety management systems | ISO/PC 283 | 2018 | compatibility profile (restricted) | paywalled | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Zero trust and identity
3 register entries.
| Standard | Body | Version | Relation | Access | Verified |
|---|---|---|---|---|---|
| NIST SP 800-207 Zero Trust Architecture | NIST | Final (11 August 2020) | adopt | open | verified |
| CISA Zero Trust Maturity Model Version 2.0 | CISA (US Cybersecurity and Infrastructure Security Agency) | 2.0 (April 2023) | profile | open | verified |
| OAuth 2.0 (RFC 6749) and OpenID Connect Core 1.0 | IETF and OpenID Foundation | RFC 6749 (2012); OpenID Connect Core 1.0 | adopt | open | unverified |
Unverified entries rest on a secondary source for at least one field, as indicated in the register.
Relation types and their evidence
| Relation | Meaning | Evidence |
|---|---|---|
cite | The Nexus Standard refers to the external standard as context. | Identifier, version and URL in the register. |
profile | The Nexus Standard constrains or specialises an open external standard (for example STAC, DCAT, PROV-O, DataCite, CAP). | Conformance tests against the external standard’s own validator where one exists. |
crosswalk | Elements of the external standard map to Nexus elements (clauses, record fields). | A crosswalk table in the register entry; each row cites the external clause by number, never by text. |
adopt | The Nexus Standards use the external standard as it is for a function (for example ISO 3166-1, SPDX, ORCID, ROR). | Validation of values against the external scheme. |
extend | A Nexus Standard adds machine-readable, real-time or provenance elements that the external standard lacks. | The extension is a Nexus clause or field; the external standard is cited as the baseline. |
gap | No external standard covers the concern; a Nexus Standard specifies it. | The gap statement in the landscape study. |
Questions and answers.
Does a crosswalk establish that a conformance programme artefact conforms to these standards?
Why are some relations shown as compatibility profile (restricted)?
Why are some entries marked unverified?
Around conformance programme.
Shape the standards for conformance programme.
Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.
Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artefact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.
Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.