What is External Framework Mapping?
Framework Mapping helps you review suppliers against external security frameworks using information they’ve already provided in their Risk Ledger assessment.
With Framework Mapping, you can add a pre-made policy and apply it to suppliers. Risk Ledger then uses the controls in that policy to show how each supplier’s existing assessment aligns with the selected framework.
How it helps you
See where your suppliers stand against the frameworks you work to. Apply a framework policy and see how each supplier's existing assessment aligns with ISO 27001, CAF, Cyber Essentials, Cloud Security Principles or NIST CSF.
Find the gaps fast. See which mapped controls a supplier has in place and which they do not, so you know where to follow up.
Skip the manual mapping. You no longer cross-reference supplier answers against each framework, control by control.
Stop sending extra questionnaires. Use the answers your suppliers already gave you, instead of a separate framework questionnaire.
Talk in your stakeholders' terms. Show your auditors, regulators or board how your supplier assurance compares to the frameworks they ask about.
How to use it
To add a pre-built policy, navigate to Policies > Add a pre-made policy:
Then choose an Industry Framework:
Important: The controls included in a pre-made framework policy are locked by default. This preserves Risk Ledger’s standard mapping. If you choose to unlock and edit the requirements, your organisation becomes responsible for maintaining those changes.
Full article: How to setup a policy
Apply the policy to suppliers
When setting up the policy, use the policy’s application criteria to define which suppliers it should apply to. Once applied, you can review those suppliers against the mapped Risk Ledger controls using their existing assessment responses.
Coverage
For each standard, the share of its requirements the Standardised Assessment Framework covers Fully, Partially or Not. Rows marked N/A in the mapping are not counted.
Standard | Requirements mapped | Fully | Partially | Not covered |
ISO/IEC 27001 (Annex A) | 93 | 85% | 10% | 5% |
NCSC Cyber Assessment Framework (CAF) | 41 | 83% | 17% | 0% |
NCSC Cloud Security Principles | 77 | 75% | 17% | 8% |
NCSC Cyber Essentials | 55 | 65% | 35% | 0% |
NIST Cybersecurity Framework | 106 | 58% | 41% | 1% |
📄 To request the latest mapping spreadsheet, contact support@riskledger.com or speak to your Customer Success Manager. We’ll provide the current version and help you interpret the mapping if needed.
How to read the coverage
We rated strictly. Where there was any doubt about full coverage, we rated the requirement Partially rather than Fully.
Fully Risk Ledger's controls cover the requirement.
Partially This does not mean the controls barely cover it. In most cases, you can still get the information - check the supplier's notes and evidence on the listed controls.
Not covered Often, the requirement is not something a supplier security assessment can establish. It may be a commercial commitment or a capability of the supplier's product, and better addressed in your contract. Where that is the case, the comments say so.
In addition, some rows in the 'Reason for remaining gap' column mention 'diminishing value'. Suppliers keep one Risk Ledger profile that all their customers can see, so every supplier must answer any question we add. Very detailed questions rarely change your decision about a supplier, but they still add to what every supplier has to evidence. This slows completion and can reduce the quality of answers. It is a common reason we do not add more questions.
Important information
Framework Mapping shows how Risk Ledger controls map to or align with external frameworks. A supplier's answers show how they align with a standard. That does not necessarily mean they hold its certification or have passed a compliance assessment.
Framework Mapping doesn’t change how supplier compliance scores are calculated.
💡 If there’s anything we haven’t covered, please feel free to contact us at support@riskledger.com or select the Chat icon in the bottom right corner.