# Crosswalk method and initial topic map

Crosswalks are navigation aids, **not equivalence or automatic compliance claims**. A mapped topic means the referenced framework and AATS address a related risk; the precise external clause, version, jurisdiction, and evidence reuse must be verified against an authorized copy before a formal mapping is published. This draft intentionally does not invent clause-level citations.

| External framework or law | AATS topics to examine | Mapping caveat |
|---|---|---|
| ISO/IEC 27001 | AATS-01–04, 17–18, 21–24 | Information security management system scope differs from deployment control tests |
| ISO/IEC 27701 | AATS-05–07, 09, 17 | Privacy management roles and legal basis need separate analysis |
| ISO/IEC 42001 | AATS-08, 18–20, 25 | AI management system does not imply per-agent runtime certification |
| SOC 2 Trust Services Criteria | AATS-03–06, 17–18, 21–24 | Report criteria, period, and service boundary remain distinct |
| NIST AI RMF | AATS-08, 15–20, 25 | Risk management guidance has different conformance semantics |
| NIST cybersecurity guidance | AATS-01–04, 11–13, 17, 21–24 | Select publication/version before clause mapping |
| OWASP agent guidance | AATS-03–04, 11–16, 19–20 | Threat guidance is not an assessor credential |
| MITRE ATLAS | AATS-14, 19–23 | Threat technique coverage does not establish full control pass |
| GDPR | AATS-05–07, 09, 17 | Legal obligations depend on role, jurisdiction, and processing facts |
| EU AI Act | AATS-02, 08, 15–20, 24–25 | Applicability and obligations require legal classification |
| HIPAA | AATS-05–06, 09, 17, 21–22 | Applies only to covered facts and entities |
| PCI DSS | AATS-03–06, 09, 17, 21–24 | Cardholder-data environment scope is separate |

A formal mapping file should record: external standard/version/clause, AATS control ID, relation (`related`, `partial`, `supports`), rationale, evidence overlap, reviewer, review date, and limitations. Use **mapped to**, never **automatically compliant with**.