Set Theory Relationship Mapping (STRM)

Starting with release 2024.1, the SCF leverages NIST IR 8477 Set Theory Relationship Mapping for crosswalk mapping. This is the US Government's gold standard for evaluating cybersecurity and data privacy laws, regulations and frameworks.

Relationship Types

200+

LRF Mapped

NIST IR 8477

Gold Standard

EDC

Expert-Derived Content

Download the SCF Learn More About the SCF STRM Overview

NIST IR 8477

The Gold Standard for Crosswalk Mapping

NIST IR 8477 provides the definitive practice for crosswalk mapping with no technology needed. It can be performed with a pencil and piece of paper.

Children learn the process of diagramming sentences in grade school (e.g., the Reed–Kellogg model) with pencil and paper. This same process of graphically identifying the relationships between elements forms the basis of STRM. What NIST IR 8477 does is formalize this with Set Theory mathematics to produce rigorous, defensible, and IP-protected crosswalk mappings.

STRM is part of NIST’s broader NIST OLIR Program, an effort to facilitate Subject Matter Experts in defining standardized Online Informative References between elements of their creation and NIST publications.

You can click on the image to the side to see a PDF version of how the SCF is utilizing STRM, as well as an example for what that looks like with a few NIST CSF 2.0 controls:

Purchase STRM Excel Bundles

The SCF offers editable Excel versions of all STRM mappings. The bundle of Excel versions is $25 (access to redownload is availabe for 30 days from date of purchase).

BUY STRM BUNDLE

STRM Methodology

The 5 STRM Relationship Types

Every crosswalk mapping in the SCF uses exactly one of these five mathematically-defined relationship types, ensuring precision and consistency across all 200+ mapped LRF.

⊂

Subset Of

The LRF requirement is fully contained within the SCF control. The SCF control is broader in scope and coverage.

∩

Intersects With

The LRF requirement and SCF control share partial overlap. Neither is fully contained within the other.

Equal To

The LRF requirement and SCF control are semantically equivalent. They address the same concept at the same scope.

⊃

Superset Of

The SCF control is contained within the LRF requirement. The LRF requirement is broader in scope and coverage.

No Relationship

The LRF requirement and SCF control have no meaningful semantic overlap. No mapping is established.

Relationship Strength (1–10)

Relationship Strength (1–10): Each mapping also receives a numeric strength rating. A rating of 1 indicates a nominal relationship, 5 indicates moderately strong, and 10 indicates the strongest relationship, typically reserved for "Equal To" or where the LRF requirement is a "Subset Of" the SCF control.

Methodology Advantage

Expert-Derived Content (EDC) vs. Natural Language Processing (NLP)

The SCF exclusively uses human subject-matter experts to perform STRM crosswalk mapping. This is a deliberate choice with significant IP, legal and quality implications.

SCF: Expert-Derived Content (EDC)

The SCF leverages human SMEs to perform STRM mapping. This produces content that is:

Copyright-protected as original work by human creators
Patent-eligible under the “mental steps” doctrine
Defensible through documented expert judgment
Consistent with NIST IR 8477 gold standard practices

Other Vendors: Natural Language Processing (NLP)

AI/NLP-based crosswalk solutions face significant IP limitations:

AI-generated content is not copyright-protectable (no human creator)
Potentially free to copy under current US copyright rulings
Patent claims may be invalid under the 2014 Supreme Court “mental steps” doctrine
Quality depends on training data rather than professional expertise

Why it matters

The SCF's EDC approach means its crosswalk mappings are both higher-quality and legally protected intellectual property, which is exactly how NIST IR 8477 itself was designed to work.

SCF Implementation

How the SCF Utilizes STRM

The SCF applies STRM to every one of its 200+ mapped laws, regulations and frameworks. Each mapping documents the precise set-theoretic relationship between every LRF requirement and the corresponding SCF control.

Focal Document Element (FDE)

Each LRF requirement is defined as a Focal Document Element with a unique identifier. Without a unique FDE value, no granular mapping is possible because there is nothing to map to.

SCF Control Mapping

Each FDE is mapped to the most appropriate SCF control with a documented relationship type (Subset Of, Intersects With, Equal To, Superset Of, or No Relationship) and a strength score of 1–10.

Multi-Framework Compliance

Because all LRF are mapped to common SCF controls using STRM, a single SCF control can simultaneously satisfy requirements across dozens of laws, regulations and frameworks. This enables true multi-framework compliance efficiency.

Available STRMs

Published STRM Mappings

Excel versions of the STRM mappings are available for purchase at the SCF Store. The following STRM mappings are currently published:

ALL GENERAL USA EMEA APAC AMERICAS

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Americas

✓ STRM

Canada

Canada - Protecting controlled information in non-Government of Canada systems and organizations (ITSP.10.171)

Set Theory Relationship Mapping (STRM)

The Gold Standard for Crosswalk Mapping

Purchase STRM Excel Bundles

The 5 STRM Relationship Types

Subset Of

Intersects With

Equal To

Superset Of

No Relationship

Expert-Derived Content (EDC) vs. Natural Language Processing (NLP)

SCF: Expert-Derived Content (EDC)

Other Vendors: Natural Language Processing (NLP)

How the SCF Utilizes STRM

Focal Document Element (FDE)

SCF Control Mapping

Multi-Framework Compliance

Published STRM Mappings

How To Submit a Community STRM Mapping

Define the Focal Document

Perform the STRM Mapping

Submit to the SCF Council

Explore Further

Included LRF

NIST OLIR Participation

SCF Domains

Download the SCF

Join 25,000+ GRC Professionals