Assessment to Assessment Mapping

There are similarities in different security models that lend themselves to assessment mapping options. For example, a completed NIST assessment, which requires input from all organizational controls, can be applied where applicable to the CFS assessment template. Providing mapping options between matching data collected for different security models saves organizations from redundant work and improves the consistency of control entries across various assessments.

In addition, after completing at least one assessment, the list of common controls creates a template for the assessment to assessment mapping. Customers can either select from mapping templates created by Axio, create their own mapping template (in progress, currently requires administrative steps by Axio), or select from mapping templates created by industry peers (development in progress).

Editing a mapping template from any source provides granular control over the assessment mapping, whether updating a common control and having it applied to multiple assessments or how a specific control maps.

If N/A exists on the answer scale, these responses will not be mapped. 

Available Maps

With the current deployment, Axio360 provides a list of preconfigured maps that users can select:

Only CRI v1.2 Tier 1 is currently available as a mapping option from CSF V1.1. The other Tiers are following shortly.

If a mapping references Axio map or Axio Expert map in the name, the map has been developed or modified for use in Axio360 by Axio Cybersecurity Engineering team members. All maps provided by other organizations reference the organization’s name in the map title.

More maps will be uploaded as they become available. Check back for updates. If you are looking for additional maps, please contact us through the Support Portal to request or inquire.

How to Use an Assessment Map

C2M2 Example

To use the Assessment Mapping feature, follow these steps:

1. In the left navigation menu select the Assessments icon.
2. From the list of new assessments, select the type of assessment you want to create. For example C2M2 v2.1 Full Assessment.
3. On the New Assessment modal
   1. provide an assessment name and meaningful description for easy identification.
   2. specify tags and a target score from the available drop-down menus.

   3. from the Select an assessment map (Optional) drop-down, select a completed assessment map. For this example, we selected a C2M2 v1.1 to v2.1 map, named C2M2 Take 2. This is just a test name and will be different for your environment.

      

   4. from the Source Assessment to use (Optional) drop-down, select a previously completed assessment based on the model that you wish to map into the new assessment.
4. Click Save.

Once the new assessment opens with the mapped data, you can start your assessment work based on the new model.

The assessment practices show a status message if the data has been mapped from a source assessment. Practices that are net new in the target assessment show up as not implemented and need to have a mapped from status message.

CRI Example - Preview

CRI Assessments need to be mapped by tier:

• CRI v1.2 Tier 1 to CRI v2.0 Tier 1
• CRI v1.2 Tier 2 to CRI v2.0 Tier 2
• CRI v1.2 Tier 3 to CRI v2.0 Tier 3
• CRI v1.2 Tier 4 to CRI v2.0 Tier 4

To view detailed differences between the versions, refer to Map - CRI v1.2.1 to v2.0.

To use the Assessment Mapping feature, follow these steps:

1. In the left navigation menu select the Assessments icon.
2. From the list of new assessments, select the type of assessment you want to create. For example CRI V2 Tier 1.
3. On the New Assessment modal

   1. provide an assessment name and meaningful description for easy identification.

      

   2. in the Prepared on Behalf of (Required) field, enter the company name for reference.
   3. specify tags and a target score from the available drop-down menus.
   4. from the Select an assessment map (Optional) drop-down, select a completed assessment map. For this example, we selected a CRI Profile 1.2 to CRI v2.0 Tier 1 map, named CRIProfilev1.2-to-v2 CRI T1 TEST. This is just a test name and will be different for your environment.

   5. from the Source Assessment to use (Optional) drop-down, select a previously completed assessment based on the model that you wish to map into the new assessment. In this example: CRI Profile v1.2.1 tier 1.

      

4. Click Save.

Once the new assessment opens with the mapped data, you can start your assessment work based on the new model.

The assessment practices show a status message if the data has been mapped from a source assessment, for example, “*Mapped from CRI Profile v1.2.1 tier 1”.