Why map one TLS-minimum check to clauses in three compliance frameworks instead of writing three checks?
answer
- one fact, three reports
- assertion versus compliance claim
- the mapping is data, not code
- duplicate rules drift apart
- one failure fans out to three findings
basics
~10 sThe check is the same engineering fact; only the reporting differs. One check with three mapping edges means one rule to maintain and three audit reports that can never disagree about the same listener.
solid answer
~50 sA crosswalk separates the technical assertion from the compliance claim. The assertion — every externally reachable listener negotiates TLS 1.2 or higher — is one rule producing one result set. The crosswalk is a mapping that says this result answers a NIST SP 800-53 transmission-protection control, a SOC 2 common criterion in the CC6 logical-access series, and PCI DSS Requirement 4 on protecting cardholder data in transit over open, public networks. Three separate copies of the rule drift: someone tightens the cipher list in the PCI copy and not the others, and two reports quietly disagree about the same host. The mapping also works in the failing direction — one failed listener fans out into three findings, in three reports, with three different remediation deadlines. And because the mapping is data rather than code, adding a fourth framework is a new edge, not a new scanner.
go deeper
Be ready to state the difference between the technical assertion a check evaluates and the framework clause it is claimed to answer, and to say that a crosswalk is the mapping between them.
Explain the mechanics of the duplication failure: how copied rules drift after the first fix, and how a single failed resource fans out into several findings with different remediation clocks.
Show you have operated this. Talk about edges carrying conditions — one framework's clause applying only to a subset of listeners — and about the crosswalk changing reporting rather than enforcement.
Own the argument that the mapping is data with an owner, so a new customer framework is a set of rows rather than a new scanning programme. Be able to say what that decision costs when a mapping is wrong.
## Two different objects A compliance framework clause and a policy check are not the same kind of thing, and a crosswalk exists because of that gap. - **The assertion** is engineering: *every externally reachable listener negotiates TLS 1.2 or higher*. It is evaluable. It runs on a schedule, it looks at a concrete set of resources, and it returns pass or fail per resource with a timestamp. - **The claim** is compliance: *we protect data in transit*. It is a sentence written by a standards body for thousands of organisations, and it deliberately does not name your load balancers. A crosswalk is the mapping between the two: a table of edges, each saying "this check's result is part of the answer to that clause of that framework at that revision". ## The worked case One TLS-minimum check plausibly touches three frameworks at once: | Framework | What the edge says | |---|---| | NIST SP 800-53 | Answers the transmission confidentiality and integrity control for the components in the mapping's scope | | SOC 2 | Supports a common criterion in the CC6 logical-access series, as tested against your own stated policy | | PCI DSS | Answers Requirement 4, protecting cardholder data with strong cryptography in transit over open, public networks | Note what is already visible here: the three edges are not identical. The PCI edge carries a condition — it only speaks to listeners inside the cardholder-data environment reachable from a public network. The SOC 2 edge is tested against what your own policy document says you do. So even the "one check answers three clauses" case is really "one result, three edges, each with its own qualifier". Recording those qualifiers is the whole craft. ## Why not three checks The obvious alternative is to let each compliance workstream own its own rule. It fails in four predictable ways. 1. **Drift.** The copies start identical and diverge on the first fix. A cipher suite gets banned in one copy after an incident; the others still pass. Now two reports about the same host disagree, and nobody can say which is right without reading three rule bodies. 2. **Cost of the estate.** Three rules is three sets of false positives, three exception lists, three sets of people to argue with, and three things to update when TLS 1.2 stops being an acceptable floor. 3. **Incoherent evidence.** An auditor who sees two results for one listener does not conclude that one report is stale; they conclude the control is not operating reliably. The point of a control is that it works the same way every time. 4. **Frameworks multiply.** A customer contract adds a fourth framework. With a crosswalk that is a handful of new rows written by the control owner. With copied rules it is another scanner configuration to build, run and keep green. ## What a crosswalk changes and what it does not It changes **reporting**, not enforcement. The mapping never blocks a deployment, never mutates a resource, never gates a pipeline. It decides which report a failure appears in and under which heading. If you removed the crosswalk entirely, exactly the same listeners would pass and fail; you would simply be unable to say which audit cares. It also does not, on its own, prove the control. A passing check proves the assertion held on the resources it looked at, at the times it ran. Most clauses want more than that: a documented standard saying TLS 1.2 is the floor, a record that the check ran continuously, and a story about what happened when it failed. The crosswalk edge is the pointer that connects those pieces to the clause; it is not the evidence. ## What good looks like in an interview Say the assertion out loud, separately from the clause. Then describe the mapping as data with an owner, kept next to the rule and reviewed when it changes. Then mention the failure direction — that one failed resource means three findings, and that the frameworks may impose different remediation clocks on the same fix, which is a real operational consequence of the mapping and the first thing a control owner notices in practice.
- What breaks first when each compliance workstream keeps its own copy of the same check?The copies diverge on the first fix. Someone tightens the cipher list in one copy after an incident and leaves the others alone, so two reports now disagree about the same listener. An auditor reading both does not assume one is stale — they conclude the control does not operate consistently, which is a worse finding than the original gap.
- Does a passing check ever fully satisfy a framework clause by itself?Rarely. The check proves the assertion held on the resources it examined, at the times it ran. Clauses usually also want a documented standard that fixes the threshold, and confidence the check ran continuously rather than once before the audit. The crosswalk edge points at those pieces; it does not replace them.
One thermometer, three forms. The temperature is measured once; the school, the airline and the clinic each have their own box to copy it into, with their own rules about what counts as too high.
saying these in an interview costs you the question
- Treats the three frameworks' clauses as identical requirements
- Copies the rule per framework and calls that coverage
- Says a passing check proves the control rather than the assertion
- Thinks the crosswalk enforces or blocks something
- Forgets that one failure now opens three findings