Crosswalk pair
NIST Cybersecurity Framework and US Employment Law - Federal Baseline, control by control
1 canonical control in Keel’s library satisfies clauses of both NIST Cybersecurity Framework and US Employment Law - Federal Baseline. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don’t repeat.
NIST Cybersecurity Framework is free on every plan. US Employment Law - Federal Baseline counts as one of your plan’s paid frameworks, or from $19/mo as an add-on. See plans and pricing.
The overlap
What the two libraries have in common
Every figure here counts canonical controls in Keel’s library, not clauses of either standard. Each standard’s own authored count is on its framework page.
1
Controls that satisfy both
Canonical controls that crosswalk to at least one clause of each.
50
In Keel’s library for NIST Cybersecurity Framework
2% of them also map to US Employment Law - Federal Baseline.
16
In Keel’s library for US Employment Law - Federal Baseline
6% of them also map to NIST Cybersecurity Framework.
3
Evidence artifacts expected
Across the shared controls, from Keel’s evidence guidance. Gathered once.
-
NIST Cybersecurity Framework 2%
1 control of 50 in Keel’s library for NIST Cybersecurity Framework also maps to US Employment Law - Federal Baseline.
-
US Employment Law - Federal Baseline 6%
1 control of 16 in Keel’s library for US Employment Law - Federal Baseline also maps to NIST Cybersecurity Framework.
The mapping
Controls that satisfy both
Each row is one control in Keel’s library and the clauses it answers on each side. Do the work once; both columns are then evidenced by the same artifacts.
| Canonical control | NIST Cybersecurity Framework clauses | US Employment Law - Federal Baseline clauses |
|---|---|---|
| Personnel security (HR) Background screening, confidentiality agreements, and onboarding/offboarding security steps. Before a person is given access to sensitive data, and again whenever their role changes, a documented determination is made that the access their work calls for is appropriate to it - the screening informs that decision but is not the decision. What screening may ask is itself bounded: inquiries about a candidate’s health, disability or medical history are not made, and medical examinations are not required, before a conditional offer of the role has been made, and where such inquiries or examinations are made after an offer they are applied to everyone entering that role rather than to the individuals somebody chose to ask. Access is ended when their employment, or any other arrangement under which they worked for the organization, comes to an end, and whenever that determination says they should no longer hold it. The security responsibilities a person carries are stated in the terms under which they are engaged - in the employment contract or the equivalent agreement for a contractor or temporary worker - together with the organization’s own obligations to them, the duties that continue after the engagement ends and for how long, and what happens if the terms are broken; the terms are accepted before access is given. At the end of an engagement, and on a change of role that removes the need, every asset the person holds is returned and the return is recorded against the inventory rather than assumed - devices, media, tokens and keys, documents and any organization information held on equipment they own - and where information exists only on equipment the organization is not taking back, its transfer and deletion are performed and confirmed before the person leaves. The practice is governed by a documented personnel security policy with supporting procedures, issued to the roles it binds, owned by a named role and reviewed on a defined cadence. Security and privacy responsibilities are written into the POSITION DESCRIPTION for each role rather than only into the contract everybody signs, so what a particular job is accountable for is visible when it is advertised, filled, evaluated and re-scoped - and the descriptions are revised when the responsibilities change. Where a regime requires any NATIONALITY condition attaching to a role or to an account type to be written down, the organization documents the condition, and documents explicitly that there is none where none applies. Silence and a recorded absence are not the same record, and only the second can be verified. | GV.RR-04 | us.hiring-onboarding.ada-preoffer, us.hiring-onboarding.fcra-background |
Beyond the pair
Where else this work counts
A framework is lit when a shared control above also maps to it. Unlit means none of them do, which is an absence rather than a judgment about that standard.
Also reached by this control
- AI Governance Essentials not reached
- Amazon Appstore Child-Directed Apps not reached
- Apple App Store Kids Category not reached
- CIS Critical Security Controls not reached
- COPPA not reached
- ESG Essentials not reached
- EU AI Act not reached
- FedRAMP 20x not reached
- FedRAMP Consolidated Rules not reached
- FedRAMP Rev5 Class B also reached
- FedRAMP Rev5 Class C also reached
- FedRAMP Rev5 Class D also reached
- GDPR also reached
- Google Play Families not reached
- HIPAA also reached
- ISO 9001 not reached
- ISO/IEC 27001 also reached
- ISO/IEC 42001 not reached
- NIST AI Risk Management Framework not reached
- NIST SP 800-171 also reached
- NIST SP 800-53 also reached
- PCI DSS also reached
- PIPEDA not reached
- SOC 2 also reached
- SOX (Sarbanes-Oxley) Section 404 also reached
Nearby pairs
- NIST Cybersecurity Framework and ISO/IEC 27001 45 shared controls
- NIST Cybersecurity Framework and FedRAMP Rev5 Class D 35 shared controls
- NIST Cybersecurity Framework and FedRAMP Rev5 Class C 34 shared controls
- NIST Cybersecurity Framework and NIST SP 800-53 33 shared controls
- NIST Cybersecurity Framework and FedRAMP Rev5 Class B 32 shared controls
- NIST Cybersecurity Framework and SOC 2 26 shared controls
The thesis
Why this is one project, not two
On a crosswalk-native model, US Employment Law - Federal Baseline mostly lights up controls you already built for NIST Cybersecurity Framework. You’re not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That’s the whole idea behind collect once, comply everywhere.
Next step
Add US Employment Law - Federal Baseline to the work you already did
Apply both frameworks in one workspace and see the overlap measured against the controls you already hold.