Framework Coverage
The CCM is cross-mapped to 85+ internationally recognised frameworks — each mapping qualified at the individual control level with full traceability.
Mapping Methodology
C-PAP's framework mappings are not high-level thematic alignments. Each mapping is a qualified, control-to-requirement relationship established at the individual control level. When the CCM states that a control maps to a specific framework requirement, the relationship has been reviewed, verified, and documented.
Mapping depth is described using qualitative descriptors rather than percentages, reflecting the reality that different frameworks have different scopes, structures, and levels of prescriptiveness:
Comprehensive
Full or near-full coverage of the framework's control requirements.
Extensive
Broad coverage across the framework's major domains and objectives.
Strong
Significant coverage of core framework requirements with targeted alignment.
Mapped
Specific, targeted mapping to relevant framework requirements.
Primary Baseline & Governance Standards
Core information security, cybersecurity, and governance standards that anchor the CCM's control structure. These form the backbone of most compliance programmes and provide the primary mapping foundations.
OT/ICS Security Frameworks
Standards and guidance specific to operational technology, industrial control systems, and cyber-physical environments. These underpin the D14 OT/ICS Security overlay domain.
UK Regulatory & NIS Frameworks
UK legislation, regulatory instruments, and sector supervisory frameworks applicable to operators of essential services and regulated entities.
EU Regulatory Frameworks
EU directives and regulations imposing cybersecurity, resilience, and digital governance obligations across member states and affected entities.
Financial Services
Regulatory and supervisory instruments for banking, financial services, and insurance organisations.
Cloud Security & Privacy
Standards and frameworks addressing cloud computing security, privacy management, and third-party assurance.
IoT & Telecommunications
Standards and legislation addressing connected devices, consumer IoT security, and telecommunications infrastructure.
AI Governance Frameworks
Standards and regulatory instruments governing the responsible development and deployment of artificial intelligence systems.
Energy & Utilities
Sector-specific regulatory and operational frameworks for energy generation, distribution, and water utilities.
Aviation
Airworthiness, aviation security, and air traffic management cybersecurity standards and regulations.
Maritime
International maritime cyber risk management regulations and classification society requirements.
Defence
Defence and national security cybersecurity standards for controlled information and defence supply chain assurance.
Nuclear
Nuclear sector security assessment and guidance frameworks for civil nuclear facilities and operations.
Transport & Automotive
Cybersecurity standards for railway, automotive, and road vehicle systems.
Space
Space sector cybersecurity standards and regulatory frameworks for satellite systems and space operations.
Threat Knowledge Frameworks
Threat intelligence and defensive knowledge bases integrated for threat-informed prioritisation and control validation.
Ongoing Framework Expansion
The CCM framework mapping programme is continuously expanding. Additional frameworks are in active development, with particular focus on sector-specific regulatory instruments and emerging international standards.
All new framework mappings follow the same rigorous control-to-requirement methodology, ensuring consistent quality and traceability across the entire mapping library.
See Your Framework Coverage
Request a demonstration to see how C-PAP maps to your specific framework obligations.