Frameworks & crosswalks
Keel is built around one principle: collect once, comply everywhere. Instead of running a separate project for every standard, you maintain a single control library, and Keel maps each control to every framework requirement it satisfies. Do the work once and it counts everywhere it applies.
How the crosswalk works
Section titled “How the crosswalk works”A requirement is what a framework asks for. A control is what you do to satisfy it. Because security fundamentals overlap heavily across standards, one control (say, enforcing multi-factor authentication) maps to requirements in many frameworks at once. Keel maintains those mappings for you, so when you implement a control and attach evidence, your coverage improves across every applied framework simultaneously.
This is why adding a second or third framework is far less work than the first: much of what you’ve already implemented and evidenced carries straight over through the crosswalk. How much carries over depends on the pair: security standards share a lot, while a narrow framework such as the EU AI Act shares controls only with the other AI governance frameworks.
Compare two frameworks
Section titled “Compare two frameworks”The Bridge tab under Frameworks answers “how ready am I for the next one?” Pick the framework you run and the one you are heading for. Keel shows how many of the target’s controls you already run, how many of those are implemented, which target clauses they address, and the net-new controls the target adds. Both lists export as CSV or print.
Reuse is measured against Keel’s canonical controls mapped to each framework. It shows the work that carries over, not a claim that the target framework is covered. The bridge is included on every paid plan.
Applying a framework
Section titled “Applying a framework”From the Get started hub or the Frameworks area, apply a framework and Keel seeds a curated, pre-mapped starter control set for it in one click. You get a structured library aligned to that standard’s requirements, not a blank slate. Your readiness score then reflects the share of that framework’s in-scope requirements covered by an implemented control with current evidence or an approved policy linked to it.
Starter controls
Section titled “Starter controls”Owners and admins can also add a framework’s starter set from Controls, under Add recommended controls. Pick one of the frameworks you have applied and press the button. Every control in the set arrives mapped to that framework’s clauses, and you can edit, reassign or delete any of them afterward.
Running a set again only fills gaps. A control you already have keeps its name, description and status, and gains the clause mappings for the framework you picked.
Import controls from a spreadsheet
Section titled “Import controls from a spreadsheet”If your controls already live in a spreadsheet, owners and admins can bring them in from Controls
with Import CSV. Download the template from the same drawer. Only name is required. Give each
control a key or leave it blank and Keel makes one from the name. List the clauses a control covers
in mappings as framework:ref, separated by semicolons, for example iso-27001:A.8.1; soc-2:CC6.1.
An owner_email must belong to someone on your team.
The import is all or nothing. A file with a bad row, a key you already use, or a clause Keel does not have imports nothing, and the notice names up to three rows to fix.
Framework breadth
Section titled “Framework breadth”Keel’s catalog spans the standards SMBs are most often asked for, including:
- SOC 2 (Trust Services Criteria)
- ISO/IEC 27001 (ISMS + Annex A)
- PCI DSS
- HIPAA
- NIST Cybersecurity Framework (CSF)
- CIS Critical Security Controls
- NIST SP 800-171
- GDPR
- AI governance: AI Governance Essentials (free), ISO/IEC 42001, the NIST AI RMF, and the EU AI Act
- ISO 9001 quality, ESG, and more
Some frameworks are available to apply today; others are on the way, and the in-app catalog shows each one’s status, version, and availability. Availability also depends on your plan. NIST CSF is included on every plan, and other frameworks are included depending on your plan.
Standard text and public-domain sources
Section titled “Standard text and public-domain sources”Framework names and clause references are used factually. Keel writes its own control mappings and does not reproduce copyrighted standard text. Frameworks drawn from public-domain sources are labeled public domain in the catalog.
Managing scope
Section titled “Managing scope”- Set each control’s status in Controls; mark a control N/A to remove its requirements from scope for a framework.
- Add frameworks as your needs grow. The crosswalk means shared controls only have to be implemented and evidenced once.
- Use AI implementation guidance on any control to get plain-English steps and the exact evidence to collect.
Excluding a clause
Section titled “Excluding a clause”Scope lists the clauses of one applied framework at a time. Owners and admins can mark a clause out of scope when it does not apply to your environment, for example a physical security clause when you have no office and all hosting is with a cloud provider. An exclusion is saved only with a written reason, and that reason is shown to your auditor next to the clause.
An excluded clause drops out of that framework’s readiness. For ISO 27001, an excluded Annex A control also shows as excluded on the Statement of Applicability. Include brings it back at any time. Scope warns you about any excluded clause that has no reason recorded, because an auditor will ask about each one.