Reference Documentation

Topics

Compliance Map Protocol Tokens Shared Modules Universal Schema

Compliance Frameworks

Compliance framework mapping used across the toolkit for findings categorization.

Framework Reference

NIST SP 800-53

Field: nist_800_53

Security and Privacy Controls for Information Systems and Organizations. Rev 5.
AC (Access Control) AU (Audit) AT (Awareness) CM (Config Mgmt) CP (Contingency) IA (Identification/Auth) IR (Incident Response) MA (Maintenance) MP (Media Protection) PE (Physical) PL (Planning) PM (Program Mgmt) PS (Personnel) PT (PII Processing) RA (Risk Assessment) SA (System Acquisition) SC (System/Comms Protection) SI (System/Info Integrity) SR (Supply Chain)

NIST SP 800-171

Field: nist_800_171

Protecting Controlled Unclassified Information in Nonfederal Systems. Rev 3.
3.1 Access Control 3.2 Awareness/Training 3.3 Audit 3.4 Config Mgmt 3.5 Identification/Auth 3.6 Incident Response 3.7 Maintenance 3.8 Media Protection 3.9 Personnel Security 3.10 Physical Protection 3.11 Risk Assessment 3.12 Security Assessment 3.13 System/Comms Protection 3.14 System/Info Integrity

NIST CSF 2.0

Field: nist_csf2

Cybersecurity Framework 2.0. Six core functions.
GV (Govern) ID (Identify) PR (Protect) DE (Detect) RS (Respond) RC (Recover)

PCI DSS 4.0

Field: pci_dss_4

Payment Card Industry Data Security Standard v4.0.
Req 1 (Network Controls) Req 2 (Secure Configs) Req 3 (Account Data Protection) Req 4 (Cryptography in Transit) Req 5 (Malware) Req 6 (Secure Development) Req 7 (Access Restriction) Req 8 (User Identification) Req 9 (Physical Access) Req 10 (Logging/Monitoring) Req 11 (Security Testing) Req 12 (Information Security Policy)

ISO 27001

Field: iso_27001

Information Security Management System requirements. 2022 revision.
A.5 Organizational A.6 People A.7 Physical A.8 Technological

ISO 27002

Field: iso_27002

Code of practice for information security controls. 2022 revision.
5 Organizational Controls 6 People Controls 7 Physical Controls 8 Technological Controls

SOC 2

Field: soc2

Service Organization Control 2 Trust Services Criteria.
CC1 (Control Environment) CC2 (Communication/Info) CC3 (Risk Assessment) CC4 (Monitoring) CC5 (Control Activities) CC6 (Logical/Physical Access) CC7 (System Operations) CC8 (Change Mgmt) CC9 (Risk Mitigation)

HITRUST CSF

Field: hitrust

Health Information Trust Alliance Common Security Framework.
01 (Access Control) 02 (Human Resources) 03 (Risk Mgmt) 04 (Security Policy) 05 (Organization of IS) 06 (Compliance) 07 (Asset Mgmt) 08 (Physical/Environmental) 09 (Communications/Ops) 10 (Info Systems) 11 (Business Continuity) 12 (Privacy Practices)

GDPR

Field: gdpr

General Data Protection Regulation (EU).
Art. 5 (Principles) Art. 6 (Lawfulness) Art. 25 (Data Protection by Design) Art. 32 (Security of Processing) Art. 33 (Breach Notification) Art. 35 (Impact Assessment)