Every other tool is evidence-first: it maps what you collected to the controls it touches. control-coverage is control-first — it starts from the complete catalog of a framework’s controls and scores your evidence against it. The result is a true coverage percentage, the blind spots no finding touches, and a Statement of Applicability — from audit-report JSON you already have.
One corpus, three questions — how much of the framework you address, how that moved since last time, and which evidence is doing the most work.
Every control gets an assurance state — supported, failing, asserted, or unaddressed. The blind-spot list names the controls no finding touches, and a Statement of Applicability falls out for free. --format md,html,json,soa.
Point --baseline at an earlier corpus. Each control is classified improved, regressed, gained, or lost, with the coverage delta per framework. Gate CI with --fail-on-regression.
One 2FA check is evidence for SOC 2 CC6.1, ISO A.5.17, and NIST IA-2 at once. --crosswalk shows that leverage and computes the minimal evidence set — the fewest checks that still cover everything.
Coverage measures how much of a framework your evidence addresses — not whether you’re compliant. An unaddressed control is a gap in evidence; the judgment stays with you and your auditor.
# Install from PyPI pip install control-coverage # Score a folder of audit-report JSON reports control-coverage ./reports/ \ --scope soa.yaml --format md,html,soa --out out/
The exit-code contract, at a glance:
Pairs with audit-report — report on each package for compliance, then measure coverage across the whole corpus.