Audit Labs / control-coverage

Measure what your evidence
doesn’t cover.

Every other tool is evidence-first: it maps what you collected to the controls it touches. control-coverage is control-first — it starts from the complete catalog of a framework’s controls and scores your evidence against it. The result is a true coverage percentage, the blind spots no finding touches, and a Statement of Applicability — from audit-report JSON you already have.

# Score a corpus against the whole framework
$ control-coverage ./reports/ --framework SOC2
  SOC 2: 16.7% coverage · 3 supported · 30 blind spots
──────────────────────────────
# List the controls nothing evidences yet
$ control-coverage ./reports/ --blind-spots
  ○ CC1.1 commitment to integrity and ethical values
  ○ CC2.1 relevant, quality information
  30 in-scope controls unaddressed
Three analyses

Coverage, trend, and crosswalk.

One corpus, three questions — how much of the framework you address, how that moved since last time, and which evidence is doing the most work.

01 · COVERAGE

What’s missing

Every control gets an assurance state — supported, failing, asserted, or unaddressed. The blind-spot list names the controls no finding touches, and a Statement of Applicability falls out for free. --format md,html,json,soa.

02 · TREND

What moved

Point --baseline at an earlier corpus. Each control is classified improved, regressed, gained, or lost, with the coverage delta per framework. Gate CI with --fail-on-regression.

03 · CROSSWALK

What earns the most

One 2FA check is evidence for SOC 2 CC6.1, ISO A.5.17, and NIST IA-2 at once. --crosswalk shows that leverage and computes the minimal evidence set — the fewest checks that still cover everything.

What you get

The denominator no other tool has.

Coverage measures how much of a framework your evidence addresses — not whether you’re compliant. An unaddressed control is a gap in evidence; the judgment stays with you and your auditor.

Complete catalogs
SOC 2 (all five Trust Services categories, 61 controls), ISO 27001:2022 Annex A (all 93), and the NIST 800-53 moderate baseline (177) — the full lists to measure against.
Blind spots
The in-scope controls no finding touches — the gaps an auditor finds for you if you don’t find them first.
Statement of Applicability
The required ISO 27001 artifact, derived from evidence rather than hand-kept. Exclude a control or a whole category with --scope — every exclusion needs a reason.
CI gating
--fail-under exits non-zero when coverage drops below a floor; --fail-on-regression when a control slips. Coverage as a metric, not a fire drill.
Measures coverage of
SOC 2 ISO 27001 NIST 800-53 · reads audit-report JSON
Get started

Install & quickstart.

# Install from PyPI
pip install control-coverage

# Score a folder of audit-report JSON reports
control-coverage ./reports/ \
  --scope soa.yaml --format md,html,soa --out out/
Python 3.10+ GPL-3.0 PyYAML only SOC 2 · ISO 27001 · NIST

The exit-code contract, at a glance:

0Ran clean — no coverage or regression gate was crossed.
1Coverage fell below --fail-under, or a control regressed under --fail-on-regression.
2Usage error, e.g. no reports found or an unknown framework.

Pairs with audit-report — report on each package for compliance, then measure coverage across the whole corpus.