audit-labs/audit-labs.dev
The website for Audit Labs.
clone: git clone https://gitbay.org/audit-labs/audit-labs.dev.git
main: control-coverage/index.html · raw
1<!DOCTYPE html>
2<html lang="en">
3<head>
4 <meta charset="UTF-8">
5 <meta name="viewport" content="width=device-width, initial-scale=1.0">
6 <title>control-coverage | Audit Labs</title>
7 <meta name="description" content="Control-first coverage and blind-spot analysis. Scores an evidence corpus against the complete catalog of a framework's controls — SOC 2, ISO 27001, NIST 800-53 — for a true coverage percentage, the blind spots no finding touches, and a Statement of Applicability.">
8 <link rel="preconnect" href="https://fonts.googleapis.com">
9 <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;700&family=DM+Serif+Display:ital@0;1&family=DM+Sans:wght@400;500;600&display=swap" rel="stylesheet">
10 <link rel="stylesheet" href="../assets/site.css">
11</head>
12<body>
13
14<nav>
15 <div class="nav-inner">
16 <a href="/" class="logo">AUDIT<span>LABS</span></a>
17 <ul class="nav-links">
18 <li><a href="https://github.com/audit-labs/control-coverage" class="btn-github">View on GitHub →</a></li>
19 </ul>
20 </div>
21</nav>
22
23<header class="hero split">
24 <div class="hero-inner">
25 <div>
26 <div class="crumb"><a href="/">Audit Labs</a> / control-coverage</div>
27 <h1>Measure what your evidence<br><em>doesn’t cover.</em></h1>
28 <p class="hero-desc">
29 Every other tool is evidence-first: it maps what you collected to the controls it
30 touches. <strong>control-coverage</strong> is control-first — it starts from the
31 <em>complete</em> catalog of a framework’s controls and scores your evidence against
32 it. The result is a true coverage percentage, the blind spots no finding touches, and a
33 Statement of Applicability — from audit-report JSON you already have.
34 </p>
35 <div class="hero-actions">
36 <a href="https://github.com/audit-labs/control-coverage" class="btn-primary">View on GitHub</a>
37 <a href="#install" class="btn-secondary">Install & quickstart</a>
38 </div>
39 </div>
40 <div class="terminal">
41 <div class="terminal-bar"><div class="dot dot-red"></div><div class="dot dot-yellow"></div><div class="dot dot-green"></div></div>
42 <div class="terminal-body">
43 <span class="t-comment"># Score a corpus against the whole framework</span><br>
44 <span class="t-prompt">$</span> <span class="t-cmd">control-coverage ./reports/ --framework SOC2</span><br>
45 <span class="t-path"> SOC 2: 16.7% coverage · 3 supported · 30 blind spots</span><br>
46 <span class="t-dim">──────────────────────────────</span><br>
47 <span class="t-comment"># List the controls nothing evidences yet</span><br>
48 <span class="t-prompt">$</span> <span class="t-cmd">control-coverage ./reports/ --blind-spots</span><br>
49 <span class="t-out"> ○ CC1.1 commitment to integrity and ethical values</span><br>
50 <span class="t-out"> ○ CC2.1 relevant, quality information</span><br>
51 <span class="t-bad"> 30 in-scope controls unaddressed</span>
52 </div>
53 </div>
54 </div>
55</header>
56
57<section>
58 <div class="section-inner">
59 <div class="eyebrow">Three analyses</div>
60 <h2>Coverage, trend, and crosswalk.</h2>
61 <p class="lede">One corpus, three questions — how much of the framework you address, how that moved since last time, and which evidence is doing the most work.</p>
62 <div class="guarantees">
63 <div class="card">
64 <div class="num">01 · COVERAGE</div>
65 <h3>What’s missing</h3>
66 <p>Every control gets an assurance state — <em>supported</em>, <em>failing</em>, <em>asserted</em>, or <em>unaddressed</em>. The blind-spot list names the controls no finding touches, and a Statement of Applicability falls out for free. <span class="mono">--format md,html,json,soa</span>.</p>
67 </div>
68 <div class="card">
69 <div class="num">02 · TREND</div>
70 <h3>What moved</h3>
71 <p>Point <span class="mono">--baseline</span> at an earlier corpus. Each control is classified <em>improved</em>, <em>regressed</em>, <em>gained</em>, or <em>lost</em>, with the coverage delta per framework. Gate CI with <span class="mono">--fail-on-regression</span>.</p>
72 </div>
73 <div class="card">
74 <div class="num">03 · CROSSWALK</div>
75 <h3>What earns the most</h3>
76 <p>One 2FA check is evidence for SOC 2 CC6.1, ISO A.5.17, and NIST IA-2 at once. <span class="mono">--crosswalk</span> shows that leverage and computes the <em>minimal evidence set</em> — the fewest checks that still cover everything.</p>
77 </div>
78 </div>
79 </div>
80</section>
81
82<section class="cmds">
83 <div class="section-inner">
84 <div class="eyebrow">What you get</div>
85 <h2>The denominator no other tool has.</h2>
86 <p class="lede">Coverage measures how much of a framework your evidence addresses — not whether you’re compliant. An unaddressed control is a gap in <em>evidence</em>; the judgment stays with you and your auditor.</p>
87 <div class="cmd-list">
88 <div class="cmd-row"><div class="cmd-name">Complete catalogs</div><div class="cmd-desc">SOC 2 (all five Trust Services categories, 61 controls), ISO 27001:2022 Annex A (all 93), and the NIST 800-53 moderate baseline (177) — the full lists to measure against.</div></div>
89 <div class="cmd-row"><div class="cmd-name">Blind spots</div><div class="cmd-desc">The in-scope controls no finding touches — the gaps an auditor finds for you if you don’t find them first.</div></div>
90 <div class="cmd-row"><div class="cmd-name">Statement of Applicability</div><div class="cmd-desc">The required ISO 27001 artifact, derived from evidence rather than hand-kept. Exclude a control or a whole category with <span class="mono">--scope</span> — every exclusion needs a reason.</div></div>
91 <div class="cmd-row"><div class="cmd-name">CI gating</div><div class="cmd-desc"><span class="mono">--fail-under</span> exits non-zero when coverage drops below a floor; <span class="mono">--fail-on-regression</span> when a control slips. Coverage as a metric, not a fire drill.</div></div>
92 </div>
93 </div>
94</section>
95
96<section class="frameworks">
97 <div class="frameworks-inner">
98 <span class="frameworks-label">Measures coverage of</span>
99 <div class="frameworks-list">
100 <span class="framework-tag">SOC 2</span>
101 <span class="framework-tag">ISO 27001</span>
102 <span class="framework-tag">NIST 800-53</span>
103 <span class="framework-tag" style="color:var(--gray-4);">·</span>
104 <span class="framework-tag">reads audit-report JSON</span>
105 </div>
106 </div>
107</section>
108
109<section class="install" id="install">
110 <div class="section-inner">
111 <div class="eyebrow">Get started</div>
112 <h2>Install & quickstart.</h2>
113 <div class="install-grid">
114 <div>
115 <pre><span class="c"># Install from PyPI</span>
116pip install <span class="p">control-coverage</span>
117
118<span class="c"># Score a folder of audit-report JSON reports</span>
119control-coverage ./reports/ \
120 --scope soa.yaml --format md,html,soa --out out/</pre>
121 <div class="badges">
122 <span class="badge">Python 3.10+</span>
123 <span class="badge">GPL-3.0</span>
124 <span class="badge">PyYAML only</span>
125 <span class="badge">SOC 2 · ISO 27001 · NIST</span>
126 </div>
127 </div>
128 <div>
129 <p class="lede">The exit-code contract, at a glance:</p>
130 <div class="exit">
131 <div class="e"><span class="code g">0</span><span>Ran clean — no coverage or regression gate was crossed.</span></div>
132 <div class="e"><span class="code r">1</span><span>Coverage fell below <span class="mono">--fail-under</span>, or a control regressed under <span class="mono">--fail-on-regression</span>.</span></div>
133 <div class="e"><span class="code a">2</span><span>Usage error, e.g. no reports found or an unknown framework.</span></div>
134 </div>
135 <p class="lede" style="margin-top:1.4rem; font-size:.9rem;">
136 Pairs with <a href="/audit-report/" style="color:var(--amber); text-decoration:none;">audit-report</a>
137 — report on each package for compliance, then measure coverage across the whole corpus.
138 </p>
139 </div>
140 </div>
141 </div>
142</section>
143
144<footer>
145 <div class="footer-inner">
146 <div class="footer-left">
147 <a href="/" class="footer-logo">AUDIT<span>LABS</span></a>
148 <p>© 2026 Audit Labs — a two-person team building for the community.</p>
149 </div>
150 <div class="footer-links">
151 <a href="/">Home</a>
152 <a href="https://github.com/audit-labs">GitHub</a>
153 </div>
154 </div>
155</footer>
156
157</body>
158</html>