audit-labs/audit-report

 1"""Control catalog.
 2
 3A small, plain-language reference for every control code a ruleset may cite.
 4Control codes are written as ``FRAMEWORK:CODE`` (for example ``SOC2:CC6.1``).
 5The catalog is deliberately not exhaustive — it covers the codes the bundled
 6rulesets actually reference. Adding a framework means adding its codes here and
 7citing them from a ruleset.
 8
 9Like gh-attest, this tool produces *evidence*, not a compliance verdict: a
10mapping says a signal is relevant to a control, not that the control is met.
11"""
12
13# framework code -> human-readable name
14FRAMEWORKS = {
15    "SOC2": "SOC 2 (Trust Services Criteria)",
16    "ISO": "ISO/IEC 27001:2022 Annex A",
17    "NIST": "NIST SP 800-53 Rev. 5",
18}
19
20# "FRAMEWORK:CODE" -> one-line description of the control
21CONTROLS = {
22    # SOC 2 Trust Services Criteria
23    "SOC2:CC6.1": "Logical access security — restrict access to protected information assets.",
24    "SOC2:CC6.2": "Register and authorize new users before granting access.",
25    "SOC2:CC6.3": "Manage access rights based on roles and least privilege.",
26    "SOC2:CC6.6": "Restrict access from outside the system boundary.",
27    "SOC2:CC6.7": "Restrict the transmission and movement of information.",
28    "SOC2:CC7.1": "Detect and monitor for new vulnerabilities and misconfigurations.",
29    "SOC2:CC7.2": "Monitor system components for anomalies and security events.",
30    "SOC2:CC8.1": "Authorize, design, and track changes to infrastructure and software.",
31    # ISO/IEC 27001:2022 Annex A
32    "ISO:A.5.15": "Access control — rules based on business and security requirements.",
33    "ISO:A.5.17": "Authentication information — management of secrets and MFA.",
34    "ISO:A.5.18": "Access rights — provisioning, review, and removal.",
35    "ISO:A.8.2": "Privileged access rights — restricted and managed.",
36    "ISO:A.8.9": "Configuration management — secure baseline configuration.",
37    "ISO:A.8.15": "Logging — record events for monitoring and investigation.",
38    "ISO:A.8.20": "Network security — securing networks and network services.",
39    "ISO:A.8.32": "Change management — control changes to information systems.",
40    # NIST SP 800-53 Rev. 5
41    "NIST:AC-2": "Account management — establish, review, and disable accounts.",
42    "NIST:AC-6": "Least privilege — authorize the minimum access necessary.",
43    "NIST:AU-2": "Event logging — determine and record auditable events.",
44    "NIST:CM-6": "Configuration settings — establish and enforce secure settings.",
45    "NIST:IA-2": "Identification and authentication — multifactor for accounts.",
46    "NIST:IA-5": "Authenticator management — password strength and lifecycle.",
47    "NIST:SC-7": "Boundary protection — control communications at boundaries.",
48}
49
50
51def describe(control: str) -> str:
52    """Return the description for a control code, or a placeholder if unknown."""
53    return CONTROLS.get(control, "(no description on file)")
54
55
56def framework_of(control: str) -> str:
57    """Return the framework short code for a control code (text before ':')."""
58    return control.split(":", 1)[0]