audit-labs/control-coverage

 1# Control catalogs — provenance and rationale
 2
 3`control-coverage` measures how much of a framework an evidence corpus addresses.
 4The **denominator** is a framework catalog: the complete list of controls the
 5framework defines. This document records where those catalogs come from, how they
 6are versioned, and the limits of what they claim.
 7
 8## What these catalogs are — and are not
 9
10- They enumerate control **identifiers** (e.g. `SOC2:CC6.1`, `ISO:A.5.17`,
11  `NIST:AC-2`) plus a short title used as a display label.
12- They are **not** the normative control text. For authoritative wording, consult
13  the source standard.
14- Mapping a control to an evidence signal is the **maintainers' interpretation**.
15  It is not reviewed or endorsed by the AICPA, ISO/IEC, or NIST.
16- Coverage is a measure of **evidence**, not of compliance. A control counted as
17  "addressed" means the corpus contains a signal relevant to it — not that the
18  control operates effectively. That judgment belongs to the organization and its
19  auditor.
20
21## Sources and revisions
22
23| Framework | Catalog file | Revision used | Scope |
24|---|---|---|---|
25| SOC 2 | `catalogs/soc2.yaml` | Trust Services Criteria 2017 (2022 revised points of focus) | All five categories: Security (Common Criteria), Availability, Confidentiality, Processing Integrity, Privacy |
26| ISO/IEC 27001 | `catalogs/iso27001.yaml` | 27001:2022 Annex A | All 93 Annex A controls, four themes |
27| NIST SP 800-53 | `catalogs/nist80053.yaml` | Rev. 5 / SP 800-53B **Moderate** baseline | 177 base controls (see below) |
28
29### How the NIST count is 177
30
31The NIST catalog is the base controls selected in the **SP 800-53B Moderate**
32impact baseline, across the 18 baseline-applicable families. Control
33**enhancements** (e.g. `AC-2(1)`) are not enumerated — coverage is measured at the
34base-control level. The Program Management (PM) family is organization-wide and
35not baseline-allocated; the Privacy (PT) family is selected via the separate
36privacy baseline. That selection is 177 base controls.
37
38## Versioning and traceability
39
40- Each catalog carries a `version` field, and every report stamps the catalog
41  `version` **and a SHA-256 of the catalog file** into its output (`tool` and
42  `frameworks[].sha256` in JSON; the header line in Markdown/HTML).
43- This lets an auditor tie any coverage result back to the exact denominator that
44  produced it, and re-perform against it.
45- Change the control set or a title and the SHA-256 changes; bump `version` on any
46  substantive change.
47
48## Authorship and review
49
50- **Author:** the audit-labs maintainer.
51- **Review status:** maintainer self-review. These catalogs have **not** been
52  through independent professional review; treat them accordingly and validate
53  against the source standards before relying on them in an engagement.
54- **Effective date:** 2026-08.
55
56## Copyright
57
58- **SOC 2 / Trust Services Criteria** — copyright AICPA. Only identifiers are
59  reproduced; titles are our own short-form paraphrases, not the criteria text.
60- **ISO/IEC 27001:2022** — copyright ISO/IEC. Only Annex A identifiers and short
61  titles are reproduced; normative text and guidance are not.
62- **NIST SP 800-53** — U.S. Government work in the public domain.