audit-labs/control-coverage

Control coverage and blind-spot analysis for audit evidence.

clone: git clone https://gitbay.org/audit-labs/control-coverage.git

 1# Example scope / Statement of Applicability for the test corpus.
 2subject: Acme Production
 3frameworks: [SOC2, ISO]
 4exclusions:
 5  - control: ISO:A.7.1
 6    reason: "Fully cloud-hosted; no physical premises are in scope for the ISMS."
 7  - control: ISO:A.5.7
 8    reason: "No formal threat-intelligence program; risk accepted by the CISO for 2026."
 9owners:
10  SOC2:CC6.1: platform-team
11  ISO:A.5.17: identity-team