audit-labs/gh-attest

 1-- Secret scanning now maps to BOTH CC6.6 and CC6.1. A leaked credential is
 2-- simultaneously an external-access vector (CC6.6 — protection against threats
 3-- outside the system boundary, already mapped in 0002) and a compromise of the
 4-- logical-access controls themselves (CC6.1 — logical access security over
 5-- protected assets), since the credential is itself a logical-access key.
 6-- Auditors differ on which is the primary home; attesting both lets the export
 7-- satisfy whichever the control narrative uses. Each secret-scanning snapshot
 8-- therefore emits the CC6.1 rows below in addition to its CC6.6 rows.
 9INSERT INTO control_mappings (resource, status, framework, control_id, posture, rationale) VALUES
10  ('secret_scanning_alert', NULL, 'soc2', 'CC6.1', 'positive', 'Logical-access credential protection — leaked-credential detection is active'),
11  ('secret_scanning_alert', 'open', 'soc2', 'CC6.1', 'negative', 'Exposed credential undermines logical access controls'),
12  ('secret_scanning_alert', 'resolved', 'soc2', 'CC6.1', 'positive', 'Logical access control restored — exposure remediated');