module

CRE::Compliance::ControlMapping

ControlMapping is the lookup that turns audit event_types into the specific framework controls they satisfy. The mapping is intentionally opinionated - each event maps only to controls where it provides direct evidence, not speculative coverage.

Constants

HIPAA = {"rotation.completed" => ["164.308(a)(5)(ii)(D)"], "rotation.failed" => ["164.308(a)(5)(ii)(D)", "164.308(a)(6)(ii)"], "policy.violation" => ["164.308(a)(5)(ii)(D)"], "drift.detected" => ["164.308(a)(6)(ii)"], "audit.batch.sealed" => ["164.312(b)"]}

ISO27001 = {"rotation.completed" => ["A.5.16", "A.5.17"], "rotation.failed" => ["A.5.17", "A.8.5"], "policy.violation" => ["A.5.18"], "drift.detected" => ["A.8.16"], "audit.batch.sealed" => ["A.8.15"], "key.rotation.kek" => ["A.8.24"]}

PCI_DSS = {"rotation.completed" => ["8.3.9", "8.6.3"], "rotation.failed" => ["8.3.9", "10.2.1"], "policy.violation" => ["8.6.3", "10.2.1"], "drift.detected" => ["10.2.1", "11.5.2"], "audit.batch.sealed" => ["10.5.2", "10.5.3"], "key.rotation.kek" => ["3.7.4"]}

SOC2 = {"rotation.completed" => ["CC6.1", "CC6.6"], "rotation.failed" => ["CC6.6", "CC7.2"], "rotation.step.completed" => ["CC6.1"], "rotation.step.failed" => ["CC6.6", "CC7.2"], "policy.violation" => ["CC6.7", "CC7.2"], "drift.detected" => ["CC6.6", "CC7.2"], "audit.batch.sealed" => ["CC4.1", "CC7.1"], "key.rotation.kek" => ["CC6.1"], "credential.discovered" => ["CC6.1"], "alert.raised" => ["CC7.2"]}

Class methods

for(framework : String) : Hash(String, Array(String))

Source

frameworks

Source