Lab 02 — Control Crosswalk & Coverage Engine

Frameworks: NIST 800-53, OWASP ASVS, ISO 27002, PCI DSS, SOC 2. Kind: catalog of controls + process. Builds toward: Phase 15, Phase 07.

The problem (and the threat model)

The naive compliance program runs N separate efforts for N frameworks — re-documenting "we encrypt data in transit" five times, five ways, for five auditors. That is how a company spends three years on what should take nine months. The "threat" here is wasted, un-leveraged effort and un-evidenced claims: a control marked "done" in a spreadsheet with no fresh evidence behind it, or a requirement everyone assumed some other control covered. The control is a crosswalk engine: engineer each control once, map it to the requirement it satisfies in every framework, and prove — mechanically — that every required item has a substantiated control behind it.

one control ("TLS 1.2+ enforced & tested")
   ├─ NIST:SC-8        (FedRAMP)
   ├─ PCI:4.2.1        (PCI DSS)
   ├─ ISO:8.24         (ISO 27002)
   ├─ ASVS:9.1.1       (OWASP ASVS)
   └─ SOC2:CC6.7       (SOC 2)        → implement once, satisfy five

A control only counts when it is implemented, has evidence, and that evidence is fresh (an implemented control with stale or missing evidence is an assertion, not a control — the ConMon lesson from Phase 07/15).

What you build (`lab.py`)

is_substantiated(control) — implemented and evidenced and fresh.
validate_crosswalk(controls) — sorted findings of three kinds:
- gap:{framework}:{req} — a required item no control even maps to;
- unsubstantiated:{framework}:{req} — mapped, but no substantiated control behind it;
- dangling-claim:{control}:{req} — a control claims a requirement no framework demands (a typo / stale mapping).
coverage(controls) — per framework: {required, satisfied, gaps}.
leverage(controls) — rank substantiated controls by how many real requirements each satisfies (the "one control, many frameworks" metric — where to invest).
is_ready(framework, controls) — zero gaps for that framework.

Attack / failure cases the tests cover

One control, many frameworks: a clean five-control library fully covers all five frameworks; the three highest-leverage controls each satisfy 5 requirements.
Gap: a requirement with no mapped control fails coverage and readiness.
Unsubstantiated: a mapped control with no evidence or stale evidence (> 365 days) does not satisfy its requirements — it becomes a coverage gap, not a free pass.
Dangling claim: a control claiming a requirement no framework demands is flagged.
Determinism: findings are sorted and stable.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

Import a real OSCAL catalog/profile and emit OSCAL assessment-results (Phase 15).
Add partial satisfaction (a requirement needing two controls) and weighted coverage.
Pull the crosswalk from CSA's Cloud Controls Matrix mappings instead of a hand-built table.
Add an exception path (owner + expiry) so a gap can be accepted with a tracked POA&M (Phase 15).

Interview / resume

"Built a multi-framework control-crosswalk engine that maps one engineered, evidenced control to its requirement in NIST 800-53, PCI DSS, ISO 27002, OWASP ASVS, and SOC 2 — computing coverage, flagging unsubstantiated and dangling mappings, and ranking controls by cross-framework leverage. The point: implement once, satisfy many; an un-evidenced control is a gap, not a checkbox."

Limitations: a representative requirement slice, not the full catalogs; one-to-one control→requirement satisfaction (no partial/composite controls); freshness is a single global window.

Security Engineer