trust/frameworks.json

{
  "$comment": "Framework clause catalogs. Reference data: the published clause lists, verbatim in id and title, with no Hanzo judgement in them. They are the DENOMINATOR of every coverage number — a control in controls.json may only map to an id that appears here, which is what makes a typo a build failure instead of a silently uncounted clause. Every field here describes a published clause, so coverage against that list is the only thing this file can say.",
  "soc2": {
    "name": "SOC 2 Trust Services Criteria",
    "edition": "2017, with the 2022 revised points of focus",
    "publisher": "AICPA",
    "unit": "criterion",
    "units": "criteria",
    "note": "All five trust services categories. Security (the common criteria) applies to every engagement; the other four are included only when in scope for a given report.",
    "clauses": [
      { "id": "CC1.1", "group": "Control Environment", "title": "Demonstrates a commitment to integrity and ethical values" },
      { "id": "CC1.2", "group": "Control Environment", "title": "Board of directors demonstrates independence and exercises oversight" },
      { "id": "CC1.3", "group": "Control Environment", "title": "Establishes structures, reporting lines, authorities and responsibilities" },
      { "id": "CC1.4", "group": "Control Environment", "title": "Demonstrates a commitment to attract, develop and retain competent individuals" },
      { "id": "CC1.5", "group": "Control Environment", "title": "Holds individuals accountable for their internal control responsibilities" },
      { "id": "CC2.1", "group": "Communication and Information", "title": "Obtains or generates relevant, quality information to support internal control" },
      { "id": "CC2.2", "group": "Communication and Information", "title": "Internally communicates information necessary to support internal control" },
      { "id": "CC2.3", "group": "Communication and Information", "title": "Communicates with external parties regarding matters affecting internal control" },
      { "id": "CC3.1", "group": "Risk Assessment", "title": "Specifies objectives with sufficient clarity to identify and assess risk" },
      { "id": "CC3.2", "group": "Risk Assessment", "title": "Identifies and analyzes risk to the achievement of its objectives" },
      { "id": "CC3.3", "group": "Risk Assessment", "title": "Considers the potential for fraud in assessing risk" },
      { "id": "CC3.4", "group": "Risk Assessment", "title": "Identifies and assesses changes that could significantly impact internal control" },
      { "id": "CC4.1", "group": "Monitoring Activities", "title": "Selects, develops and performs ongoing and separate evaluations of controls" },
      { "id": "CC4.2", "group": "Monitoring Activities", "title": "Evaluates and communicates internal control deficiencies in a timely manner" },
      { "id": "CC5.1", "group": "Control Activities", "title": "Selects and develops control activities that mitigate risk to acceptable levels" },
      { "id": "CC5.2", "group": "Control Activities", "title": "Selects and develops general control activities over technology" },
      { "id": "CC5.3", "group": "Control Activities", "title": "Deploys control activities through policies and procedures" },
      { "id": "CC6.1", "group": "Logical and Physical Access", "title": "Implements logical access security software, infrastructure and architectures over protected information assets" },
      { "id": "CC6.2", "group": "Logical and Physical Access", "title": "Registers and authorizes new internal and external users before issuing credentials" },
      { "id": "CC6.3", "group": "Logical and Physical Access", "title": "Authorizes, modifies or removes access based on roles, responsibilities and least privilege" },
      { "id": "CC6.4", "group": "Logical and Physical Access", "title": "Restricts physical access to facilities and protected information assets" },
      { "id": "CC6.5", "group": "Logical and Physical Access", "title": "Discontinues logical and physical protections over assets on disposal" },
      { "id": "CC6.6", "group": "Logical and Physical Access", "title": "Implements logical access security measures against threats from outside the system boundaries" },
      { "id": "CC6.7", "group": "Logical and Physical Access", "title": "Restricts the transmission, movement and removal of information" },
      { "id": "CC6.8", "group": "Logical and Physical Access", "title": "Implements controls to prevent or detect and act upon unauthorized or malicious software" },
      { "id": "CC7.1", "group": "System Operations", "title": "Uses detection and monitoring procedures to identify configuration changes and vulnerabilities" },
      { "id": "CC7.2", "group": "System Operations", "title": "Monitors system components for anomalies indicative of malicious acts, natural disasters and errors" },
      { "id": "CC7.3", "group": "System Operations", "title": "Evaluates security events to determine whether they could or have resulted in a failure" },
      { "id": "CC7.4", "group": "System Operations", "title": "Responds to identified security incidents" },
      { "id": "CC7.5", "group": "System Operations", "title": "Identifies, develops and implements activities to recover from identified security incidents" },
      { "id": "CC8.1", "group": "Change Management", "title": "Authorizes, designs, develops, tests, approves and implements changes to infrastructure, data, software and procedures" },
      { "id": "CC9.1", "group": "Risk Mitigation", "title": "Identifies, selects and develops risk mitigation activities for business disruptions" },
      { "id": "CC9.2", "group": "Risk Mitigation", "title": "Assesses and manages risks associated with vendors and business partners" },
      { "id": "A1.1", "group": "Availability", "title": "Maintains, monitors and evaluates current processing capacity and use of system components" },
      { "id": "A1.2", "group": "Availability", "title": "Authorizes, designs, implements and maintains environmental protections, backup and recovery infrastructure" },
      { "id": "A1.3", "group": "Availability", "title": "Tests recovery plan procedures supporting system recovery" },
      { "id": "C1.1", "group": "Confidentiality", "title": "Identifies and maintains confidential information to meet confidentiality objectives" },
      { "id": "C1.2", "group": "Confidentiality", "title": "Disposes of confidential information to meet confidentiality objectives" },
      { "id": "PI1.1", "group": "Processing Integrity", "title": "Obtains, generates, uses and communicates relevant quality information about processing objectives" },
      { "id": "PI1.2", "group": "Processing Integrity", "title": "Implements policies and procedures over system inputs" },
      { "id": "PI1.3", "group": "Processing Integrity", "title": "Implements policies and procedures over system processing" },
      { "id": "PI1.4", "group": "Processing Integrity", "title": "Implements policies and procedures to make output available in accordance with specifications" },
      { "id": "PI1.5", "group": "Processing Integrity", "title": "Implements policies and procedures to store inputs, items in processing and outputs completely and accurately" },
      { "id": "P1.1", "group": "Privacy — Notice", "title": "Provides notice about its privacy practices to data subjects" },
      { "id": "P2.1", "group": "Privacy — Choice and Consent", "title": "Communicates choices available regarding personal information and obtains consent" },
      { "id": "P3.1", "group": "Privacy — Collection", "title": "Collects personal information consistent with its objectives" },
      { "id": "P3.2", "group": "Privacy — Collection", "title": "Obtains explicit consent for sensitive personal information" },
      { "id": "P4.1", "group": "Privacy — Use, Retention and Disposal", "title": "Limits the use of personal information to its stated purposes" },
      { "id": "P4.2", "group": "Privacy — Use, Retention and Disposal", "title": "Retains personal information consistent with its objectives" },
      { "id": "P4.3", "group": "Privacy — Use, Retention and Disposal", "title": "Securely disposes of personal information" },
      { "id": "P5.1", "group": "Privacy — Access", "title": "Grants identified and authenticated data subjects access to their personal information" },
      { "id": "P5.2", "group": "Privacy — Access", "title": "Corrects, amends or appends personal information on request" },
      { "id": "P6.1", "group": "Privacy — Disclosure and Notification", "title": "Discloses personal information only with the consent of the data subject" },
      { "id": "P6.2", "group": "Privacy — Disclosure and Notification", "title": "Creates and retains a record of authorized disclosures" },
      { "id": "P6.3", "group": "Privacy — Disclosure and Notification", "title": "Creates and retains a record of detected or reported unauthorized disclosures" },
      { "id": "P6.4", "group": "Privacy — Disclosure and Notification", "title": "Obtains privacy commitments from third parties to whom information is disclosed" },
      { "id": "P6.5", "group": "Privacy — Disclosure and Notification", "title": "Obtains commitments from third parties to notify of unauthorized disclosures" },
      { "id": "P6.6", "group": "Privacy — Disclosure and Notification", "title": "Provides notification of breaches and incidents to affected data subjects, regulators and others" },
      { "id": "P6.7", "group": "Privacy — Disclosure and Notification", "title": "Provides data subjects with an accounting of personal information held and disclosures made" },
      { "id": "P7.1", "group": "Privacy — Quality", "title": "Collects and maintains accurate, complete and relevant personal information" },
      { "id": "P8.1", "group": "Privacy — Monitoring and Enforcement", "title": "Implements a process for receiving, addressing and resolving privacy complaints" }
    ]
  },
  "iso27001": {
    "name": "ISO/IEC 27001 Annex A",
    "edition": "2022",
    "publisher": "ISO/IEC",
    "unit": "control",
    "units": "controls",
    "note": "All 93 Annex A controls across the four themes. Annex A is a reference set; a real Statement of Applicability scopes it per organization. This catalog does not scope it — every control is counted, and the ones no engineering control can reach show as uncovered rather than as excluded.",
    "clauses": [
      { "id": "A.5.1", "group": "Organizational", "title": "Policies for information security" },
      { "id": "A.5.2", "group": "Organizational", "title": "Information security roles and responsibilities" },
      { "id": "A.5.3", "group": "Organizational", "title": "Segregation of duties" },
      { "id": "A.5.4", "group": "Organizational", "title": "Management responsibilities" },
      { "id": "A.5.5", "group": "Organizational", "title": "Contact with authorities" },
      { "id": "A.5.6", "group": "Organizational", "title": "Contact with special interest groups" },
      { "id": "A.5.7", "group": "Organizational", "title": "Threat intelligence" },
      { "id": "A.5.8", "group": "Organizational", "title": "Information security in project management" },
      { "id": "A.5.9", "group": "Organizational", "title": "Inventory of information and other associated assets" },
      { "id": "A.5.10", "group": "Organizational", "title": "Acceptable use of information and other associated assets" },
      { "id": "A.5.11", "group": "Organizational", "title": "Return of assets" },
      { "id": "A.5.12", "group": "Organizational", "title": "Classification of information" },
      { "id": "A.5.13", "group": "Organizational", "title": "Labelling of information" },
      { "id": "A.5.14", "group": "Organizational", "title": "Information transfer" },
      { "id": "A.5.15", "group": "Organizational", "title": "Access control" },
      { "id": "A.5.16", "group": "Organizational", "title": "Identity management" },
      { "id": "A.5.17", "group": "Organizational", "title": "Authentication information" },
      { "id": "A.5.18", "group": "Organizational", "title": "Access rights" },
      { "id": "A.5.19", "group": "Organizational", "title": "Information security in supplier relationships" },
      { "id": "A.5.20", "group": "Organizational", "title": "Addressing information security within supplier agreements" },
      { "id": "A.5.21", "group": "Organizational", "title": "Managing information security in the ICT supply chain" },
      { "id": "A.5.22", "group": "Organizational", "title": "Monitoring, review and change management of supplier services" },
      { "id": "A.5.23", "group": "Organizational", "title": "Information security for use of cloud services" },
      { "id": "A.5.24", "group": "Organizational", "title": "Information security incident management planning and preparation" },
      { "id": "A.5.25", "group": "Organizational", "title": "Assessment and decision on information security events" },
      { "id": "A.5.26", "group": "Organizational", "title": "Response to information security incidents" },
      { "id": "A.5.27", "group": "Organizational", "title": "Learning from information security incidents" },
      { "id": "A.5.28", "group": "Organizational", "title": "Collection of evidence" },
      { "id": "A.5.29", "group": "Organizational", "title": "Information security during disruption" },
      { "id": "A.5.30", "group": "Organizational", "title": "ICT readiness for business continuity" },
      { "id": "A.5.31", "group": "Organizational", "title": "Legal, statutory, regulatory and contractual requirements" },
      { "id": "A.5.32", "group": "Organizational", "title": "Intellectual property rights" },
      { "id": "A.5.33", "group": "Organizational", "title": "Protection of records" },
      { "id": "A.5.34", "group": "Organizational", "title": "Privacy and protection of personally identifiable information" },
      { "id": "A.5.35", "group": "Organizational", "title": "Independent review of information security" },
      { "id": "A.5.36", "group": "Organizational", "title": "Compliance with policies, rules and standards for information security" },
      { "id": "A.5.37", "group": "Organizational", "title": "Documented operating procedures" },
      { "id": "A.6.1", "group": "People", "title": "Screening" },
      { "id": "A.6.2", "group": "People", "title": "Terms and conditions of employment" },
      { "id": "A.6.3", "group": "People", "title": "Information security awareness, education and training" },
      { "id": "A.6.4", "group": "People", "title": "Disciplinary process" },
      { "id": "A.6.5", "group": "People", "title": "Responsibilities after termination or change of employment" },
      { "id": "A.6.6", "group": "People", "title": "Confidentiality or non-disclosure agreements" },
      { "id": "A.6.7", "group": "People", "title": "Remote working" },
      { "id": "A.6.8", "group": "People", "title": "Information security event reporting" },
      { "id": "A.7.1", "group": "Physical", "title": "Physical security perimeters" },
      { "id": "A.7.2", "group": "Physical", "title": "Physical entry" },
      { "id": "A.7.3", "group": "Physical", "title": "Securing offices, rooms and facilities" },
      { "id": "A.7.4", "group": "Physical", "title": "Physical security monitoring" },
      { "id": "A.7.5", "group": "Physical", "title": "Protecting against physical and environmental threats" },
      { "id": "A.7.6", "group": "Physical", "title": "Working in secure areas" },
      { "id": "A.7.7", "group": "Physical", "title": "Clear desk and clear screen" },
      { "id": "A.7.8", "group": "Physical", "title": "Equipment siting and protection" },
      { "id": "A.7.9", "group": "Physical", "title": "Security of assets off-premises" },
      { "id": "A.7.10", "group": "Physical", "title": "Storage media" },
      { "id": "A.7.11", "group": "Physical", "title": "Supporting utilities" },
      { "id": "A.7.12", "group": "Physical", "title": "Cabling security" },
      { "id": "A.7.13", "group": "Physical", "title": "Equipment maintenance" },
      { "id": "A.7.14", "group": "Physical", "title": "Secure disposal or re-use of equipment" },
      { "id": "A.8.1", "group": "Technological", "title": "User endpoint devices" },
      { "id": "A.8.2", "group": "Technological", "title": "Privileged access rights" },
      { "id": "A.8.3", "group": "Technological", "title": "Information access restriction" },
      { "id": "A.8.4", "group": "Technological", "title": "Access to source code" },
      { "id": "A.8.5", "group": "Technological", "title": "Secure authentication" },
      { "id": "A.8.6", "group": "Technological", "title": "Capacity management" },
      { "id": "A.8.7", "group": "Technological", "title": "Protection against malware" },
      { "id": "A.8.8", "group": "Technological", "title": "Management of technical vulnerabilities" },
      { "id": "A.8.9", "group": "Technological", "title": "Configuration management" },
      { "id": "A.8.10", "group": "Technological", "title": "Information deletion" },
      { "id": "A.8.11", "group": "Technological", "title": "Data masking" },
      { "id": "A.8.12", "group": "Technological", "title": "Data leakage prevention" },
      { "id": "A.8.13", "group": "Technological", "title": "Information backup" },
      { "id": "A.8.14", "group": "Technological", "title": "Redundancy of information processing facilities" },
      { "id": "A.8.15", "group": "Technological", "title": "Logging" },
      { "id": "A.8.16", "group": "Technological", "title": "Monitoring activities" },
      { "id": "A.8.17", "group": "Technological", "title": "Clock synchronization" },
      { "id": "A.8.18", "group": "Technological", "title": "Use of privileged utility programs" },
      { "id": "A.8.19", "group": "Technological", "title": "Installation of software on operational systems" },
      { "id": "A.8.20", "group": "Technological", "title": "Networks security" },
      { "id": "A.8.21", "group": "Technological", "title": "Security of network services" },
      { "id": "A.8.22", "group": "Technological", "title": "Segregation of networks" },
      { "id": "A.8.23", "group": "Technological", "title": "Web filtering" },
      { "id": "A.8.24", "group": "Technological", "title": "Use of cryptography" },
      { "id": "A.8.25", "group": "Technological", "title": "Secure development life cycle" },
      { "id": "A.8.26", "group": "Technological", "title": "Application security requirements" },
      { "id": "A.8.27", "group": "Technological", "title": "Secure system architecture and engineering principles" },
      { "id": "A.8.28", "group": "Technological", "title": "Secure coding" },
      { "id": "A.8.29", "group": "Technological", "title": "Security testing in development and acceptance" },
      { "id": "A.8.30", "group": "Technological", "title": "Outsourced development" },
      { "id": "A.8.31", "group": "Technological", "title": "Separation of development, test and production environments" },
      { "id": "A.8.32", "group": "Technological", "title": "Change management" },
      { "id": "A.8.33", "group": "Technological", "title": "Test information" },
      { "id": "A.8.34", "group": "Technological", "title": "Protection of information systems during audit testing" }
    ]
  },
  "nist80053": {
    "name": "NIST SP 800-53 control families",
    "edition": "Revision 5",
    "publisher": "NIST",
    "unit": "family",
    "units": "families",
    "note": "Mapped at FAMILY granularity, not to individual controls. Rev 5 has over a thousand controls and enhancements; claiming a per-control mapping we have not performed would be the exact dishonesty this system exists to prevent. A family counts as automated when at least one verified automated control lands inside it — that is a weaker statement than covering the family, and it is stated that way everywhere it is reported.",
    "clauses": [
      { "id": "AC", "group": "800-53 Rev 5", "title": "Access Control" },
      { "id": "AT", "group": "800-53 Rev 5", "title": "Awareness and Training" },
      { "id": "AU", "group": "800-53 Rev 5", "title": "Audit and Accountability" },
      { "id": "CA", "group": "800-53 Rev 5", "title": "Assessment, Authorization and Monitoring" },
      { "id": "CM", "group": "800-53 Rev 5", "title": "Configuration Management" },
      { "id": "CP", "group": "800-53 Rev 5", "title": "Contingency Planning" },
      { "id": "IA", "group": "800-53 Rev 5", "title": "Identification and Authentication" },
      { "id": "IR", "group": "800-53 Rev 5", "title": "Incident Response" },
      { "id": "MA", "group": "800-53 Rev 5", "title": "Maintenance" },
      { "id": "MP", "group": "800-53 Rev 5", "title": "Media Protection" },
      { "id": "PE", "group": "800-53 Rev 5", "title": "Physical and Environmental Protection" },
      { "id": "PL", "group": "800-53 Rev 5", "title": "Planning" },
      { "id": "PM", "group": "800-53 Rev 5", "title": "Program Management" },
      { "id": "PS", "group": "800-53 Rev 5", "title": "Personnel Security" },
      { "id": "PT", "group": "800-53 Rev 5", "title": "Personally Identifiable Information Processing and Transparency" },
      { "id": "RA", "group": "800-53 Rev 5", "title": "Risk Assessment" },
      { "id": "SA", "group": "800-53 Rev 5", "title": "System and Services Acquisition" },
      { "id": "SC", "group": "800-53 Rev 5", "title": "System and Communications Protection" },
      { "id": "SI", "group": "800-53 Rev 5", "title": "System and Information Integrity" },
      { "id": "SR", "group": "800-53 Rev 5", "title": "Supply Chain Risk Management" }
    ]
  }
}