@blamejs/exceptd-skills 0.13.19 → 0.13.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/CHANGELOG.md +72 -0
  2. package/data/_indexes/_meta.json +6 -6
  3. package/data/attack-techniques.json +2 -3
  4. package/data/cve-catalog.json +301 -3792
  5. package/data/framework-control-gaps.json +168 -504
  6. package/data/zeroday-lessons.json +5 -3029
  7. package/lib/canonical-eq.js +88 -0
  8. package/lib/cve-regression-watcher.js +130 -9
  9. package/lib/gap-detectors.js +555 -0
  10. package/lib/source-advisories.js +9 -34
  11. package/lib/version-pins.js +73 -0
  12. package/lib/xml-tokenizer.js +344 -0
  13. package/manifest.json +44 -44
  14. package/package.json +4 -3
  15. package/sbom.cdx.json +108 -33
  16. package/scripts/audit-catalog-gaps.js +74 -13
  17. package/scripts/check-catalog-gap-budget.js +133 -0
  18. package/scripts/check-test-coverage.js +16 -18
  19. package/scripts/predeploy.js +14 -0
  20. package/scripts/refresh-upstream-catalogs.js +13 -0
package/data/framework-control-gaps.json CHANGED
@@ -49,12 +49,8 @@
49
49
  ],
50
50
  "verdict_when_failed": "compliance-theater"
51
51
  },
52
- "_gap_skip": {
53
- "fields": [
54
- "evidence_cves"
55
- ],
56
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
57
- }
52
+ "forward_looking": true,
53
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
58
54
  },
59
55
  "ALL-MCP-TOOL-TRUST": {
60
56
  "framework": "ALL",
@@ -87,12 +83,8 @@
87
83
  ],
88
84
  "verdict_when_failed": "compliance-theater"
89
85
  },
90
- "_gap_skip": {
91
- "fields": [
92
- "evidence_cves"
93
- ],
94
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
95
- }
86
+ "forward_looking": true,
87
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
96
88
  },
97
89
  "ALL-PROMPT-INJECTION-ACCESS-CONTROL": {
98
90
  "framework": "ALL",
@@ -125,12 +117,8 @@
125
117
  ],
126
118
  "verdict_when_failed": "compliance-theater"
127
119
  },
128
- "_gap_skip": {
129
- "fields": [
130
- "evidence_cves"
131
- ],
132
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
133
- }
120
+ "forward_looking": true,
121
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
134
122
  },
135
123
  "AU-Essential-8-App-Hardening": {
136
124
  "framework": "ASD Essential Eight (AU)",
@@ -163,12 +151,8 @@
163
151
  ],
164
152
  "verdict_when_failed": "compliance-theater"
165
153
  },
166
- "_gap_skip": {
167
- "fields": [
168
- "evidence_cves"
169
- ],
170
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
171
- }
154
+ "forward_looking": true,
155
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
172
156
  },
173
157
  "AU-Essential-8-Backup": {
174
158
  "framework": "ASD Essential Eight (AU)",
@@ -200,12 +184,8 @@
200
184
  ],
201
185
  "verdict_when_failed": "compliance-theater"
202
186
  },
203
- "_gap_skip": {
204
- "fields": [
205
- "evidence_cves"
206
- ],
207
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
208
- }
187
+ "forward_looking": true,
188
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
209
189
  },
210
190
  "AU-Essential-8-MFA": {
211
191
  "framework": "ASD Essential Eight (AU)",
@@ -238,12 +218,8 @@
238
218
  ],
239
219
  "verdict_when_failed": "compliance-theater"
240
220
  },
241
- "_gap_skip": {
242
- "fields": [
243
- "evidence_cves"
244
- ],
245
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
246
- }
221
+ "forward_looking": true,
222
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
247
223
  },
248
224
  "AU-Essential-8-Patch": {
249
225
  "framework": "ASD Essential Eight (AU)",
@@ -273,12 +249,8 @@
273
249
  ],
274
250
  "verdict_when_failed": "compliance-theater"
275
251
  },
276
- "_gap_skip": {
277
- "fields": [
278
- "evidence_cves"
279
- ],
280
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
281
- }
252
+ "forward_looking": true,
253
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
282
254
  },
283
255
  "CIS-Controls-v8-Control7": {
284
256
  "framework": "CIS Controls v8",
@@ -379,12 +351,8 @@
379
351
  ],
380
352
  "verdict_when_failed": "compliance-theater"
381
353
  },
382
- "_gap_skip": {
383
- "fields": [
384
- "evidence_cves"
385
- ],
386
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
387
- }
354
+ "forward_looking": true,
355
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
388
356
  },
389
357
  "CWE-Top-25-2024-meta": {
390
358
  "framework": "CWE Top 25 Most Dangerous Software Weaknesses (2024 list)",
@@ -419,12 +387,8 @@
419
387
  ],
420
388
  "verdict_when_failed": "compliance-theater"
421
389
  },
422
- "_gap_skip": {
423
- "fields": [
424
- "evidence_cves"
425
- ],
426
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
427
- }
390
+ "forward_looking": true,
391
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
428
392
  },
429
393
  "CycloneDX-v1.6-SBOM": {
430
394
  "framework": "CycloneDX v1.6 (OWASP SBOM standard)",
@@ -459,12 +423,8 @@
459
423
  ],
460
424
  "verdict_when_failed": "compliance-theater"
461
425
  },
462
- "_gap_skip": {
463
- "fields": [
464
- "evidence_cves"
465
- ],
466
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
467
- }
426
+ "forward_looking": true,
427
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
468
428
  },
469
429
  "DORA-Art28": {
470
430
  "framework": "EU DORA (Regulation 2022/2554)",
@@ -533,12 +493,8 @@
533
493
  ],
534
494
  "verdict_when_failed": "compliance-theater"
535
495
  },
536
- "_gap_skip": {
537
- "fields": [
538
- "evidence_cves"
539
- ],
540
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
541
- }
496
+ "forward_looking": true,
497
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
542
498
  },
543
499
  "DORA-ITS-TLPT": {
544
500
  "framework": "EU DORA (Regulation 2022/2554) — ITS on threat-led penetration testing under Art. 26",
@@ -574,12 +530,8 @@
574
530
  ],
575
531
  "verdict_when_failed": "compliance-theater"
576
532
  },
577
- "_gap_skip": {
578
- "fields": [
579
- "evidence_cves"
580
- ],
581
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
582
- }
533
+ "forward_looking": true,
534
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
583
535
  },
584
536
  "DORA-RTS-Incident-Classification": {
585
537
  "framework": "EU DORA (Regulation 2022/2554) — RTS on classification of major ICT-related incidents under Art. 18(3)",
@@ -614,12 +566,8 @@
614
566
  ],
615
567
  "verdict_when_failed": "compliance-theater"
616
568
  },
617
- "_gap_skip": {
618
- "fields": [
619
- "evidence_cves"
620
- ],
621
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
622
- }
569
+ "forward_looking": true,
570
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
623
571
  },
624
572
  "DORA-IA-CTPP-Oversight": {
625
573
  "framework": "EU DORA (Regulation 2022/2554) — Implementing Acts for critical-third-party-provider (CTPP) oversight under Art. 31-44",
@@ -653,12 +601,8 @@
653
601
  ],
654
602
  "verdict_when_failed": "compliance-theater"
655
603
  },
656
- "_gap_skip": {
657
- "fields": [
658
- "evidence_cves"
659
- ],
660
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
661
- }
604
+ "forward_looking": true,
605
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
662
606
  },
663
607
  "EU-AI-Act-Art-15": {
664
608
  "framework": "EU Artificial Intelligence Act (2024/1689)",
@@ -727,12 +671,8 @@
727
671
  ],
728
672
  "verdict_when_failed": "compliance-theater"
729
673
  },
730
- "_gap_skip": {
731
- "fields": [
732
- "evidence_cves"
733
- ],
734
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
735
- }
674
+ "forward_looking": true,
675
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
736
676
  },
737
677
  "EU-AI-Act-Art-55-Systemic": {
738
678
  "framework": "EU Artificial Intelligence Act (2024/1689) — GPAI with systemic risk",
@@ -769,12 +709,8 @@
769
709
  ],
770
710
  "verdict_when_failed": "compliance-theater"
771
711
  },
772
- "_gap_skip": {
773
- "fields": [
774
- "evidence_cves"
775
- ],
776
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
777
- }
712
+ "forward_looking": true,
713
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
778
714
  },
779
715
  "EU-AI-Act-Annex-IX-Conformity": {
780
716
  "framework": "EU Artificial Intelligence Act (2024/1689) — Annex IX conformity assessment",
@@ -806,12 +742,8 @@
806
742
  ],
807
743
  "verdict_when_failed": "compliance-theater"
808
744
  },
809
- "_gap_skip": {
810
- "fields": [
811
- "evidence_cves"
812
- ],
813
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
814
- }
745
+ "forward_looking": true,
746
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
815
747
  },
816
748
  "EU-AI-Act-GPAI-CoP": {
817
749
  "framework": "EU Artificial Intelligence Act (2024/1689) — Code of Practice for GPAI",
@@ -844,12 +776,8 @@
844
776
  ],
845
777
  "verdict_when_failed": "compliance-theater"
846
778
  },
847
- "_gap_skip": {
848
- "fields": [
849
- "evidence_cves"
850
- ],
851
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
852
- }
779
+ "forward_looking": true,
780
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
853
781
  },
854
782
  "EU-CRA-Art13": {
855
783
  "framework": "EU Cyber Resilience Act (2024/2847)",
@@ -930,12 +858,8 @@
930
858
  ],
931
859
  "verdict_when_failed": "compliance-theater"
932
860
  },
933
- "_gap_skip": {
934
- "fields": [
935
- "evidence_cves"
936
- ],
937
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
938
- }
861
+ "forward_looking": true,
862
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
939
863
  },
940
864
  "HIPAA-Security-Rule-164.312(a)(1)": {
941
865
  "framework": "HIPAA Security Rule (45 CFR § 164.312)",
@@ -970,12 +894,8 @@
970
894
  ],
971
895
  "verdict_when_failed": "compliance-theater"
972
896
  },
973
- "_gap_skip": {
974
- "fields": [
975
- "evidence_cves"
976
- ],
977
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
978
- }
897
+ "forward_looking": true,
898
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
979
899
  },
980
900
  "HIPAA-Security-Rule-2026-NPRM-164.308": {
981
901
  "framework": "HIPAA Security Rule (45 CFR § 164.308) — 2026 Notice of Proposed Rulemaking",
@@ -1010,12 +930,8 @@
1010
930
  ],
1011
931
  "verdict_when_failed": "compliance-theater"
1012
932
  },
1013
- "_gap_skip": {
1014
- "fields": [
1015
- "evidence_cves"
1016
- ],
1017
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1018
- }
933
+ "forward_looking": true,
934
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1019
935
  },
1020
936
  "HIPAA-Security-Rule-2026-NPRM-164.310": {
1021
937
  "framework": "HIPAA Security Rule (45 CFR § 164.310) — 2026 Notice of Proposed Rulemaking",
@@ -1049,12 +965,8 @@
1049
965
  ],
1050
966
  "verdict_when_failed": "compliance-theater"
1051
967
  },
1052
- "_gap_skip": {
1053
- "fields": [
1054
- "evidence_cves"
1055
- ],
1056
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1057
- }
968
+ "forward_looking": true,
969
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1058
970
  },
1059
971
  "HIPAA-Security-Rule-2026-NPRM-164.312": {
1060
972
  "framework": "HIPAA Security Rule (45 CFR § 164.312) — 2026 Notice of Proposed Rulemaking",
@@ -1091,12 +1003,8 @@
1091
1003
  ],
1092
1004
  "verdict_when_failed": "compliance-theater"
1093
1005
  },
1094
- "_gap_skip": {
1095
- "fields": [
1096
- "evidence_cves"
1097
- ],
1098
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1099
- }
1006
+ "forward_looking": true,
1007
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1100
1008
  },
1101
1009
  "HIPAA-Security-Rule-2026-NPRM-164.314": {
1102
1010
  "framework": "HIPAA Security Rule (45 CFR § 164.314) — 2026 Notice of Proposed Rulemaking",
@@ -1130,12 +1038,8 @@
1130
1038
  ],
1131
1039
  "verdict_when_failed": "compliance-theater"
1132
1040
  },
1133
- "_gap_skip": {
1134
- "fields": [
1135
- "evidence_cves"
1136
- ],
1137
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1138
- }
1041
+ "forward_looking": true,
1042
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1139
1043
  },
1140
1044
  "HITRUST-CSF-v11.4-09.l": {
1141
1045
  "framework": "HITRUST CSF v11.4",
@@ -1169,12 +1073,8 @@
1169
1073
  ],
1170
1074
  "verdict_when_failed": "compliance-theater"
1171
1075
  },
1172
- "_gap_skip": {
1173
- "fields": [
1174
- "evidence_cves"
1175
- ],
1176
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1177
- }
1076
+ "forward_looking": true,
1077
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1178
1078
  },
1179
1079
  "IEC-62443-3-3": {
1180
1080
  "framework": "IEC 62443-3-3 (Industrial communication networks — security for IACS)",
@@ -1211,12 +1111,8 @@
1211
1111
  ],
1212
1112
  "verdict_when_failed": "compliance-theater"
1213
1113
  },
1214
- "_gap_skip": {
1215
- "fields": [
1216
- "evidence_cves"
1217
- ],
1218
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1219
- }
1114
+ "forward_looking": true,
1115
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1220
1116
  },
1221
1117
  "ISO-27001-2022-A.8.16": {
1222
1118
  "framework": "ISO/IEC 27001:2022",
@@ -1249,12 +1145,8 @@
1249
1145
  ],
1250
1146
  "verdict_when_failed": "compliance-theater"
1251
1147
  },
1252
- "_gap_skip": {
1253
- "fields": [
1254
- "evidence_cves"
1255
- ],
1256
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1257
- }
1148
+ "forward_looking": true,
1149
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1258
1150
  },
1259
1151
  "ISO-27001-2022-A.8.22": {
1260
1152
  "framework": "ISO/IEC 27001:2022",
@@ -1680,12 +1572,8 @@
1680
1572
  ],
1681
1573
  "verdict_when_failed": "compliance-theater"
1682
1574
  },
1683
- "_gap_skip": {
1684
- "fields": [
1685
- "evidence_cves"
1686
- ],
1687
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1688
- }
1575
+ "forward_looking": true,
1576
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1689
1577
  },
1690
1578
  "ISO-IEC-42001-2023-clause-6.1.2": {
1691
1579
  "framework": "ISO/IEC 42001:2023 (AI Management System)",
@@ -1721,12 +1609,8 @@
1721
1609
  ],
1722
1610
  "verdict_when_failed": "compliance-theater"
1723
1611
  },
1724
- "_gap_skip": {
1725
- "fields": [
1726
- "evidence_cves"
1727
- ],
1728
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1729
- }
1612
+ "forward_looking": true,
1613
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1730
1614
  },
1731
1615
  "NERC-CIP-007-6-R4": {
1732
1616
  "framework": "NERC CIP-007-6 (BES Cyber System Security Management)",
@@ -1763,12 +1647,8 @@
1763
1647
  ],
1764
1648
  "verdict_when_failed": "compliance-theater"
1765
1649
  },
1766
- "_gap_skip": {
1767
- "fields": [
1768
- "evidence_cves"
1769
- ],
1770
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1771
- }
1650
+ "forward_looking": true,
1651
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1772
1652
  },
1773
1653
  "NIS2-Art21-incident-handling": {
1774
1654
  "framework": "EU NIS2 Directive (2022/2555)",
@@ -1887,12 +1767,8 @@
1887
1767
  ],
1888
1768
  "verdict_when_failed": "compliance-theater"
1889
1769
  },
1890
- "_gap_skip": {
1891
- "fields": [
1892
- "evidence_cves"
1893
- ],
1894
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1895
- }
1770
+ "forward_looking": true,
1771
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
1896
1772
  },
1897
1773
  "NIST-800-218-SSDF": {
1898
1774
  "framework": "NIST SP 800-218 (Secure Software Development Framework v1.1)",
@@ -2284,12 +2160,8 @@
2284
2160
  ],
2285
2161
  "verdict_when_failed": "compliance-theater"
2286
2162
  },
2287
- "_gap_skip": {
2288
- "fields": [
2289
- "evidence_cves"
2290
- ],
2291
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2292
- }
2163
+ "forward_looking": true,
2164
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2293
2165
  },
2294
2166
  "NIST-800-53-SI-2": {
2295
2167
  "framework": "NIST SP 800-53 Rev 5",
@@ -2696,12 +2568,8 @@
2696
2568
  ],
2697
2569
  "verdict_when_failed": "compliance-theater"
2698
2570
  },
2699
- "_gap_skip": {
2700
- "fields": [
2701
- "evidence_cves"
2702
- ],
2703
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2704
- }
2571
+ "forward_looking": true,
2572
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2705
2573
  },
2706
2574
  "NIST-800-82r3": {
2707
2575
  "framework": "NIST SP 800-82 Rev 3 (Guide to OT Security)",
@@ -2738,12 +2606,8 @@
2738
2606
  ],
2739
2607
  "verdict_when_failed": "compliance-theater"
2740
2608
  },
2741
- "_gap_skip": {
2742
- "fields": [
2743
- "evidence_cves"
2744
- ],
2745
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2746
- }
2609
+ "forward_looking": true,
2610
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2747
2611
  },
2748
2612
  "NIST-AI-RMF-MAP-3.4": {
2749
2613
  "framework": "NIST AI RMF 1.0",
@@ -2810,12 +2674,8 @@
2810
2674
  ],
2811
2675
  "verdict_when_failed": "compliance-theater"
2812
2676
  },
2813
- "_gap_skip": {
2814
- "fields": [
2815
- "evidence_cves"
2816
- ],
2817
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2818
- }
2677
+ "forward_looking": true,
2678
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2819
2679
  },
2820
2680
  "OWASP-ASVS-v5.0-V14": {
2821
2681
  "framework": "OWASP ASVS v5.0",
@@ -2849,12 +2709,8 @@
2849
2709
  ],
2850
2710
  "verdict_when_failed": "compliance-theater"
2851
2711
  },
2852
- "_gap_skip": {
2853
- "fields": [
2854
- "evidence_cves"
2855
- ],
2856
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2857
- }
2712
+ "forward_looking": true,
2713
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2858
2714
  },
2859
2715
  "OWASP-LLM-Top-10-2025-LLM01": {
2860
2716
  "framework": "OWASP Top 10 for LLM Applications 2025",
@@ -2926,12 +2782,8 @@
2926
2782
  ],
2927
2783
  "verdict_when_failed": "compliance-theater"
2928
2784
  },
2929
- "_gap_skip": {
2930
- "fields": [
2931
- "evidence_cves"
2932
- ],
2933
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2934
- }
2785
+ "forward_looking": true,
2786
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2935
2787
  },
2936
2788
  "OWASP-LLM-Top-10-2025-LLM06": {
2937
2789
  "framework": "OWASP Top 10 for LLM Applications 2025",
@@ -2967,12 +2819,8 @@
2967
2819
  ],
2968
2820
  "verdict_when_failed": "compliance-theater"
2969
2821
  },
2970
- "_gap_skip": {
2971
- "fields": [
2972
- "evidence_cves"
2973
- ],
2974
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2975
- }
2822
+ "forward_looking": true,
2823
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
2976
2824
  },
2977
2825
  "OWASP-LLM-Top-10-2025-LLM08": {
2978
2826
  "framework": "OWASP Top 10 for LLM Applications 2025",
@@ -3009,12 +2857,8 @@
3009
2857
  ],
3010
2858
  "verdict_when_failed": "compliance-theater"
3011
2859
  },
3012
- "_gap_skip": {
3013
- "fields": [
3014
- "evidence_cves"
3015
- ],
3016
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3017
- }
2860
+ "forward_looking": true,
2861
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3018
2862
  },
3019
2863
  "OWASP-Pen-Testing-Guide-v5": {
3020
2864
  "framework": "OWASP Web Security Testing Guide v5 (WSTG)",
@@ -3053,12 +2897,8 @@
3053
2897
  ],
3054
2898
  "verdict_when_failed": "compliance-theater"
3055
2899
  },
3056
- "_gap_skip": {
3057
- "fields": [
3058
- "evidence_cves"
3059
- ],
3060
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3061
- }
2900
+ "forward_looking": true,
2901
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3062
2902
  },
3063
2903
  "OWASP-Top-10-2021-A06": {
3064
2904
  "framework": "OWASP Top 10 (2021)",
@@ -3163,12 +3003,8 @@
3163
3003
  ],
3164
3004
  "verdict_when_failed": "compliance-theater"
3165
3005
  },
3166
- "_gap_skip": {
3167
- "fields": [
3168
- "evidence_cves"
3169
- ],
3170
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3171
- }
3006
+ "forward_looking": true,
3007
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3172
3008
  },
3173
3009
  "PCI-DSS-4.0.1-11.6.1": {
3174
3010
  "framework": "PCI DSS 4.0.1 (effective 2025-03-31)",
@@ -3201,12 +3037,8 @@
3201
3037
  ],
3202
3038
  "verdict_when_failed": "compliance-theater"
3203
3039
  },
3204
- "_gap_skip": {
3205
- "fields": [
3206
- "evidence_cves"
3207
- ],
3208
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3209
- }
3040
+ "forward_looking": true,
3041
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3210
3042
  },
3211
3043
  "PCI-DSS-4.0.1-12.3.3": {
3212
3044
  "framework": "PCI DSS 4.0.1 (effective 2025-03-31)",
@@ -3238,12 +3070,8 @@
3238
3070
  ],
3239
3071
  "verdict_when_failed": "compliance-theater"
3240
3072
  },
3241
- "_gap_skip": {
3242
- "fields": [
3243
- "evidence_cves"
3244
- ],
3245
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3246
- }
3073
+ "forward_looking": true,
3074
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3247
3075
  },
3248
3076
  "PCI-DSS-4.0.1-12.10.7": {
3249
3077
  "framework": "PCI DSS 4.0.1 (effective 2025-03-31)",
@@ -3278,12 +3106,8 @@
3278
3106
  ],
3279
3107
  "verdict_when_failed": "compliance-theater"
3280
3108
  },
3281
- "_gap_skip": {
3282
- "fields": [
3283
- "evidence_cves"
3284
- ],
3285
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3286
- }
3109
+ "forward_looking": true,
3110
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3287
3111
  },
3288
3112
  "PSD2-RTS-SCA": {
3289
3113
  "framework": "EU PSD2 Regulatory Technical Standards on Strong Customer Authentication (Commission Delegated Regulation (EU) 2018/389)",
@@ -3318,12 +3142,8 @@
3318
3142
  ],
3319
3143
  "verdict_when_failed": "compliance-theater"
3320
3144
  },
3321
- "_gap_skip": {
3322
- "fields": [
3323
- "evidence_cves"
3324
- ],
3325
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3326
- }
3145
+ "forward_looking": true,
3146
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3327
3147
  },
3328
3148
  "PTES-Pre-engagement": {
3329
3149
  "framework": "Penetration Testing Execution Standard (PTES)",
@@ -3359,12 +3179,8 @@
3359
3179
  ],
3360
3180
  "verdict_when_failed": "compliance-theater"
3361
3181
  },
3362
- "_gap_skip": {
3363
- "fields": [
3364
- "evidence_cves"
3365
- ],
3366
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3367
- }
3182
+ "forward_looking": true,
3183
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3368
3184
  },
3369
3185
  "SLSA-v1.0-Build-L3": {
3370
3186
  "framework": "SLSA v1.0 (Supply-chain Levels for Software Artifacts) — Build Track",
@@ -3505,12 +3321,8 @@
3505
3321
  ],
3506
3322
  "verdict_when_failed": "compliance-theater"
3507
3323
  },
3508
- "_gap_skip": {
3509
- "fields": [
3510
- "evidence_cves"
3511
- ],
3512
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3513
- }
3324
+ "forward_looking": true,
3325
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3514
3326
  },
3515
3327
  "SOC2-CC9-vendor-management": {
3516
3328
  "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -3579,12 +3391,8 @@
3579
3391
  ],
3580
3392
  "verdict_when_failed": "compliance-theater"
3581
3393
  },
3582
- "_gap_skip": {
3583
- "fields": [
3584
- "evidence_cves"
3585
- ],
3586
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3587
- }
3394
+ "forward_looking": true,
3395
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3588
3396
  },
3589
3397
  "SWIFT-CSCF-v2026-1.1": {
3590
3398
  "framework": "SWIFT Customer Security Controls Framework v2026",
@@ -3620,12 +3428,8 @@
3620
3428
  ],
3621
3429
  "verdict_when_failed": "compliance-theater"
3622
3430
  },
3623
- "_gap_skip": {
3624
- "fields": [
3625
- "evidence_cves"
3626
- ],
3627
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3628
- }
3431
+ "forward_looking": true,
3432
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3629
3433
  },
3630
3434
  "UK-CAF-A1": {
3631
3435
  "framework": "UK NCSC Cyber Assessment Framework v3.2",
@@ -3655,12 +3459,8 @@
3655
3459
  ],
3656
3460
  "verdict_when_failed": "compliance-theater"
3657
3461
  },
3658
- "_gap_skip": {
3659
- "fields": [
3660
- "evidence_cves"
3661
- ],
3662
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3663
- }
3462
+ "forward_looking": true,
3463
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3664
3464
  },
3665
3465
  "UK-CAF-B2": {
3666
3466
  "framework": "UK NCSC Cyber Assessment Framework v3.2",
@@ -3693,12 +3493,8 @@
3693
3493
  ],
3694
3494
  "verdict_when_failed": "compliance-theater"
3695
3495
  },
3696
- "_gap_skip": {
3697
- "fields": [
3698
- "evidence_cves"
3699
- ],
3700
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3701
- }
3496
+ "forward_looking": true,
3497
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3702
3498
  },
3703
3499
  "UK-CAF-C1": {
3704
3500
  "framework": "UK NCSC Cyber Assessment Framework v3.2",
@@ -3732,12 +3528,8 @@
3732
3528
  ],
3733
3529
  "verdict_when_failed": "compliance-theater"
3734
3530
  },
3735
- "_gap_skip": {
3736
- "fields": [
3737
- "evidence_cves"
3738
- ],
3739
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3740
- }
3531
+ "forward_looking": true,
3532
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3741
3533
  },
3742
3534
  "UK-CAF-D1": {
3743
3535
  "framework": "UK NCSC Cyber Assessment Framework v3.2",
@@ -3767,12 +3559,8 @@
3767
3559
  ],
3768
3560
  "verdict_when_failed": "compliance-theater"
3769
3561
  },
3770
- "_gap_skip": {
3771
- "fields": [
3772
- "evidence_cves"
3773
- ],
3774
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3775
- }
3562
+ "forward_looking": true,
3563
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3776
3564
  },
3777
3565
  "VEX-CSAF-v2.1": {
3778
3566
  "framework": "VEX via OASIS CSAF 2.1 (Common Security Advisory Framework)",
@@ -3806,12 +3594,8 @@
3806
3594
  ],
3807
3595
  "verdict_when_failed": "compliance-theater"
3808
3596
  },
3809
- "_gap_skip": {
3810
- "fields": [
3811
- "evidence_cves"
3812
- ],
3813
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3814
- }
3597
+ "forward_looking": true,
3598
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3815
3599
  },
3816
3600
  "FCC-CPNI-4.1": {
3817
3601
  "framework": "FCC-CPNI",
@@ -3846,12 +3630,8 @@
3846
3630
  ],
3847
3631
  "verdict_when_failed": "compliance-theater"
3848
3632
  },
3849
- "_gap_skip": {
3850
- "fields": [
3851
- "evidence_cves"
3852
- ],
3853
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3854
- }
3633
+ "forward_looking": true,
3634
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3855
3635
  },
3856
3636
  "FCC-Cyber-Incident-Notification-2024": {
3857
3637
  "framework": "FCC",
@@ -3883,12 +3663,8 @@
3883
3663
  ],
3884
3664
  "verdict_when_failed": "compliance-theater"
3885
3665
  },
3886
- "_gap_skip": {
3887
- "fields": [
3888
- "evidence_cves"
3889
- ],
3890
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3891
- }
3666
+ "forward_looking": true,
3667
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3892
3668
  },
3893
3669
  "NIS2-Annex-I-Telecom": {
3894
3670
  "framework": "NIS2",
@@ -3923,12 +3699,8 @@
3923
3699
  ],
3924
3700
  "verdict_when_failed": "compliance-theater"
3925
3701
  },
3926
- "_gap_skip": {
3927
- "fields": [
3928
- "evidence_cves"
3929
- ],
3930
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3931
- }
3702
+ "forward_looking": true,
3703
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3932
3704
  },
3933
3705
  "DORA-Art-21-Telecom-ICT": {
3934
3706
  "framework": "DORA",
@@ -3959,12 +3731,8 @@
3959
3731
  ],
3960
3732
  "verdict_when_failed": "compliance-theater"
3961
3733
  },
3962
- "_gap_skip": {
3963
- "fields": [
3964
- "evidence_cves"
3965
- ],
3966
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3967
- }
3734
+ "forward_looking": true,
3735
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
3968
3736
  },
3969
3737
  "UK-CAF-B5": {
3970
3738
  "framework": "UK-CAF",
@@ -3996,12 +3764,8 @@
3996
3764
  ],
3997
3765
  "verdict_when_failed": "compliance-theater"
3998
3766
  },
3999
- "_gap_skip": {
4000
- "fields": [
4001
- "evidence_cves"
4002
- ],
4003
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4004
- }
3767
+ "forward_looking": true,
3768
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4005
3769
  },
4006
3770
  "AU-ISM-1556": {
4007
3771
  "framework": "au-ism",
@@ -4033,12 +3797,8 @@
4033
3797
  ],
4034
3798
  "verdict_when_failed": "compliance-theater"
4035
3799
  },
4036
- "_gap_skip": {
4037
- "fields": [
4038
- "evidence_cves"
4039
- ],
4040
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4041
- }
3800
+ "forward_looking": true,
3801
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4042
3802
  },
4043
3803
  "GSMA-NESAS-Deployment": {
4044
3804
  "framework": "GSMA-NESAS",
@@ -4069,12 +3829,8 @@
4069
3829
  ],
4070
3830
  "verdict_when_failed": "compliance-theater"
4071
3831
  },
4072
- "_gap_skip": {
4073
- "fields": [
4074
- "evidence_cves"
4075
- ],
4076
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4077
- }
3832
+ "forward_looking": true,
3833
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4078
3834
  },
4079
3835
  "3GPP-TR-33.926": {
4080
3836
  "framework": "3GPP",
@@ -4105,12 +3861,8 @@
4105
3861
  ],
4106
3862
  "verdict_when_failed": "compliance-theater"
4107
3863
  },
4108
- "_gap_skip": {
4109
- "fields": [
4110
- "evidence_cves"
4111
- ],
4112
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4113
- }
3864
+ "forward_looking": true,
3865
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4114
3866
  },
4115
3867
  "ITU-T-X.805": {
4116
3868
  "framework": "ITU-T",
@@ -4141,12 +3893,8 @@
4141
3893
  ],
4142
3894
  "verdict_when_failed": "compliance-theater"
4143
3895
  },
4144
- "_gap_skip": {
4145
- "fields": [
4146
- "evidence_cves"
4147
- ],
4148
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4149
- }
3896
+ "forward_looking": true,
3897
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4150
3898
  },
4151
3899
  "NIST-800-53-IA-5-Federated": {
4152
3900
  "framework": "NIST 800-53 Rev.5",
@@ -4210,12 +3958,8 @@
4210
3958
  ],
4211
3959
  "verdict_when_failed": "compliance-theater"
4212
3960
  },
4213
- "_gap_skip": {
4214
- "fields": [
4215
- "evidence_cves"
4216
- ],
4217
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4218
- }
3961
+ "forward_looking": true,
3962
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4219
3963
  },
4220
3964
  "SOC2-CC6-OAuth-Consent": {
4221
3965
  "framework": "SOC 2 (AICPA Trust Services Criteria)",
@@ -4245,12 +3989,8 @@
4245
3989
  ],
4246
3990
  "verdict_when_failed": "compliance-theater"
4247
3991
  },
4248
- "_gap_skip": {
4249
- "fields": [
4250
- "evidence_cves"
4251
- ],
4252
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4253
- }
3992
+ "forward_looking": true,
3993
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4254
3994
  },
4255
3995
  "UK-CAF-B2-IdP-Tenant": {
4256
3996
  "framework": "UK NCSC CAF",
@@ -4282,12 +4022,8 @@
4282
4022
  ],
4283
4023
  "verdict_when_failed": "compliance-theater"
4284
4024
  },
4285
- "_gap_skip": {
4286
- "fields": [
4287
- "evidence_cves"
4288
- ],
4289
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4290
- }
4025
+ "forward_looking": true,
4026
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4291
4027
  },
4292
4028
  "AU-ISM-1559-IdP": {
4293
4029
  "framework": "AU ISM",
@@ -4318,12 +4054,8 @@
4318
4054
  ],
4319
4055
  "verdict_when_failed": "compliance-theater"
4320
4056
  },
4321
- "_gap_skip": {
4322
- "fields": [
4323
- "evidence_cves"
4324
- ],
4325
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4326
- }
4057
+ "forward_looking": true,
4058
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4327
4059
  },
4328
4060
  "NIS2-Art-21-Federated-Identity": {
4329
4061
  "framework": "EU NIS2 Directive",
@@ -4355,12 +4087,8 @@
4355
4087
  ],
4356
4088
  "verdict_when_failed": "compliance-theater"
4357
4089
  },
4358
- "_gap_skip": {
4359
- "fields": [
4360
- "evidence_cves"
4361
- ],
4362
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4363
- }
4090
+ "forward_looking": true,
4091
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4364
4092
  },
4365
4093
  "DORA-Art-19-IdP-4h": {
4366
4094
  "framework": "EU DORA",
@@ -4391,12 +4119,8 @@
4391
4119
  ],
4392
4120
  "verdict_when_failed": "compliance-theater"
4393
4121
  },
4394
- "_gap_skip": {
4395
- "fields": [
4396
- "evidence_cves"
4397
- ],
4398
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4399
- }
4122
+ "forward_looking": true,
4123
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4400
4124
  },
4401
4125
  "OFAC-Sanctions-Threat-Actor-Negotiation": {
4402
4126
  "framework": "US Treasury OFAC + EU sanctions overlay + UK OFSI",
@@ -4427,12 +4151,8 @@
4427
4151
  ],
4428
4152
  "verdict_when_failed": "compliance-theater"
4429
4153
  },
4430
- "_gap_skip": {
4431
- "fields": [
4432
- "evidence_cves"
4433
- ],
4434
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4435
- }
4154
+ "forward_looking": true,
4155
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4436
4156
  },
4437
4157
  "FedRAMP-IL5-IAM-Federated": {
4438
4158
  "framework": "FedRAMP (US)",
@@ -4467,12 +4187,8 @@
4467
4187
  ],
4468
4188
  "verdict_when_failed": "compliance-theater"
4469
4189
  },
4470
- "_gap_skip": {
4471
- "fields": [
4472
- "evidence_cves"
4473
- ],
4474
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4475
- }
4190
+ "forward_looking": true,
4191
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4476
4192
  },
4477
4193
  "CISA-Snowflake-AA24-IdP-Cloud": {
4478
4194
  "framework": "CISA (US) - Cross-framework advisory",
@@ -4507,12 +4223,8 @@
4507
4223
  ],
4508
4224
  "verdict_when_failed": "compliance-theater"
4509
4225
  },
4510
- "_gap_skip": {
4511
- "fields": [
4512
- "evidence_cves"
4513
- ],
4514
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4515
- }
4226
+ "forward_looking": true,
4227
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4516
4228
  },
4517
4229
  "NIST-800-53-AC-2-Cross-Account": {
4518
4230
  "framework": "NIST 800-53 Rev 5",
@@ -4547,12 +4259,8 @@
4547
4259
  ],
4548
4260
  "verdict_when_failed": "compliance-theater"
4549
4261
  },
4550
- "_gap_skip": {
4551
- "fields": [
4552
- "evidence_cves"
4553
- ],
4554
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4555
- }
4262
+ "forward_looking": true,
4263
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4556
4264
  },
4557
4265
  "ISO-27017-Cloud-IAM": {
4558
4266
  "framework": "ISO/IEC 27017:2015",
@@ -4585,12 +4293,8 @@
4585
4293
  ],
4586
4294
  "verdict_when_failed": "compliance-theater"
4587
4295
  },
4588
- "_gap_skip": {
4589
- "fields": [
4590
- "evidence_cves"
4591
- ],
4592
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4593
- }
4296
+ "forward_looking": true,
4297
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4594
4298
  },
4595
4299
  "SOC2-CC6-Access-Key-Leak-Public-Repo": {
4596
4300
  "framework": "AICPA SOC 2 Trust Services Criteria",
@@ -4623,12 +4327,8 @@
4623
4327
  ],
4624
4328
  "verdict_when_failed": "compliance-theater"
4625
4329
  },
4626
- "_gap_skip": {
4627
- "fields": [
4628
- "evidence_cves"
4629
- ],
4630
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4631
- }
4330
+ "forward_looking": true,
4331
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4632
4332
  },
4633
4333
  "AWS-Security-Hub-Coverage-Gap": {
4634
4334
  "framework": "AWS Security Hub Foundational Security Best Practices (also GCP SCC, Azure Defender for Cloud)",
@@ -4663,12 +4363,8 @@
4663
4363
  ],
4664
4364
  "verdict_when_failed": "compliance-theater"
4665
4365
  },
4666
- "_gap_skip": {
4667
- "fields": [
4668
- "evidence_cves"
4669
- ],
4670
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4671
- }
4366
+ "forward_looking": true,
4367
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4672
4368
  },
4673
4369
  "UK-CAF-B2-Cloud-IAM": {
4674
4370
  "framework": "UK NCSC CAF (Cyber Assessment Framework) v3.x",
@@ -4701,12 +4397,8 @@
4701
4397
  ],
4702
4398
  "verdict_when_failed": "compliance-theater"
4703
4399
  },
4704
- "_gap_skip": {
4705
- "fields": [
4706
- "evidence_cves"
4707
- ],
4708
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4709
- }
4400
+ "forward_looking": true,
4401
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4710
4402
  },
4711
4403
  "AU-ISM-1546-Cloud-Service-Account": {
4712
4404
  "framework": "ACSC ISM (Australian Government Information Security Manual)",
@@ -4739,12 +4431,8 @@
4739
4431
  ],
4740
4432
  "verdict_when_failed": "compliance-theater"
4741
4433
  },
4742
- "_gap_skip": {
4743
- "fields": [
4744
- "evidence_cves"
4745
- ],
4746
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4747
- }
4434
+ "forward_looking": true,
4435
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4748
4436
  },
4749
4437
  "OFAC-SDN-Payment-Block": {
4750
4438
  "framework": "ALL",
@@ -4775,12 +4463,8 @@
4775
4463
  ],
4776
4464
  "verdict_when_failed": "compliance-theater"
4777
4465
  },
4778
- "_gap_skip": {
4779
- "fields": [
4780
- "evidence_cves"
4781
- ],
4782
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4783
- }
4466
+ "forward_looking": true,
4467
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4784
4468
  },
4785
4469
  "Insurance-Carrier-24h-Notification": {
4786
4470
  "framework": "ALL",
@@ -4812,12 +4496,8 @@
4812
4496
  ],
4813
4497
  "verdict_when_failed": "compliance-theater"
4814
4498
  },
4815
- "_gap_skip": {
4816
- "fields": [
4817
- "evidence_cves"
4818
- ],
4819
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4820
- }
4499
+ "forward_looking": true,
4500
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4821
4501
  },
4822
4502
  "EU-Sanctions-Reg-2014-833-Cyber": {
4823
4503
  "framework": "EU",
@@ -4848,12 +4528,8 @@
4848
4528
  ],
4849
4529
  "verdict_when_failed": "compliance-theater"
4850
4530
  },
4851
- "_gap_skip": {
4852
- "fields": [
4853
- "evidence_cves"
4854
- ],
4855
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4856
- }
4531
+ "forward_looking": true,
4532
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4857
4533
  },
4858
4534
  "Immutable-Backup-Recovery": {
4859
4535
  "framework": "ALL",
@@ -4885,12 +4561,8 @@
4885
4561
  ],
4886
4562
  "verdict_when_failed": "compliance-theater"
4887
4563
  },
4888
- "_gap_skip": {
4889
- "fields": [
4890
- "evidence_cves"
4891
- ],
4892
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4893
- }
4564
+ "forward_looking": true,
4565
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4894
4566
  },
4895
4567
  "Decryptor-Availability-Pre-Decision": {
4896
4568
  "framework": "ALL",
@@ -4922,12 +4594,8 @@
4922
4594
  ],
4923
4595
  "verdict_when_failed": "compliance-theater"
4924
4596
  },
4925
- "_gap_skip": {
4926
- "fields": [
4927
- "evidence_cves"
4928
- ],
4929
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4930
- }
4597
+ "forward_looking": true,
4598
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4931
4599
  },
4932
4600
  "PHI-Exfil-Before-Encrypt-Breach-Class": {
4933
4601
  "framework": "ALL",
@@ -4960,12 +4628,8 @@
4960
4628
  ],
4961
4629
  "verdict_when_failed": "compliance-theater"
4962
4630
  },
4963
- "_gap_skip": {
4964
- "fields": [
4965
- "evidence_cves"
4966
- ],
4967
- "reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4968
- }
4631
+ "forward_looking": true,
4632
+ "forward_looking_reason": "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident"
4969
4633
  },
4970
4634
  "NIS2-Art21-vulnerability-management": {
4971
4635
  "framework": "EU NIS2 Directive (2022/2555)",