@clear-capabilities/agentic-security-scanner 0.147.0 → 0.148.0

package/dist/compliance-frameworks/nist-800-171-r3.json

@@ -0,0 +1,1269 @@
+{
+  "id": "nist-800-171-r3",
+  "name": "NIST SP 800-171 Rev. 3 — Protecting CUI in Nonfederal Systems",
+  "publisher": "NIST",
+  "license": "public-domain (US Federal publication)",
+  "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final",
+  "note": "Control text is generated from docs/standards/NIST_SP_800_171r3_Controls.csv by scripts/nist-800-171/build-catalog.py. The codeTestable rating is THIS ENGINE'S judgment, not NIST's. Unlike the AI 600-1 workbook, the 800-171 export rates no control for testability. Ratings and their rationales live in scripts/nist-800-171/code-testability.json.",
+  "scope": "FULL CATALOGUE — all 97 requirements of NIST SP 800-171 Rev. 3 are carried, deliberately including those this engine cannot assess, because omitting them would read as coverage. Automated evidence is PARTIAL and unevenly distributed: 16 requirements are rated code-testable, 38 partial, and 43 are organisational, physical or personnel controls NOT represented by any automated signal: all of Awareness and Training, Personnel Security and Physical Protection, and most of Incident Response, Maintenance and Media Protection. Those are forced to 'partial' with an explicit disclosure and can never read as satisfied. This is not a CMMC assessment and produces no SPRS score.",
+  "controlsDigest": "28e4a38c393e1457",
+  "controlCount": 97,
+  "controls": [
+    {
+      "id": "03.01.01",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Account Management: a. Define the types of system accounts allowed and prohibited. b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. c.…",
+      "codeTestable": "partial",
+      "evidence": [
+        "No automated signal in this engine, Auth wiring is visible in code; account creation/approval/notification lifecycle is a process no scanner observes.",
+        "Reported as an engine gap: this requirement is code-observable in principle, but no detector here decides it."
+      ]
+    },
+    {
+      "id": "03.01.02",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Access Enforcement: Enforce approved authorizations for logical access to CUI and system resources in accordance with applicable access control policies.",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: broken-access-control, idor, springboot-missing-authz, authz-matrix-inconsistency, mass-assignment."
+      ],
+      "mapsTo": [
+        "family:broken-access-control",
+        "family:idor",
+        "family:springboot-missing-authz",
+        "family:authz-matrix-inconsistency",
+        "family:mass-assignment"
+      ]
+    },
+    {
+      "id": "03.01.03",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Information Flow Enforcement: Enforce approved authorizations for controlling the flow of CUI within the system and between connected systems.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: ssrf, open-redirect, permissive-cors-allow-origin."
+      ],
+      "mapsTo": [
+        "family:ssrf",
+        "family:open-redirect",
+        "family:permissive-cors-allow-origin"
+      ]
+    },
+    {
+      "id": "03.01.04",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Separation of Duties: a. Identify the duties of individuals requiring separation. b. Define system access authorizations to support separation of duties.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Separation of duties is an organisational role-design decision.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.01.05",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Least Privilege: a. Allow only authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. b. Authorize access to [Assignment:…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: k8s-rbac-cluster-admin, k8s-rbac-wildcard, k8s-rbac-overbroad-binding, terraform-iam-action-wildcard, k8s-pod-security-privileged."
+      ],
+      "mapsTo": [
+        "family:k8s-rbac-cluster-admin",
+        "family:k8s-rbac-wildcard",
+        "family:k8s-rbac-overbroad-binding",
+        "family:terraform-iam-action-wildcard",
+        "family:k8s-pod-security-privileged"
+      ]
+    },
+    {
+      "id": "03.01.06",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Least Privilege - Privileged Accounts: a. Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles]. b. Require that users (or roles) with privileged accounts use non-privileged accounts when…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: k8s-rbac-cluster-admin, terraform-iam-action-wildcard."
+      ],
+      "mapsTo": [
+        "family:k8s-rbac-cluster-admin",
+        "family:terraform-iam-action-wildcard"
+      ]
+    },
+    {
+      "id": "03.01.07",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Least Privilege - Privileged Functions: a. Prevent non-privileged users from executing privileged functions. b. Log the execution of privileged functions.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: broken-access-control, k8s-pod-security-allow-privesc."
+      ],
+      "mapsTo": [
+        "family:broken-access-control",
+        "family:k8s-pod-security-allow-privesc"
+      ]
+    },
+    {
+      "id": "03.01.08",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Unsuccessful Logon Attempts: a. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period]. b. Automatically [Selection: lock…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: auth-endpoint-missing-rate-limiting."
+      ],
+      "mapsTo": [
+        "family:auth-endpoint-missing-rate-limiting"
+      ]
+    },
+    {
+      "id": "03.01.09",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "System Use Notification: Display a system use notification message with privacy and security notices consistent with applicable CUI rules before granting access to the system.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Presence and wording of a system-use banner is a deployment/UI policy matter.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.01.10",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Device Lock: a. Prevent access to the system by [Selection: initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Device lock is an endpoint OS configuration.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.01.11",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Session Termination: Terminate a user session automatically after [Assignment: organization-defined conditions or trigger events requiring session disconnect].",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: jwt-no-exp."
+      ],
+      "mapsTo": [
+        "family:jwt-no-exp"
+      ]
+    },
+    {
+      "id": "03.01.12",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Remote Access: a. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access. b. Authorize each type of remote system access prior to…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: insecure-http, crypto-tls-version, crypto-tls-no-verify."
+      ],
+      "mapsTo": [
+        "family:insecure-http",
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify"
+      ]
+    },
+    {
+      "id": "03.01.16",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Wireless Access: a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system. b. Authorize each type of wireless access to the system prior…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Wireless configuration is network infrastructure.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.01.18",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Access Control for Mobile Devices: a. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices. b. Authorize the connection of mobile devices to the system. c. Implement full-device or…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: swift-insecure-storage, dart-insecure-storage, swift-webview-unsafe, dart-webview-unsafe, ios-webview-untrusted-url."
+      ],
+      "mapsTo": [
+        "family:swift-insecure-storage",
+        "family:dart-insecure-storage",
+        "family:swift-webview-unsafe",
+        "family:dart-webview-unsafe",
+        "family:ios-webview-untrusted-url"
+      ]
+    },
+    {
+      "id": "03.01.20",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Use of External Systems: a. Prohibit the use of external systems unless the systems are specifically authorized. b. Establish the following security requirements to be satisfied on external systems prior to allowing use of…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Authorization of external systems is a contractual and organisational control.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.01.22",
+      "function": "Access Control",
+      "category": "03.01 Access Control",
+      "summary": "Publicly Accessible Content: a. Train authorized individuals to ensure that publicly accessible information does not contain CUI. b. Review the content on publicly accessible systems for CUI and remove such information, if…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: aws-public-s3, terraform-s3-bucket-acl-public-read."
+      ],
+      "mapsTo": [
+        "family:aws-public-s3",
+        "family:terraform-s3-bucket-acl-public-read"
+      ]
+    },
+    {
+      "id": "03.02.01",
+      "function": "Awareness and Training",
+      "category": "03.02 Awareness and Training",
+      "summary": "Literacy Training and Awareness: a. Provide security literacy training to system users: 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter, 2. When required by system changes or…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Security literacy training is delivered to people, not code.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.02.02",
+      "function": "Awareness and Training",
+      "category": "03.02 Awareness and Training",
+      "summary": "Role-Based Training: a. Provide role-based security training to organizational personnel: 1. Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Role-based training is delivered to people, not code.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.01",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Event Logging: a. Specify the following event types selected for logging within the system: [Assignment: organization-defined event types]. b. Review and update the event types selected for logging [Assignment:…",
+      "codeTestable": "partial",
+      "evidence": [
+        "No automated signal in this engine, No detector decides which event types a customer system logs; only the surrounding scan history is observable.",
+        "Reported as an engine gap: this requirement is code-observable in principle, but no detector here decides it."
+      ]
+    },
+    {
+      "id": "03.03.02",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Audit Record Content: a. Include the following content in audit records: 1. What type of event occurred, 2. When the event occurred, 3. Where the event occurred, 4. Source of the event, 5. Outcome of the event, 6.…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Audit record content fields are a logging-schema decision no detector inspects.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.03",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Audit Record Generation: a. Generate audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02. b. Retain audit records for a time period consistent with the records retention…",
+      "codeTestable": "partial",
+      "evidence": [
+        "No automated signal in this engine, Audit record generation and retention are runtime properties this engine does not observe.",
+        "Reported as an engine gap: this requirement is code-observable in principle, but no detector here decides it."
+      ]
+    },
+    {
+      "id": "03.03.04",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Response to Audit Logging Process Failures: a. Alert organizational personnel or roles within [Assignment: organization-defined time period] in the event of an audit logging process failure. b. Take the following additional actions:…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Alerting on audit-logging failure is an operational runbook control.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.05",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Audit Record Review, Analysis, and Reporting: a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications and the potential impact of inappropriate or unusual activity. b. Report findings to…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Human review and correlation of audit records.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.06",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Audit Record Reduction and Report Generation: a. Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents. b.…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Audit reduction and reporting is a SIEM capability.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.07",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Time Stamps: a. Use internal system clocks to generate time stamps for audit records. b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, System clock and timestamp granularity are host configuration.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.03.08",
+      "function": "Audit and Accountability",
+      "category": "03.03 Audit and Accountability",
+      "summary": "Protection of Audit Information: a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. b. Authorize access to management of audit logging functionality to only a subset of…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: integrity."
+      ],
+      "mapsTo": [
+        "module:integrity"
+      ]
+    },
+    {
+      "id": "03.04.01",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Baseline Configuration: a. Develop and maintain under configuration control, a current baseline configuration of the system. b. Review and update the baseline configuration of the system [Assignment: organization-defined…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: iac-misconfig."
+      ],
+      "mapsTo": [
+        "family:iac-misconfig"
+      ]
+    },
+    {
+      "id": "03.04.02",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Configuration Settings: a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment:…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: iac-misconfig, k8s-pod-security-privileged, k8s-pod-security-run-as-root, k8s-securitycontext-privileged-true, terraform-encryption-disabled-at-rest."
+      ],
+      "mapsTo": [
+        "family:iac-misconfig",
+        "family:k8s-pod-security-privileged",
+        "family:k8s-pod-security-run-as-root",
+        "family:k8s-securitycontext-privileged-true",
+        "family:terraform-encryption-disabled-at-rest"
+      ]
+    },
+    {
+      "id": "03.04.03",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Configuration Change Control: a. Define the types of changes to the system that are configuration-controlled. b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: dockerfile-image-uses-latest-tag."
+      ],
+      "mapsTo": [
+        "family:dockerfile-image-uses-latest-tag"
+      ]
+    },
+    {
+      "id": "03.04.04",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Impact Analyses: a. Analyze changes to the system to determine potential security impacts prior to change implementation. b. Verify that the security requirements for the system continue to be satisfied after the…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: scan-history."
+      ],
+      "mapsTo": [
+        "module:scan-history"
+      ]
+    },
+    {
+      "id": "03.04.05",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Access Restrictions for Change: Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.",
+      "codeTestable": "partial",
+      "evidence": [
+        "No automated signal in this engine, Over-broad pipeline write permissions are observable; physical and logical change restrictions largely are not.",
+        "Reported as an engine gap: this requirement is code-observable in principle, but no detector here decides it."
+      ]
+    },
+    {
+      "id": "03.04.06",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Least Functionality: a. Configure the system to provide only mission-essential capabilities. b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment:…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: k8s-pod-security-capabilities-broad, k8s-pod-security-hostnetwork, k8s-pod-security-hostpid, k8s-pod-security-hostpath, container-runtime."
+      ],
+      "mapsTo": [
+        "family:k8s-pod-security-capabilities-broad",
+        "family:k8s-pod-security-hostnetwork",
+        "family:k8s-pod-security-hostpid",
+        "family:k8s-pod-security-hostpath",
+        "family:container-runtime"
+      ]
+    },
+    {
+      "id": "03.04.08",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Authorized Software - Allow by Exception: a. Identify software programs authorized to execute on the system. b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system. c. Review and…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: malicious-install-script, supply-chain."
+      ],
+      "mapsTo": [
+        "family:malicious-install-script",
+        "family:supply-chain"
+      ]
+    },
+    {
+      "id": "03.04.10",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "System Component Inventory: a. Develop and document an inventory of system components. b. Review and update the system component inventory [Assignment: organization-defined frequency]. c. Update the system component inventory…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: sbom-diff, aibom."
+      ],
+      "mapsTo": [
+        "module:sbom-diff",
+        "module:aibom"
+      ]
+    },
+    {
+      "id": "03.04.11",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "Information Location: a. Identify and document the location of CUI and the system components on which the information is processed and stored. b. Document changes to the system or system component location where CUI is…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: privacy-taint."
+      ],
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "03.04.12",
+      "function": "Configuration Management",
+      "category": "03.04 Configuration Management",
+      "summary": "System and Component Configuration for High-Risk Areas: a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined system configurations]. b. Apply the…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Travel/high-risk-area device configuration is an operational control.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.05.01",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "User Identification and Authentication: a. Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users. b. Re-authenticate users when [Assignment:…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: broken-access-control, jwt-no-verify, crypto-jwt-none, crypto-jwt-key-confusion."
+      ],
+      "mapsTo": [
+        "family:broken-access-control",
+        "family:jwt-no-verify",
+        "family:crypto-jwt-none",
+        "family:crypto-jwt-key-confusion"
+      ]
+    },
+    {
+      "id": "03.05.02",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Device Identification and Authentication: Uniquely identify and authenticate [Assignment: organization-defined devices or types of devices] before establishing a system connection.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Device authentication is network infrastructure.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.05.03",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Multi-Factor Authentication: Implement multi-factor authentication for access to privileged and non-privileged accounts.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, No detector decides whether MFA is enforced for account access.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.05.04",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Replay-Resistant Authentication: Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: jwt-no-exp."
+      ],
+      "mapsTo": [
+        "family:jwt-no-exp"
+      ]
+    },
+    {
+      "id": "03.05.05",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Identifier Management: a. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier. b. Select and assign an identifier that identifies an individual,…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Identifier assignment and reuse prevention is an identity-management process.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.05.07",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Password Management: a. Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: weak-password-hash, crypto-kdf-weak, weak-hardcoded-session-secret."
+      ],
+      "mapsTo": [
+        "family:weak-password-hash",
+        "family:crypto-kdf-weak",
+        "family:weak-hardcoded-session-secret"
+      ]
+    },
+    {
+      "id": "03.05.11",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Authentication Feedback: Obscure feedback of authentication information during the authentication process.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Obscuring authentication feedback is a UI behaviour.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.05.12",
+      "function": "Identification and Authentication",
+      "category": "03.05 Identification and Authentication",
+      "summary": "Authenticator Management: a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution. b. Establish initial authenticator content for…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: hardcoded-secret, secret, key-hygiene."
+      ],
+      "mapsTo": [
+        "family:hardcoded-secret",
+        "family:secret",
+        "family:key-hygiene"
+      ]
+    },
+    {
+      "id": "03.06.01",
+      "function": "Incident Response",
+      "category": "03.06 Incident Response",
+      "summary": "Incident Handling: Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Incident handling is an operational capability.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.06.02",
+      "function": "Incident Response",
+      "category": "03.06 Incident Response",
+      "summary": "Incident Monitoring, Reporting, and Response Assistance: a. Track and document system security incidents. b. Report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]. c. Report…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Incident tracking and reporting is an operational process.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.06.03",
+      "function": "Incident Response",
+      "category": "03.06 Incident Response",
+      "summary": "Incident Response Testing: Test the effectiveness of the incident response capability [Assignment: organization-defined frequency].",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Incident response exercises are organisational.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.06.04",
+      "function": "Incident Response",
+      "category": "03.06 Incident Response",
+      "summary": "Incident Response Training: a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: organization-defined time period] of assuming an incident response…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Incident response training is delivered to people.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.06.05",
+      "function": "Incident Response",
+      "category": "03.06 Incident Response",
+      "summary": "Incident Response Plan: a. Develop an incident response plan that: 1. Provides the organization with a roadmap, 2. Describes the structure and organization, 3. Provides a high-level approach, 4. Defines reportable…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, The incident response plan is a document.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.07.04",
+      "function": "Maintenance",
+      "category": "03.07 Maintenance",
+      "summary": "Maintenance Tools: a. Approve, control, and monitor the use of system maintenance tools. b. Check media with diagnostic and test programs for malicious code before it is used in the system. c. Prevent the removal of…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Maintenance tool control is a physical and operational process.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.07.05",
+      "function": "Maintenance",
+      "category": "03.07 Maintenance",
+      "summary": "Nonlocal Maintenance: a. Approve and monitor nonlocal maintenance and diagnostic activities. b. Implement multi-factor authentication and replay resistance in the establishment of nonlocal maintenance and diagnostic…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Nonlocal maintenance sessions are an operational control.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.07.06",
+      "function": "Maintenance",
+      "category": "03.07 Maintenance",
+      "summary": "Maintenance Personnel: a. Establish a process for maintenance personnel authorization. b. Maintain a list of authorized maintenance organizations or personnel. c. Verify that non-escorted personnel who perform maintenance…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Maintenance personnel authorization is organisational.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.01",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Storage: Physically control and securely store system media that contain CUI.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical media storage.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.02",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Access: Restrict access to CUI on system media to authorized personnel or roles.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical media access restriction.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.03",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Sanitization: Sanitize system media that contain CUI prior to disposal, release out of organizational control, or release for reuse.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Media sanitization is a physical disposal process.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.04",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Marking: Mark system media that contain CUI to indicate distribution limitations, handling caveats, and applicable CUI markings.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical media marking.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.05",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Transport: a. Protect and control system media that contain CUI during transport outside of controlled areas. b. Maintain accountability of system media that contain CUI during transport outside of controlled…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical media transport.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.07",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "Media Use: a. Restrict or prohibit the use of [Assignment: organization-defined types of system media]. b. Prohibit the use of removable system media without an identifiable owner.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Removable media use restriction is an endpoint policy.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.08.09",
+      "function": "Media Protection",
+      "category": "03.08 Media Protection",
+      "summary": "System Backup - Cryptographic Protection: a. Protect the confidentiality of backup information. b. Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI at backup storage locations.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: terraform-encryption-disabled-at-rest, crypto-weak-cipher."
+      ],
+      "mapsTo": [
+        "family:terraform-encryption-disabled-at-rest",
+        "family:crypto-weak-cipher"
+      ]
+    },
+    {
+      "id": "03.09.01",
+      "function": "Personnel Security",
+      "category": "03.09 Personnel Security",
+      "summary": "Personnel Screening: a. Screen individuals prior to authorizing access to the system. b. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening].",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Personnel screening.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.09.02",
+      "function": "Personnel Security",
+      "category": "03.09 Personnel Security",
+      "summary": "Personnel Termination and Transfer: a. When individual employment is terminated: 1. Disable system access within [Assignment: organization-defined time period], 2. Terminate or revoke authenticators and credentials, 3. Retrieve…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Termination and transfer procedures are HR processes.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.10.01",
+      "function": "Physical Protection",
+      "category": "03.10 Physical Protection",
+      "summary": "Physical Access Authorizations: a. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides. b. Issue authorization credentials for facility access. c. Review the facility…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Facility access authorization.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.10.02",
+      "function": "Physical Protection",
+      "category": "03.10 Physical Protection",
+      "summary": "Monitoring Physical Access: a. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents. b. Review physical access logs [Assignment: organization-defined frequency]…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical access monitoring.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.10.06",
+      "function": "Physical Protection",
+      "category": "03.10 Physical Protection",
+      "summary": "Alternate Work Site: a. Determine alternate work sites allowed for use by employees. b. Employ the following security requirements at alternate work sites: [Assignment: organization-defined security requirements].",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Alternate work site security.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.10.07",
+      "function": "Physical Protection",
+      "category": "03.10 Physical Protection",
+      "summary": "Physical Access Control: a. Enforce physical access authorizations at entry and exit points to the facility. b. Maintain physical access audit logs for entry or exit points. c. Escort visitors, and control visitor activity.…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical access control at entry and exit points.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.10.08",
+      "function": "Physical Protection",
+      "category": "03.10 Physical Protection",
+      "summary": "Access Control for Transmission: Control physical access to system distribution and transmission lines within organizational facilities.",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Physical protection of transmission lines.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.11.01",
+      "function": "Risk Assessment",
+      "category": "03.11 Risk Assessment",
+      "summary": "Risk Assessment: a. Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI. b. Update risk assessments [Assignment:…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: threat-model-auto."
+      ],
+      "mapsTo": [
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "03.11.02",
+      "function": "Risk Assessment",
+      "category": "03.11 Risk Assessment",
+      "summary": "Vulnerability Monitoring and Scanning: a. Monitor and scan the system for vulnerabilities [Assignment: organization-defined frequency] and when new vulnerabilities affecting the system are identified. b. Remediate system vulnerabilities…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: supply-chain.",
+        "Artifact(s) present: scan-history, cve-alert-daemon."
+      ],
+      "mapsTo": [
+        "family:supply-chain",
+        "module:scan-history",
+        "module:cve-alert-daemon"
+      ]
+    },
+    {
+      "id": "03.11.04",
+      "function": "Risk Assessment",
+      "category": "03.11 Risk Assessment",
+      "summary": "Risk Response: Respond to findings from security assessments, monitoring, and audits.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: fix-history, triage."
+      ],
+      "mapsTo": [
+        "module:fix-history",
+        "module:triage"
+      ]
+    },
+    {
+      "id": "03.12.01",
+      "function": "Security Assessment and Monitoring",
+      "category": "03.12 Security Assessment and Monitoring",
+      "summary": "Security Assessment: Assess the security requirements for the system and its environment of operation [Assignment: organization-defined frequency] to determine if the requirements have been satisfied.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: verifier, scan-history."
+      ],
+      "mapsTo": [
+        "module:verifier",
+        "module:scan-history"
+      ]
+    },
+    {
+      "id": "03.12.02",
+      "function": "Security Assessment and Monitoring",
+      "category": "03.12 Security Assessment and Monitoring",
+      "summary": "Plan of Action and Milestones: a. Develop a plan of action and milestones for the system: 1. To document the planned remediation actions, 2. To reduce or eliminate known system vulnerabilities. b. Update the existing plan of…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: triage, fix-history."
+      ],
+      "mapsTo": [
+        "module:triage",
+        "module:fix-history"
+      ]
+    },
+    {
+      "id": "03.12.03",
+      "function": "Security Assessment and Monitoring",
+      "category": "03.12 Security Assessment and Monitoring",
+      "summary": "Continuous Monitoring: Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: watch-mode, scan-history."
+      ],
+      "mapsTo": [
+        "module:watch-mode",
+        "module:scan-history"
+      ]
+    },
+    {
+      "id": "03.12.05",
+      "function": "Security Assessment and Monitoring",
+      "category": "03.12 Security Assessment and Monitoring",
+      "summary": "Information Exchange: a. Approve and manage the exchange of CUI between the system and other systems using [Selection: agreements]. b. Document interface characteristics, security requirements, and responsibilities. c.…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Information exchange agreements are contractual.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.13.01",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Boundary Protection: a. Monitor and control communications at external managed interfaces to the system and key internal managed interfaces within the system. b. Implement subnetworks for publicly accessible system…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: k8s-pod-security-hostnetwork, k8s-hostnetwork-mounted, permissive-cors-allow-origin, aws-public-s3, ssrf."
+      ],
+      "mapsTo": [
+        "family:k8s-pod-security-hostnetwork",
+        "family:k8s-hostnetwork-mounted",
+        "family:permissive-cors-allow-origin",
+        "family:aws-public-s3",
+        "family:ssrf"
+      ]
+    },
+    {
+      "id": "03.13.04",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Information in Shared System Resources: Prevent unauthorized and unintended information transfer via shared system resources.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: data-exposure."
+      ],
+      "mapsTo": [
+        "family:data-exposure"
+      ]
+    },
+    {
+      "id": "03.13.06",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Network Communications - Deny by Default: Deny network communications traffic by default, and allow network communications traffic by exception.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: k8s-pod-security-hostnetwork, k8s-rbac-wildcard, permissive-cors-allow-origin."
+      ],
+      "mapsTo": [
+        "family:k8s-pod-security-hostnetwork",
+        "family:k8s-rbac-wildcard",
+        "family:permissive-cors-allow-origin"
+      ]
+    },
+    {
+      "id": "03.13.08",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Transmission and Storage Confidentiality: Implement cryptographic mechanisms to prevent the unauthorized disclosure of CUI during transmission and while in storage.",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: insecure-http, crypto-tls-version, crypto-tls-no-verify, terraform-encryption-disabled-at-rest, dart-cleartext-http, swift-cleartext-http."
+      ],
+      "mapsTo": [
+        "family:insecure-http",
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify",
+        "family:terraform-encryption-disabled-at-rest",
+        "family:dart-cleartext-http",
+        "family:swift-cleartext-http"
+      ]
+    },
+    {
+      "id": "03.13.09",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Network Disconnect: Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: jwt-no-exp."
+      ],
+      "mapsTo": [
+        "family:jwt-no-exp"
+      ]
+    },
+    {
+      "id": "03.13.10",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Cryptographic Key Establishment and Management: Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution,…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: key-hygiene, hardcoded-secret, crypto-static-iv, rpc-key-inline."
+      ],
+      "mapsTo": [
+        "family:key-hygiene",
+        "family:hardcoded-secret",
+        "family:crypto-static-iv",
+        "family:rpc-key-inline"
+      ]
+    },
+    {
+      "id": "03.13.11",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Cryptographic Protection: Implement the following types of cryptography to protect the confidentiality of CUI: [Assignment: organization-defined types of cryptography].",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: crypto-weak-cipher, crypto-weak-hash, crypto-ecb, crypto-kdf-weak, weak-crypto, crypto-static-iv, pqc-migration."
+      ],
+      "mapsTo": [
+        "family:crypto-weak-cipher",
+        "family:crypto-weak-hash",
+        "family:crypto-ecb",
+        "family:crypto-kdf-weak",
+        "family:weak-crypto",
+        "family:crypto-static-iv",
+        "family:pqc-migration"
+      ]
+    },
+    {
+      "id": "03.13.12",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Collaborative Computing Devices and Applications: a. Prohibit the remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions]. b. Provide an explicit indication…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Collaborative computing device activation is an endpoint control.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.13.13",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Mobile Code: a. Define acceptable mobile code and mobile code technologies. b. Authorize, monitor, and control the use of mobile code.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: xss, client-side, unsanitized-llm-output-rendered-as-html."
+      ],
+      "mapsTo": [
+        "family:xss",
+        "family:client-side",
+        "family:unsanitized-llm-output-rendered-as-html"
+      ]
+    },
+    {
+      "id": "03.13.15",
+      "function": "System and Communications Protection",
+      "category": "03.13 System and Communications Protection",
+      "summary": "Session Authenticity: Protect the authenticity of communications sessions.",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: session-cookie-missing-secure-flag, session-cookie-without-httponly-flag, crypto-tls-no-verify, weak-hardcoded-session-secret."
+      ],
+      "mapsTo": [
+        "family:session-cookie-missing-secure-flag",
+        "family:session-cookie-without-httponly-flag",
+        "family:crypto-tls-no-verify",
+        "family:weak-hardcoded-session-secret"
+      ]
+    },
+    {
+      "id": "03.14.01",
+      "function": "System and Information Integrity",
+      "category": "03.14 System and Information Integrity",
+      "summary": "Flaw Remediation: a. Identify, report, and correct system flaws. b. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates.",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: sql-injection, command-injection, code-injection, path-traversal, xss, xxe, insecure-deserialization, ssrf, ssti, open-redirect, prototype-pollution, supply-chain.",
+        "Artifact(s) present: fix-history."
+      ],
+      "mapsTo": [
+        "family:sql-injection",
+        "family:command-injection",
+        "family:code-injection",
+        "family:path-traversal",
+        "family:xss",
+        "family:xxe",
+        "family:insecure-deserialization",
+        "family:ssrf",
+        "family:ssti",
+        "family:open-redirect",
+        "family:prototype-pollution",
+        "family:supply-chain",
+        "module:fix-history"
+      ]
+    },
+    {
+      "id": "03.14.02",
+      "function": "System and Information Integrity",
+      "category": "03.14 System and Information Integrity",
+      "summary": "Malicious Code Protection: a. Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code. b. Update malicious code protection mechanisms as new releases are available.…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Zero open findings at the configured severity in: malicious-install-script, supply-chain."
+      ],
+      "mapsTo": [
+        "family:malicious-install-script",
+        "family:supply-chain"
+      ]
+    },
+    {
+      "id": "03.14.03",
+      "function": "System and Information Integrity",
+      "category": "03.14 System and Information Integrity",
+      "summary": "Security Alerts, Advisories, and Directives: a. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis. b. Generate and disseminate internal system security alerts, advisories, and directives,…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: cve-alert-daemon."
+      ],
+      "mapsTo": [
+        "module:cve-alert-daemon"
+      ]
+    },
+    {
+      "id": "03.14.06",
+      "function": "System and Information Integrity",
+      "category": "03.14 System and Information Integrity",
+      "summary": "System Monitoring: a. Monitor the system to detect: 1. Attacks and indicators of potential attacks and 2. Unauthorized connections. b. Identify unauthorized use of the system. c. Monitor inbound and outbound…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: watch-mode, scan-history."
+      ],
+      "mapsTo": [
+        "module:watch-mode",
+        "module:scan-history"
+      ]
+    },
+    {
+      "id": "03.14.08",
+      "function": "System and Information Integrity",
+      "category": "03.14 System and Information Integrity",
+      "summary": "Information Management and Retention: Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: privacy-taint."
+      ],
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
+    },
+    {
+      "id": "03.15.01",
+      "function": "Planning",
+      "category": "03.15 Planning",
+      "summary": "Policy and Procedures: a. Develop, document, and disseminate to organizational personnel or roles the policies and procedures needed to satisfy the security requirements for the protection of CUI. b. Review and update…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: compliance-policy."
+      ],
+      "mapsTo": [
+        "module:compliance-policy"
+      ]
+    },
+    {
+      "id": "03.15.02",
+      "function": "Planning",
+      "category": "03.15 Planning",
+      "summary": "System Security Plan: a. Develop a system security plan that: 1. Defines the constituent system components, 2. Identifies the information types, 3. Describes specific threats, 4. Describes operational environment, 5.…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, The system security plan is a document.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.15.03",
+      "function": "Planning",
+      "category": "03.15 Planning",
+      "summary": "Rules of Behavior: a. Establish rules that describe the responsibilities and expected behavior for system usage and protecting CUI. b. Provide rules to individuals who require access to the system. c. Receive a…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, Rules of behaviour are acknowledged by people.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.16.01",
+      "function": "System and Services Acquisition",
+      "category": "03.16 System and Services Acquisition",
+      "summary": "Security Engineering Principles: Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined systems security engineering…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: threat-model-auto."
+      ],
+      "mapsTo": [
+        "module:threat-model-auto"
+      ]
+    },
+    {
+      "id": "03.16.02",
+      "function": "System and Services Acquisition",
+      "category": "03.16 System and Services Acquisition",
+      "summary": "Unsupported System Components: a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. b. Provide options for risk mitigation or alternative sources for…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: container-base-image-debian-9-eol, container-base-image-node-12-alpine-eol, container-base-image-python-2-7-eol, supply-chain."
+      ],
+      "mapsTo": [
+        "family:container-base-image-debian-9-eol",
+        "family:container-base-image-node-12-alpine-eol",
+        "family:container-base-image-python-2-7-eol",
+        "family:supply-chain"
+      ]
+    },
+    {
+      "id": "03.16.03",
+      "function": "System and Services Acquisition",
+      "category": "03.16 System and Services Acquisition",
+      "summary": "External System Services: a. Require the providers of external system services used for the processing, storage, or transmission of CUI to comply with the following security requirements: [Assignment: organization-defined…",
+      "codeTestable": "no",
+      "evidence": [
+        "Not evidenced by code analysis, External service provider requirements are contractual.",
+        "The auditor must supply organisational evidence (policy, procedure, records, or attestation) for this requirement."
+      ]
+    },
+    {
+      "id": "03.17.01",
+      "function": "Supply Chain Risk Management",
+      "category": "03.17 Supply Chain Risk Management",
+      "summary": "Supply Chain Risk Management Plan: a. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal. b.…",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: sbom-diff."
+      ],
+      "mapsTo": [
+        "module:sbom-diff"
+      ]
+    },
+    {
+      "id": "03.17.02",
+      "function": "Supply Chain Risk Management",
+      "category": "03.17 Supply Chain Risk Management",
+      "summary": "Acquisition Strategies, Tools, and Methods: Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.",
+      "codeTestable": "partial",
+      "evidence": [
+        "Artifact(s) present: license-attributions, sbom-diff."
+      ],
+      "mapsTo": [
+        "module:license-attributions",
+        "module:sbom-diff"
+      ]
+    },
+    {
+      "id": "03.17.03",
+      "function": "Supply Chain Risk Management",
+      "category": "03.17 Supply Chain Risk Management",
+      "summary": "Supply Chain Requirements and Processes: a. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes. b. Enforce the following security requirements to protect against supply…",
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings at the configured severity in: supply-chain, malicious-install-script."
+      ],
+      "mapsTo": [
+        "family:supply-chain",
+        "family:malicious-install-script"
+      ]
+    }
+  ]
+}