aws-cis-controls-assessment 1.0.6__py3-none-any.whl → 1.0.8__py3-none-any.whl

aws_cis_assessment/reporters/html_reporter.py

@@ -21,6 +21,44 @@ class HTMLReporter(ReportGenerator):
     Generates interactive web-based reports with executive dashboard,
     compliance summaries, charts, detailed drill-down capabilities,
     and responsive design for mobile and desktop viewing.
+    
+    Features:
+        - Executive dashboard with key compliance metrics
+        - Implementation Groups section showing unique controls per IG
+        - Control display names combining control ID and AWS Config rule name
+        - IG membership badges indicating which IGs include each control
+        - Consolidated detailed findings (deduplicated across IGs)
+        - Interactive charts and collapsible sections
+        - Resource details with filtering and export capabilities
+        - Responsive design for mobile and desktop
+        - Print-friendly layout
+    
+    Display Format Examples:
+        Control cards show formatted names like:
+        - "1.5: root-account-hardware-mfa-enabled"
+        - "2.1: IAM Password Policy (iam-password-policy)"
+        
+        IG badges indicate membership:
+        - Blue badge (IG1) for foundational controls
+        - Green badge (IG2) for enhanced security controls
+        - Purple badge (IG3) for advanced security controls
+    
+    CSS Classes for Custom Styling:
+        - .ig-badge-1: Blue badge for IG1 controls
+        - .ig-badge-2: Green badge for IG2 controls
+        - .ig-badge-3: Purple badge for IG3 controls
+        - .control-display-name: Formatted control name display
+        - .control-display-name.truncated: Truncated names with tooltip
+        - .ig-membership-badges: Container for IG membership badges
+        - .ig-membership-badge: Individual IG badge element
+        - .ig-explanation: Informational box explaining IG cumulative nature
+        - .ig-scope: Scope description for each IG section
+    
+    Backward Compatibility:
+        - Works with existing AssessmentResult data structures
+        - Gracefully falls back to control ID only if config_rule_name is missing
+        - Preserves all existing sections and functionality
+        - Maintains existing CSS classes for compatibility
     """
     
     def __init__(self, template_dir: Optional[str] = None, include_charts: bool = True):
@@ -147,9 +185,19 @@ class HTMLReporter(ReportGenerator):
                 control_data["progress_width"] = control_data["compliance_percentage"]
                 control_data["severity_badge"] = self._get_severity_badge(control_data)
                 
+                # Enrich control metadata with display name, IG badges, etc.
+                enriched_control = self._enrich_control_metadata(
+                    control_data, 
+                    control_id, 
+                    ig_name, 
+                    html_data["implementation_groups"]
+                )
+                # Update control_data with enriched metadata
+                ig_data["controls"][control_id] = enriched_control
+                
                 # Process findings for display
-                control_data["display_findings"] = self._prepare_findings_for_display(
-                    control_data.get("non_compliant_findings", [])
+                enriched_control["display_findings"] = self._prepare_findings_for_display(
+                    enriched_control.get("non_compliant_findings", [])
                 )
         
         # Enhance remediation priorities with visual elements
@@ -505,6 +553,58 @@ class HTMLReporter(ReportGenerator):
             margin-bottom: 10px;
         }
         
+        /* Control display name styles */
+        .control-display-name {
+            font-weight: 600;
+            color: #2c3e50;
+            margin-bottom: 5px;
+            font-size: 0.95em;
+        }
+        
+        .control-display-name.truncated {
+            overflow: hidden;
+            text-overflow: ellipsis;
+            white-space: nowrap;
+            cursor: help;
+        }
+        
+        /* IG membership badges */
+        .ig-membership-badges {
+            display: flex;
+            gap: 5px;
+            margin-top: 5px;
+            margin-bottom: 10px;
+        }
+        
+        .ig-membership-badge {
+            font-size: 0.7em;
+            padding: 2px 6px;
+            border-radius: 10px;
+            font-weight: bold;
+            text-transform: uppercase;
+            letter-spacing: 0.5px;
+        }
+        
+        .ig-badge-1 { 
+            background-color: #3498db; 
+            color: white; 
+        } /* Blue for IG1 */
+        
+        .ig-badge-2 { 
+            background-color: #27ae60; 
+            color: white; 
+        } /* Green for IG2 */
+        
+        .ig-badge-3 { 
+            background-color: #9b59b6; 
+            color: white; 
+        } /* Purple for IG3 */
+        
+        .ig-badge-default {
+            background-color: #95a5a6;
+            color: white;
+        }
+        
         /* Badges */
         .badge {
             padding: 4px 8px;
@@ -1368,6 +1468,21 @@ class HTMLReporter(ReportGenerator):
                 findings_count = len(control_data.get("non_compliant_findings", []))
                 status_class = self._get_status_class(control_data["compliance_percentage"])
                 
+                # Get display name (enriched in _enhance_html_structure)
+                display_name = control_data.get('display_name', control_id)
+                needs_truncation = control_data.get('needs_truncation', False)
+                
+                # Add title attribute for truncated names
+                title_attr = f' title="{display_name}"' if needs_truncation else ''
+                display_name_class = 'control-display-name truncated' if needs_truncation else 'control-display-name'
+                
+                # Get IG membership badges
+                originating_ig = control_data.get('originating_ig', 'IG1')
+                ig_badge_class = control_data.get('ig_badge_class', 'ig-badge-1')
+                
+                # Build IG membership badges HTML
+                ig_badges_html = f'<span class="ig-membership-badge {ig_badge_class}">{originating_ig}</span>'
+                
                 # Add inheritance indicator for inherited controls
                 inheritance_indicator = ""
                 if ig_name != "IG1" and control_id in unique_controls.get("IG1", {}):
@@ -1378,10 +1493,12 @@ class HTMLReporter(ReportGenerator):
                 controls_html += f"""
                 <div class="control-card">
                     <div class="control-header">
-                        <div class="control-id">{control_id}</div>
+                        <div class="{display_name_class}"{title_attr}>{display_name}</div>
                         <div class="badge {control_data.get('severity_badge', 'medium')}">{findings_count} Issues</div>
                     </div>
-                    <div class="control-title">{control_data.get('title', f'CIS Control {control_id}')}</div>
+                    <div class="ig-membership-badges">
+                        {ig_badges_html}
+                    </div>
                     {inheritance_indicator}
                     <div class="progress-container">
                         <div class="progress-bar {status_class}" data-width="{control_data['compliance_percentage']}">
@@ -1430,39 +1547,73 @@ class HTMLReporter(ReportGenerator):
     def _generate_detailed_findings_section(self, html_data: Dict[str, Any]) -> str:
         """Generate detailed findings section.
         
+        This method consolidates findings by control ID only (not by IG) to eliminate
+        duplication. Each control appears once with IG membership indicators.
+        
         Args:
             html_data: Enhanced HTML report data
             
         Returns:
             Detailed findings HTML as string
         """
-        findings_sections = ""
+        # Consolidate findings by control ID (deduplicated across IGs)
+        consolidated_findings = self._consolidate_findings_by_control(
+            html_data.get("implementation_groups", {})
+        )
         
-        for ig_name, ig_findings in html_data["detailed_findings"].items():
-            ig_content = ""
+        findings_content = ""
+        
+        # Generate findings grouped by control ID only (sorted alphanumerically)
+        for control_id, control_data in consolidated_findings.items():
+            findings = control_data.get('findings', [])
+            
+            # Skip if no non-compliant findings
+            if not findings:
+                continue
+            
+            # Get control metadata
+            config_rule_name = control_data.get('config_rule_name', '')
+            title = control_data.get('title', f'CIS Control {control_id}')
+            member_igs = control_data.get('member_igs', [])
+            
+            # Format display name for collapsible header
+            display_name = self._format_control_display_name(control_id, config_rule_name, title)
+            
+            # Generate IG membership badges
+            ig_badges_html = ""
+            for ig in member_igs:
+                badge_class = self._get_ig_badge_class(ig)
+                ig_badges_html += f'<span class="ig-membership-badge {badge_class}">{ig}</span>'
+            
+            # Generate findings table rows
+            findings_rows = ""
+            for finding in findings:
+                if finding.get("compliance_status") == "NON_COMPLIANT":
+                    findings_rows += f"""
+                    <tr>
+                        <td>{finding.get('resource_id', 'N/A')}</td>
+                        <td>{finding.get('resource_type', 'N/A')}</td>
+                        <td>{finding.get('region', 'N/A')}</td>
+                        <td><span class="badge {finding.get('compliance_status', '').lower()}">{finding.get('compliance_status', 'UNKNOWN')}</span></td>
+                        <td>{finding.get('evaluation_reason', 'N/A')}</td>
+                        <td>{finding.get('config_rule_name', config_rule_name)}</td>
+                    </tr>
+                    """
             
-            for control_id, control_findings in ig_findings.items():
-                if not control_findings:
-                    continue
-                
-                findings_rows = ""
-                for finding in control_findings:
-                    if finding["compliance_status"] == "NON_COMPLIANT":
-                        findings_rows += f"""
-                        <tr>
-                            <td>{finding['resource_id']}</td>
-                            <td>{finding['resource_type']}</td>
-                            <td>{finding['region']}</td>
-                            <td><span class="badge {finding['compliance_status'].lower()}">{finding['compliance_status']}</span></td>
-                            <td>{finding['evaluation_reason']}</td>
-                            <td>{finding['config_rule_name']}</td>
-                        </tr>
-                        """
+            # Only add control section if there are non-compliant findings
+            if findings_rows:
+                non_compliant_count = len([f for f in findings if f.get('compliance_status') == 'NON_COMPLIANT'])
                 
-                if findings_rows:
-                    ig_content += f"""
-                    <button class="collapsible">{control_id} - Non-Compliant Resources ({len([f for f in control_findings if f['compliance_status'] == 'NON_COMPLIANT'])} items)</button>
+                findings_content += f"""
+                <div class="control-findings-section">
+                    <button class="collapsible">
+                        <span class="control-display-name">{display_name}</span>
+                        <span class="findings-count"> - Non-Compliant Resources ({non_compliant_count} items)</span>
+                    </button>
                     <div class="collapsible-content">
+                        <div class="ig-membership-badges" style="margin-bottom: 15px;">
+                            <strong>Implementation Groups:</strong> {ig_badges_html}
+                        </div>
                         <table class="findings-table">
                             <thead>
                                 <tr>
@@ -1479,23 +1630,20 @@ class HTMLReporter(ReportGenerator):
                             </tbody>
                         </table>
                     </div>
-                    """
-            
-            if ig_content:
-                findings_sections += f"""
-                <div class="ig-findings">
-                    <h3>{ig_name} Detailed Findings</h3>
-                    {ig_content}
                 </div>
                 """
         
         return f"""
         <section id="detailed-findings" class="detailed-findings">
             <h2>Detailed Findings</h2>
+            <p class="section-description">
+                Findings are grouped by control ID and deduplicated across Implementation Groups. 
+                Each control shows which IGs include it.
+            </p>
             <div class="search-container">
                 <input type="text" placeholder="Search findings..." onkeyup="searchFindings(this.value)" style="width: 100%; padding: 10px; margin-bottom: 20px; border: 1px solid #ddd; border-radius: 5px;">
             </div>
-            {findings_sections}
+            {findings_content if findings_content else '<p>No non-compliant findings to display.</p>'}
         </section>
         """
     
@@ -1902,11 +2050,45 @@ class HTMLReporter(ReportGenerator):
     def _get_unique_controls_per_ig(self, implementation_groups: Dict[str, Any]) -> Dict[str, Dict[str, Any]]:
         """Get unique controls per Implementation Group to avoid duplication.
         
+        Filters controls to show only those unique to each IG level, eliminating
+        redundancy in the Implementation Groups section. IG2 shows only controls
+        not in IG1, and IG3 shows only controls not in IG1 or IG2.
+        
         Args:
-            implementation_groups: Implementation groups data
+            implementation_groups: Implementation groups data with all controls
             
         Returns:
-            Dictionary mapping IG names to their unique controls
+            Dictionary mapping IG names to their unique controls:
+            - IG1: All IG1 controls (foundational)
+            - IG2: Only controls unique to IG2 (not in IG1)
+            - IG3: Only controls unique to IG3 (not in IG1 or IG2)
+        
+        Examples:
+            Input:
+            {
+                'IG1': {'controls': {'1.1': {...}, '1.5': {...}}},
+                'IG2': {'controls': {'1.1': {...}, '1.5': {...}, '5.2': {...}}},
+                'IG3': {'controls': {'1.1': {...}, '1.5': {...}, '5.2': {...}, '13.1': {...}}}
+            }
+            
+            Output:
+            {
+                'IG1': {'1.1': {...}, '1.5': {...}},  # All IG1 controls
+                'IG2': {'5.2': {...}},                 # Only 5.2 is unique to IG2
+                'IG3': {'13.1': {...}}                 # Only 13.1 is unique to IG3
+            }
+        
+        Rationale:
+            - Eliminates duplicate control cards across IG sections
+            - Users see each control once in its originating IG
+            - Reduces visual clutter and improves report readability
+            - IG membership badges show which IGs include each control
+        
+        Notes:
+            - IG1 controls are always shown in full (foundational set)
+            - Higher IGs show only their incremental additions
+            - Cumulative nature is explained in the IG explanation box
+            - Used by _generate_implementation_groups_section()
         """
         unique_controls = {}
         
@@ -2159,4 +2341,331 @@ class HTMLReporter(ReportGenerator):
         options = ""
         for resource_type in sorted(resource_type_stats.keys()):
             options += f'<option value="{resource_type}">{resource_type}</option>'
-        return options
+        return options
+    
+    def _format_control_display_name(self, control_id: str, config_rule_name: str, title: Optional[str] = None) -> str:
+        """Format control display name combining ID, rule name, and optional title.
+        
+        Creates a human-readable display name that shows both the control identifier
+        and the AWS Config rule name, making it easier for users to understand what
+        each control checks without looking up documentation.
+        
+        Args:
+            control_id: Control identifier (e.g., "1.5", "2.1")
+            config_rule_name: AWS Config rule name (e.g., "root-account-hardware-mfa-enabled")
+            title: Optional human-readable title for the control
+            
+        Returns:
+            Formatted string for display in the following formats:
+            - With title: "{control_id}: {title} ({config_rule_name})"
+            - Without title: "{control_id}: {config_rule_name}"
+            - Fallback (no rule name): "{control_id}"
+        
+        Examples:
+            >>> _format_control_display_name("1.5", "root-account-hardware-mfa-enabled")
+            "1.5: root-account-hardware-mfa-enabled"
+            
+            >>> _format_control_display_name("2.1", "iam-password-policy", "IAM Password Policy")
+            "2.1: IAM Password Policy (iam-password-policy)"
+            
+            >>> _format_control_display_name("3.1", "")
+            "3.1"
+        
+        Notes:
+            - Gracefully handles missing config_rule_name by falling back to control_id only
+            - Used in both Implementation Groups and Detailed Findings sections
+            - Display names longer than 50 characters are truncated with tooltips
+        """
+        if not config_rule_name:
+            # Fallback to control_id only if config_rule_name is missing
+            return control_id
+        
+        if title:
+            return f"{control_id}: {title} ({config_rule_name})"
+        else:
+            return f"{control_id}: {config_rule_name}"
+    
+    def _get_ig_badge_class(self, ig_name: str) -> str:
+        """Get CSS class for IG badge styling.
+        
+        Returns the appropriate CSS class for styling Implementation Group badges
+        with consistent color coding across the report.
+        
+        Args:
+            ig_name: Implementation Group name (IG1, IG2, or IG3)
+            
+        Returns:
+            CSS class name for the badge:
+            - 'ig-badge-1' for IG1 (blue styling)
+            - 'ig-badge-2' for IG2 (green styling)
+            - 'ig-badge-3' for IG3 (purple styling)
+            - 'ig-badge-default' for unknown IGs (gray styling)
+        
+        Examples:
+            >>> _get_ig_badge_class("IG1")
+            "ig-badge-1"
+            
+            >>> _get_ig_badge_class("IG2")
+            "ig-badge-2"
+            
+            >>> _get_ig_badge_class("UNKNOWN")
+            "ig-badge-default"
+        
+        CSS Styling:
+            .ig-badge-1 { background-color: #3498db; color: white; }  /* Blue */
+            .ig-badge-2 { background-color: #27ae60; color: white; }  /* Green */
+            .ig-badge-3 { background-color: #9b59b6; color: white; }  /* Purple */
+        
+        Notes:
+            - Used consistently across Implementation Groups and Detailed Findings sections
+            - Provides visual hierarchy for IG levels
+            - Can be customized via CSS for different color schemes
+        """
+        badge_classes = {
+            'IG1': 'ig-badge-1',  # Blue
+            'IG2': 'ig-badge-2',  # Green
+            'IG3': 'ig-badge-3'   # Purple
+        }
+        return badge_classes.get(ig_name, 'ig-badge-default')
+    
+    def _enrich_control_metadata(self, control_data: Dict[str, Any], control_id: str, ig_name: str, 
+                                 all_igs: Dict[str, Any]) -> Dict[str, Any]:
+        """Add display metadata to control data for enhanced HTML presentation.
+        
+        Enriches control data with additional fields needed for improved display,
+        including formatted names, IG membership badges, and truncation indicators.
+        
+        Args:
+            control_data: Existing control data dictionary
+            control_id: Control identifier (e.g., "1.5")
+            ig_name: Implementation Group name (e.g., "IG1")
+            all_igs: All implementation groups data for determining originating IG
+            
+        Returns:
+            Enhanced control data with additional fields:
+            - display_name: Formatted name combining control ID and rule name
+            - originating_ig: Which IG introduced this control (IG1, IG2, or IG3)
+            - ig_badge_class: CSS class for IG badge styling
+            - needs_truncation: Boolean indicating if display name exceeds 50 characters
+        
+        Examples:
+            Input control_data:
+            {
+                'control_id': '1.5',
+                'config_rule_name': 'root-account-hardware-mfa-enabled',
+                'compliance_percentage': 0.0,
+                'total_resources': 1
+            }
+            
+            Output enriched data (includes all input fields plus):
+            {
+                ...original fields...,
+                'display_name': '1.5: root-account-hardware-mfa-enabled',
+                'originating_ig': 'IG1',
+                'ig_badge_class': 'ig-badge-1',
+                'needs_truncation': False
+            }
+        
+        Notes:
+            - Called during _enhance_html_structure() for each control
+            - Truncation threshold is 50 characters
+            - Gracefully handles missing config_rule_name
+            - Originating IG is determined by checking IG1, IG2, IG3 in order
+        """
+        enriched = control_data.copy()
+        
+        # Format display name
+        enriched['display_name'] = self._format_control_display_name(
+            control_id,
+            control_data.get('config_rule_name', ''),
+            control_data.get('title')
+        )
+        
+        # Determine originating IG (which IG introduced this control)
+        originating_ig = self._determine_originating_ig(control_id, all_igs)
+        enriched['originating_ig'] = originating_ig
+        
+        # Get badge class for the originating IG
+        enriched['ig_badge_class'] = self._get_ig_badge_class(originating_ig)
+        
+        # Check if truncation is needed (threshold: 50 characters)
+        enriched['needs_truncation'] = len(enriched['display_name']) > 50
+        
+        return enriched
+    
+    def _determine_originating_ig(self, control_id: str, all_igs: Dict[str, Any]) -> str:
+        """Determine which Implementation Group introduced a control.
+        
+        Args:
+            control_id: Control identifier
+            all_igs: All implementation groups data
+            
+        Returns:
+            Name of the IG that introduced this control (IG1, IG2, or IG3)
+        """
+        # Check in order: IG1, IG2, IG3
+        # The first IG that contains the control is the originating IG
+        for ig_name in ['IG1', 'IG2', 'IG3']:
+            if ig_name in all_igs:
+                if control_id in all_igs[ig_name].get('controls', {}):
+                    return ig_name
+        
+        # Default to IG1 if not found
+        return 'IG1'
+    
+    def _consolidate_findings_by_control(self, implementation_groups: Dict[str, Any]) -> Dict[str, Dict[str, Any]]:
+        """Consolidate findings from all IGs, grouped by control ID only.
+        
+        This method deduplicates findings across Implementation Groups so that each
+        finding appears only once in the Detailed Findings section, eliminating
+        redundancy when a control appears in multiple IGs.
+        
+        Args:
+            implementation_groups: Implementation groups data with controls and findings
+            
+        Returns:
+            Dictionary mapping control_id -> consolidated control data with:
+            - findings: List of deduplicated non-compliant findings
+            - member_igs: List of IGs that include this control (e.g., ["IG1", "IG2"])
+            - config_rule_name: AWS Config rule name for the control
+            - title: Human-readable title for the control
+            
+            Results are sorted by control ID in alphanumeric order.
+        
+        Examples:
+            Input: Control "1.5" appears in IG1, IG2, and IG3 with same findings
+            Output: Single entry for "1.5" with:
+            {
+                '1.5': {
+                    'findings': [...deduplicated findings...],
+                    'member_igs': ['IG1', 'IG2', 'IG3'],
+                    'config_rule_name': 'root-account-hardware-mfa-enabled',
+                    'title': 'Root Account Hardware MFA'
+                }
+            }
+        
+        Deduplication Strategy:
+            - Uses (resource_id, control_id, region) tuple as unique key
+            - Prevents same resource from appearing multiple times
+            - Preserves all unique findings across IGs
+        
+        Sorting:
+            - Controls are sorted alphanumerically (1.1, 1.2, ..., 1.10, 2.1, ...)
+            - Uses _sort_control_id() helper for proper numeric sorting
+        
+        Notes:
+            - Eliminates "IG1 Detailed Findings", "IG2 Detailed Findings" subsections
+            - Each control appears once with IG membership indicators
+            - Improves report readability and reduces redundancy
+        """
+        consolidated = {}
+        seen_findings = set()  # Track (resource_id, control_id, region) tuples for deduplication
+        
+        for ig_name, ig_data in implementation_groups.items():
+            for control_id, control_data in ig_data.get('controls', {}).items():
+                # Initialize control entry if not exists
+                if control_id not in consolidated:
+                    consolidated[control_id] = {
+                        'findings': [],
+                        'member_igs': [],
+                        'config_rule_name': control_data.get('config_rule_name', ''),
+                        'title': control_data.get('title', f'CIS Control {control_id}')
+                    }
+                
+                # Track which IGs include this control
+                consolidated[control_id]['member_igs'].append(ig_name)
+                
+                # Add non-compliant findings (deduplicated)
+                for finding in control_data.get('non_compliant_findings', []):
+                    finding_key = (finding.get('resource_id', ''), control_id, finding.get('region', ''))
+                    if finding_key not in seen_findings:
+                        consolidated[control_id]['findings'].append(finding)
+                        seen_findings.add(finding_key)
+        
+        # Sort by control ID using alphanumeric sorting
+        return dict(sorted(consolidated.items(), key=lambda x: self._sort_control_id(x[0])))
+    
+    def _get_control_ig_membership(self, control_id: str, implementation_groups: Dict[str, Any]) -> List[str]:
+        """Determine which Implementation Groups include a specific control.
+        
+        Checks all Implementation Groups (IG1, IG2, IG3) to identify which ones
+        contain the specified control, enabling display of IG membership badges.
+        
+        Args:
+            control_id: Control identifier (e.g., "1.5", "2.1")
+            implementation_groups: All IG data from the assessment
+            
+        Returns:
+            List of IG names that include this control, in order.
+            Examples:
+            - ["IG1", "IG2", "IG3"] for a control in all IGs
+            - ["IG1", "IG2"] for a control in IG1 and IG2 only
+            - ["IG3"] for a control unique to IG3
+            - [] for a control not found in any IG
+        
+        Examples:
+            >>> _get_control_ig_membership("1.5", implementation_groups)
+            ["IG1", "IG2", "IG3"]  # Control 1.5 is in all IGs
+            
+            >>> _get_control_ig_membership("5.2", implementation_groups)
+            ["IG2", "IG3"]  # Control 5.2 is only in IG2 and IG3
+        
+        Notes:
+            - Used to display IG membership badges in Detailed Findings section
+            - Helps users understand which IGs require remediation for each control
+            - Checks IGs in order: IG1, IG2, IG3
+        """
+        member_igs = []
+        for ig_name in ['IG1', 'IG2', 'IG3']:
+            if ig_name in implementation_groups:
+                if control_id in implementation_groups[ig_name].get('controls', {}):
+                    member_igs.append(ig_name)
+        return member_igs
+    
+    def _sort_control_id(self, control_id: str) -> tuple:
+        """Helper for alphanumeric sorting of control IDs.
+        
+        Converts control IDs like "1.1", "1.10", "2.1" into tuples of integers
+        for proper alphanumeric sorting. This ensures controls are displayed in
+        the correct order (1.1, 1.2, ..., 1.9, 1.10, 2.1, ...) rather than
+        lexicographic order (1.1, 1.10, 1.2, ...).
+        
+        Args:
+            control_id: Control identifier (e.g., "1.1", "1.10", "2.1")
+            
+        Returns:
+            Tuple of integers for sorting (e.g., (1, 1), (1, 10), (2, 1))
+            Returns (0, 0) for non-standard control IDs as fallback
+        
+        Examples:
+            >>> _sort_control_id("1.1")
+            (1, 1)
+            
+            >>> _sort_control_id("1.10")
+            (1, 10)
+            
+            >>> _sort_control_id("2.1")
+            (2, 1)
+            
+            >>> _sort_control_id("invalid")
+            (0, 0)  # Fallback for non-standard IDs
+        
+        Sorting Behavior:
+            Without this helper:
+            ["1.1", "1.10", "1.2", "2.1"]  # Incorrect lexicographic order
+            
+            With this helper:
+            ["1.1", "1.2", "1.10", "2.1"]  # Correct numeric order
+        
+        Notes:
+            - Used in _consolidate_findings_by_control() for sorting
+            - Handles multi-level control IDs (e.g., "1.2.3" -> (1, 2, 3))
+            - Gracefully handles malformed control IDs
+        """
+        try:
+            # Split by '.' and convert to integers
+            parts = control_id.split('.')
+            return tuple(int(part) for part in parts)
+        except (ValueError, AttributeError):
+            # Fallback for non-standard control IDs
+            return (0, 0)