Years making control frameworks into things systems actually do.

Federal cybersecurity across security control assessment, ISSO, ISSM, and AODR roles, with end to end authorization ownership on 15 or more classified systems. The recurring problem in that work: the controls live in a document, the system lives somewhere else, and reconciling the two is manual, annual, and stale by the time anyone reads it.

These repositories close that gap. Each takes a compliance process normally run in spreadsheets and makes it executable, testable, and reproducible.

AWS Organization baseline where control coverage is derived from the code.

Every Terraform module declares which controls it implements. CI fails on an unmapped module or an unknown control identifier, so the mapping cannot drift from the infrastructure the way a spreadsheet does.

The catalog carries SOC 2, PCI DSS 4.0, and NIST 800-53 Rev. 5 together, so one implementation produces evidence for three frameworks instead of three parallel evidence efforts. A gaps command reports which controls have no infrastructure behind them. That list is the input to a risk acceptance decision, not a surprise during an audit.

Terraform AWS Organizations SOC 2 PCI DSS NIST 800-53

Hardening as a measured cycle rather than a scan screenshot.

Baseline scan, deliberate regression, idempotent PowerShell remediation, verification scan, and a report generated from the scan export rather than typed from a console.

One control starts compliant on purpose. A lab that only fixes things never proves the scanner detects regression, which is the property continuous monitoring actually depends on.

DISA STIG Tenable Nessus PowerShell Vulnerability Management

A crosswalk that authors no mappings of its own.

Normalizes the NIST OLIR crosswalk between SP 800-53 Rev. 5 and ISO/IEC 27001:2022 into JSON and CSV with provenance on every row, down to the hash of the source file each row came from.

Controls with no published relationship are reported as unmapped. They do not get a plausible guess, because a guess in a compliance artifact is indistinguishable from a fact once someone copies the file.

NIST OLIR ISO 27001 800-53 Python

Spreadsheet control responses to a valid OSCAL 1.1.2 SSP.

Deterministic identifiers, component reference validation, and baseline coverage checking before it writes anything. A strict mode refuses to emit an incomplete package, because a package that validates while omitting controls is worse than one that fails loudly.

OSCAL FedRAMP NIST 800-53 Python

Sourced or labeled. Mappings from a published authority cite it. Mappings from engineering judgment say so in the data itself. A judgment call presented as authoritative is worse than no mapping.

Suppressions carry reasons. Where a finding is suppressed, the justification sits next to the code. A suppression with a reason is a risk decision. Without one, it is a finding someone hid.

Limits written down. Each repository states what was not tested and what was not verified. Overstating coverage costs more than admitting a gap.

Synthetic data only. Nothing here comes from a real system, client, or engagement.

Active DoD Top Secret clearance with DHS suitability. Washington, DC metro area.