What
Independent audit of nist/soc2-filter.json — verify that each SOC 2 Trust Service Criteria correctly maps to the right NIST 800-53 controls.
Why
This filter was created by an AI interpreting the AICPA TSC-to-COSO-to-800-53 crosswalk. It needs review by someone who actually knows SOC 2.
What to audit
The file is nist/soc2-filter.json (~80 lines). For each mapping:
- Is the TSC criteria ID correct? (CC1.1, CC6.1, A1.1, C1.1, etc.)
- Are the right 800-53 controls mapped?
- Are any mappings missing?
- Are any mappings wrong?
How to contribute
- Read
nist/soc2-filter.json
- Cross-reference against AICPA TSC 2017 mapping
- Open a PR with corrections, or comment with findings
- Test:
bin/comply-db init --framework soc2 should import corrected controls
Current state
38 TSC specs → 40 unique 800-53 controls. May be incomplete or inaccurate.
Who should review
- SOC 2 auditors or GRC professionals
- Engineers who've completed a SOC 2 Type II audit
- Anyone with access to AICPA's official mapping
What
Independent audit of
nist/soc2-filter.json— verify that each SOC 2 Trust Service Criteria correctly maps to the right NIST 800-53 controls.Why
This filter was created by an AI interpreting the AICPA TSC-to-COSO-to-800-53 crosswalk. It needs review by someone who actually knows SOC 2.
What to audit
The file is
nist/soc2-filter.json(~80 lines). For each mapping:How to contribute
nist/soc2-filter.jsonbin/comply-db init --framework soc2should import corrected controlsCurrent state
38 TSC specs → 40 unique 800-53 controls. May be incomplete or inaccurate.
Who should review