What
Independent audit of nist/gdpr-filter.json — verify that each GDPR article correctly maps to the right NIST 800-53 controls.
Why
GDPR-to-800-53 mapping is less standardized than HIPAA or SOC 2. This filter was created by an AI using ENISA guidance and ISO 27001 crosswalks. It especially needs expert review because:
- GDPR has privacy-specific requirements (consent, right to erasure, DPO) that don't map cleanly to 800-53 security controls
- Some articles may need interview-only controls that aren't captured
- The mapping scope (which articles to include) is debatable
What to audit
The file is nist/gdpr-filter.json (~40 lines). For each mapping:
- Is the Article reference correct? (Art. 5(1)(f), Art. 32(1)(a), etc.)
- Are the right 800-53 controls mapped?
- Are privacy-specific articles (Art. 6, Art. 15, Art. 17) adequately represented?
- Should more articles be included?
How to contribute
- Read
nist/gdpr-filter.json
- Cross-reference against ENISA guidelines or NIST Privacy Framework
- Open a PR with corrections, or comment with findings
- Test:
bin/comply-db init --framework gdpr
Current state
19 GDPR articles → 22 unique 800-53 controls. Likely incomplete — GDPR has ~99 articles.
Who should review
- GDPR DPOs (Data Protection Officers)
- EU privacy lawyers
- Engineers who've implemented GDPR compliance
- Anyone familiar with ENISA's GDPR technical guidance
What
Independent audit of
nist/gdpr-filter.json— verify that each GDPR article correctly maps to the right NIST 800-53 controls.Why
GDPR-to-800-53 mapping is less standardized than HIPAA or SOC 2. This filter was created by an AI using ENISA guidance and ISO 27001 crosswalks. It especially needs expert review because:
What to audit
The file is
nist/gdpr-filter.json(~40 lines). For each mapping:How to contribute
nist/gdpr-filter.jsonbin/comply-db init --framework gdprCurrent state
19 GDPR articles → 22 unique 800-53 controls. Likely incomplete — GDPR has ~99 articles.
Who should review