What
When a founder sees their findings, the most impactful ones should be first — not sorted by NIST control ID.
Why
"Your patient data is transmitted without encryption" matters more than "Your KMS key rotation is set to 365 days." Right now both show up as equal-weight items in a list sorted by AC-2, AU-2, SC-28.
Proposed scoring
priority = severity × cross_framework_impact × (1 / effort_to_fix)
- Severity: CRITICAL=4, HIGH=3, MEDIUM=2, LOW=1
- Cross-framework impact: how many active frameworks this control appears in (from cross-framework matrix)
- Effort inverse: quick fixes rank higher (code grep findings are faster to fix than cloud infra changes)
Surface top 5 as "Fix these first" in the dashboard and /comply status output.
Where this shows up
- Dashboard overview — "Top 5 things to fix" section
/comply status output — prioritized recommendation/comply-auto — work on highest-priority controls first
Effort
S (human: ~3 days / CC: ~15 min). The data already exists in SQLite + cross-framework matrix.
What
When a founder sees their findings, the most impactful ones should be first — not sorted by NIST control ID.
Why
"Your patient data is transmitted without encryption" matters more than "Your KMS key rotation is set to 365 days." Right now both show up as equal-weight items in a list sorted by AC-2, AU-2, SC-28.
Proposed scoring
priority = severity × cross_framework_impact × (1 / effort_to_fix)Surface top 5 as "Fix these first" in the dashboard and
/complystatus output.Where this shows up
/complystatus output — prioritized recommendation/comply-auto— work on highest-priority controls firstEffort
S (human: ~3 days / CC: ~15 min). The data already exists in SQLite + cross-framework matrix.