Summary
Currently, NIST 800-53 control mappings are maintained in a separate references/nist-mapping.md file and mapped by category (e.g., NETWORK_SECURITY → SC-7, SC-8, AC-4). Individual policy entries in the resource reference files only show the category name.
Proposed Change
Embed the specific NIST control IDs directly in each policy's reference entry, alongside the existing category field. For example:
- **Category**: NETWORK_SECURITY
- **NIST 800-53**: SC-7, SC-8, AC-4
This is already partially implemented — the CATEGORY_TO_NIST mapping exists in parse_terrascan_policies.py and policies that match a known category already show NIST controls. The enhancement would extend this to cover edge cases and potentially add more granular per-policy mappings.
Impact
- Improves compliance reporting by making controls directly visible per-finding
- No breaking changes — additive only
- Low effort — mapping infrastructure already exists in the parser
Summary
Currently, NIST 800-53 control mappings are maintained in a separate
references/nist-mapping.mdfile and mapped by category (e.g.,NETWORK_SECURITY→SC-7, SC-8, AC-4). Individual policy entries in the resource reference files only show the category name.Proposed Change
Embed the specific NIST control IDs directly in each policy's reference entry, alongside the existing category field. For example:
This is already partially implemented — the
CATEGORY_TO_NISTmapping exists inparse_terrascan_policies.pyand policies that match a known category already show NIST controls. The enhancement would extend this to cover edge cases and potentially add more granular per-policy mappings.Impact