Compliance audit answer

Audit

For a whole framework: every control, the ATT&CK techniques it defends, and whether you can detect them

This is the one-page answer to "are my controls actually backed by detection?". For each control in the framework it shows the ATT&CK techniques the control maps to, and marks each technique detectable when a real rule (Sigma, CAR, IDS, YARA, Falco) covers it, or a gap when nothing does. Honest by construction: control-to-technique links come only from the published mappings, and a technique counts as detectable only if a real rule maps to it. Controls with no ATT&CK mapping are shown as such, not hidden. Export the full matrix for your auditor below.

NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)

ISO 27001:2022 controls

controls with ATT&CK mapping

204

distinct techniques defended

138

of those, detectable

67%

overall detection coverage

Export matrix (CSV) Export (JSON) the artifact to hand an auditor

▤

Coverage by control family

4 families

Family	Controls	Mapped	Techniques	Detectable	Coverage
Organizational	37	5	89	64	71%
People	8	1	118	82	69%
Physical	14	1	34	20	58%
Technological	34	12	133	83	62%

▤

Control-by-control coverage

93 controls

NIST 800-53 ATT&CK mappings are published at the base-control level (e.g. AC-18), so the 74 sub-control enhancements (AC-18.1, AC-18.2, …) carry no direct technique mapping - their coverage is inherited from the base control. They are hidden by default. show all controls including unmapped enhancements

A.5.1 Policies for information security enhancement of A

A.5.10 Acceptable use of information and other associated assets enhancement of A

A.5.11 Return of assets enhancement of A

A.5.12 Classification of information enhancement of A

A.5.13 Labelling of information enhancement of A

A.5.15 Access control enhancement of A

A.5.16 Identity management 4/4 detectable

T1078 T1078.002 T1078.003 T1078.004

A.5.17 Authentication information enhancement of A

A.5.18 Access rights 4/4 detectable

T1078 T1078.002 T1078.003 T1078.004

A.5.19 Information security in supplier relationships enhancement of A

A.5.2 Information security roles and responsibilities enhancement of A

A.5.20 Addressing information security within supplier agreements enhancement of A

A.5.21 Managing information security in the ICT supply chain enhancement of A

A.5.22 Monitoring, review and change management of supplier services enhancement of A

A.5.23 Information security for use of cloud services enhancement of A

A.5.24 Information security incident management planning and preparation enhancement of A

A.5.25 Assessment and decision on information security events enhancement of A

A.5.26 Response to information security incidents enhancement of A

A.5.27 Learning from information security incidents enhancement of A

A.5.28 Collection of evidence enhancement of A

A.5.29 Information security during disruption enhancement of A

A.5.3 Segregation of duties enhancement of A

A.5.30 ICT readiness for business continuity enhancement of A

A.5.31 Legal, statutory, regulatory and contractual requirements enhancement of A

A.5.32 Intellectual property rights enhancement of A

A.5.33 Protection of records 20/34 detectable

A.5.34 Privacy and protection of PII enhancement of A

A.5.35 Independent review of information security enhancement of A

A.5.36 Compliance with policies, rules and standards for information security enhancement of A

A.5.37 Documented operating procedures enhancement of A

A.5.4 Management responsibilities enhancement of A

A.5.5 Contact with authorities enhancement of A

A.5.6 Contact with special interest groups enhancement of A

A.5.7 Threat intelligence 8/8 detectable

T1068 T1190 T1195 T1195.001 T1195.002 T1210 T1211 T1212

A.5.8 Information security in project management enhancement of A

A.5.9 Inventory of information and other associated assets enhancement of A

A.6.1 Screening enhancement of A

A.6.2 Terms and conditions of employment enhancement of A

A.6.3 Information security awareness, education and training enhancement of A

A.6.4 Disciplinary process enhancement of A

A.6.5 Responsibilities after termination or change of employment enhancement of A

A.6.6 Confidentiality or non-disclosure agreements enhancement of A

A.6.7 Remote working 82/118 detectable

T1020.001 T1021.008 T1048.002 T1052 T1052.001 T1059.008 T1070.002 T1070.008 T1098.002 T1110.003 T1110.004 T1111 T1114.002 T1127.002 T1213.001 T1213.002 T1213.005 T1530 T1547.012 T1547.013 T1556.001 T1556.003 T1558.002 T1558.004 T1563 T1563.001 T1567.003 T1567.004 T1578.005 T1602 T1602.001 T1602.002 T1612 T1647 T1651 T1659 T1021 T1021.001 T1021.002 T1021.003 T1021.004 T1021.005 T1021.006 T1021.007 T1037 T1037.001 T1040 T1041 T1047 T1048 T1048.003 T1059 T1059.001 T1059.002 T1059.003 T1059.004 T1059.005 T1059.006 T1059.007 T1070 T1070.001 T1072 T1078.002 T1078.004 T1098.001 T1098.003 T1098.004 T1098.005 T1110 T1110.001 T1110.002 T1114 T1114.001 T1114.003 T1119 T1133 T1134.005 T1136 T1136.001 T1136.002 T1136.003 T1137 T1137.002 T1200 T1213 T1219 T1505.004 T1505.005 T1537 T1539 T1543 T1547.003 T1547.004 T1547.009 T1550.001 T1552 T1552.002 T1552.004 T1552.005 T1552.007 T1555 T1556 T1556.004 T1557 T1557.002 T1558 T1558.003 T1563.002 T1565 T1565.001 T1565.002 T1567 T1567.001 T1567.002 T1609 T1610 T1613 T1619

A.6.8 Information security event reporting enhancement of A

A.7.1 Physical security perimeters enhancement of A

A.7.10 Storage media enhancement of A

A.7.11 Supporting utilities enhancement of A

A.7.12 Cabling security enhancement of A

A.7.13 Equipment maintenance enhancement of A

A.7.14 Secure disposal or re-use of equipment 20/34 detectable

A.7.2 Physical entry enhancement of A

A.7.3 Securing offices, rooms and facilities enhancement of A

A.7.4 Physical security monitoring enhancement of A

A.7.5 Protecting against physical and environmental threats enhancement of A

A.7.6 Working in secure areas enhancement of A

A.7.7 Clear desk and clear screen enhancement of A

A.7.8 Equipment siting and protection enhancement of A

A.7.9 Security of assets off-premises enhancement of A

A.8.1 User endpoint devices 26/42 detectable

A.8.10 Information deletion enhancement of A

A.8.12 Data leakage prevention 20/34 detectable

A.8.13 Information backup enhancement of A

A.8.14 Redundancy of information processing facilities 8/12 detectable

T1485.001 T1491 T1491.002 T1561 T1485 T1486 T1490 T1491.001 T1561.001 T1561.002 T1565 T1565.001

A.8.15 Logging enhancement of A

A.8.16 Monitoring activities enhancement of A

A.8.17 Clock synchronisation enhancement of A

A.8.18 Use of privileged utility programs enhancement of A

A.8.19 Installation of software on operational systems 28/33 detectable

A.8.2 Privileged access rights enhancement of A

A.8.20 Networks security enhancement of A

A.8.21 Security of network services enhancement of A

A.8.22 Segregation of networks 1/1 detectable

T1590.002

A.8.23 Web filtering enhancement of A

A.8.25 Secure development life cycle enhancement of A

A.8.26 Application security requirements 21/34 detectable

A.8.27 Secure system architecture and engineering principles 21/34 detectable

A.8.28 Secure coding 21/34 detectable

A.8.29 Security testing in development and acceptance 21/34 detectable

A.8.3 Information access restriction enhancement of A

A.8.30 Outsourced development enhancement of A

A.8.31 Separation of development, test and production environments enhancement of A

A.8.32 Change management 15/27 detectable

A.8.33 Test information enhancement of A

A.8.34 Protection of information systems during audit testing enhancement of A

A.8.4 Access to source code enhancement of A

A.8.5 Secure authentication enhancement of A

A.8.6 Capacity management enhancement of A

A.8.7 Protection against malware enhancement of A

A.8.8 Management of technical vulnerabilities enhancement of A

A.8.9 Configuration management enhancement of A

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin