For a whole framework: every control, the ATT&CK techniques it defends, and whether you can detect them
This is the one-page answer to "are my controls actually backed by detection?". For each control in the framework it shows the ATT&CK techniques the control maps to, and marks each technique detectable when a real rule (Sigma, CAR, IDS, YARA, Falco) covers it, or a gap when nothing does. Honest by construction: control-to-technique links come only from the published mappings, and a technique counts as detectable only if a real rule maps to it. Controls with no ATT&CK mapping are shown as such, not hidden. Export the full matrix for your auditor below.
NIST 800-53 ATT&CK mappings are published at the base-control level (e.g. AC-18), so the 50 sub-control enhancements (AC-18.1, AC-18.2, …) carry no direct technique mapping - their coverage is inherited from the base control. They are hidden by default.
7Restrict Access to System Components and Cardholder Data by Business Need to Knowno ATT&CK mapping
7.1Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understoodenhancement of 7
7.2Access to system components and data is appropriately defined and assignedenhancement of 7
7.3Access to system components and data is managed via an access control system(s)enhancement of 7
3.7Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented11/17 detectable
10Log and Monitor All Access to System Components and Cardholder Datano ATT&CK mapping
10.1Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documentedenhancement of 10
10.2Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsenhancement of 10
10.3Audit logs are protected from destruction and unauthorized modificationsenhancement of 10
10.4Audit logs are reviewed to identify anomalies or suspicious activityenhancement of 10
10.5Retain audit log history for at least 12 monthsenhancement of 10
10.6Time-synchronization mechanisms support consistent time settings across all systemsenhancement of 10
10.7Failures of critical security controls are detected, reported, and responded to promptlyenhancement of 10
4Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks10/16 detectable
4.1Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documentedenhancement of 4
4.2PAN is protected with strong cryptography during transmission7/11 detectable
12Support Information Security with Organizational Policies and Programsno ATT&CK mapping
12.1A comprehensive information security policy that governs and provides direction for protection of the entity's information assets is known and currentenhancement of 12
12.10Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyenhancement of 12
12.2Acceptable use policies for end-user technologies are defined and implementedenhancement of 12
12.3Risks to the cardholder data environment are formally identified, evaluated, and managedenhancement of 12
12.4PCI DSS compliance is managed throughout the yearenhancement of 12
12.5PCI DSS scope is documented and validatedenhancement of 12
12.6Security awareness education is an ongoing activityenhancement of 12
12.7Personnel are screened to reduce risks from insider threatsenhancement of 12
12.8Risk to information assets associated with third-party service provider (TPSP) relationships is managedenhancement of 12
12.9Third-party service providers (TPSPs) support their customers' PCI DSS complianceenhancement of 12
11Test Security of Systems and Networks Regularlyno ATT&CK mapping
11.1Processes and mechanisms for regularly testing security of systems and networks are defined and understoodenhancement of 11
11.2Wireless access points are identified and monitoredenhancement of 11
11.3External and internal vulnerabilities are regularly identified, prioritized, and addressedenhancement of 11
11.4External and internal penetration testing is regularly performedenhancement of 11
11.5Network intrusions and unexpected file changes are detected and responded toenhancement of 11
11.6Unauthorized changes on payment pages are detected and responded toenhancement of 11