Compliance audit answer

Audit

For a whole framework: every control, the ATT&CK techniques it defends, and whether you can detect them

This is the one-page answer to "are my controls actually backed by detection?". For each control in the framework it shows the ATT&CK techniques the control maps to, and marks each technique detectable when a real rule (Sigma, CAR, IDS, YARA, Falco) covers it, or a gap when nothing does. Honest by construction: control-to-technique links come only from the published mappings, and a technique counts as detectable only if a real rule maps to it. Controls with no ATT&CK mapping are shown as such, not hidden. Export the full matrix for your auditor below.

NIST 800-53 (1246)NIST CSF (106)ISO 27001:2022 (93)PCI-DSS v4.0 (75)CIS v8.1 (62)CRI Profile (60)CSA CCM v4 (57)SOC 2 TSC (57)OWASP API (10)OWASP Mobile (10)OWASP Web (10)

SOC 2 TSC controls

controls with ATT&CK mapping

242

distinct techniques defended

168

of those, detectable

69%

overall detection coverage

Export matrix (CSV) Export (JSON) the artifact to hand an auditor

▤

Coverage by control family

13 families

Family	Controls	Mapped	Techniques	Detectable	Coverage
Availability	3	1	12	8	66%
CC1 · Control Environment	5	0	0	0	0%
CC2 · Communication & Information	3	0	0	0	0%
CC3 · Risk Assessment	4	0	0	0	0%
CC4 · Monitoring	2	0	0	0	0%
CC5 · Control Activities	3	0	0	0	0%
CC6 · Logical & Physical Access	8	4	120	84	70%
CC7 · System Operations	5	1	12	8	66%
CC8 · Change Management	1	1	27	15	55%
CC9 · Risk Mitigation	2	0	0	0	0%
Confidentiality	2	2	64	39	60%
Privacy	14	7	132	99	75%
Processing Integrity	5	1	101	78	77%

▤

Control-by-control coverage

57 controls

NIST 800-53 ATT&CK mappings are published at the base-control level (e.g. AC-18), so the 40 sub-control enhancements (AC-18.1, AC-18.2, …) carry no direct technique mapping - their coverage is inherited from the base control. They are hidden by default. show all controls including unmapped enhancements

A1.1 Maintains, monitors, and evaluates current processing capacity and use of system components enhancement of A1

A1.2 Develops, documents, and maintains environmental protections, software, data backup processes enhancement of A1

A1.3 Recovers and restores the system after disruption to meet commitments 8/12 detectable

T1485.001 T1491 T1491.002 T1561 T1485 T1486 T1490 T1491.001 T1561.001 T1561.002 T1565 T1565.001

CC1.1 COSO Principle 1: Demonstrates commitment to integrity and ethical values enhancement of CC1

CC1.2 COSO Principle 2: Exercises oversight responsibility enhancement of CC1

CC1.3 COSO Principle 3: Establishes structure, authority, and responsibility enhancement of CC1

CC1.4 COSO Principle 4: Demonstrates commitment to competence enhancement of CC1

CC1.5 COSO Principle 5: Enforces accountability enhancement of CC1

CC2.1 COSO Principle 13: Uses relevant information enhancement of CC2

CC2.2 COSO Principle 14: Communicates internally enhancement of CC2

CC2.3 COSO Principle 15: Communicates externally enhancement of CC2

CC3.1 COSO Principle 6: Specifies suitable objectives enhancement of CC3

CC3.2 COSO Principle 7: Identifies and analyzes risk enhancement of CC3

CC3.3 COSO Principle 8: Assesses fraud risk enhancement of CC3

CC3.4 COSO Principle 9: Identifies and analyzes significant change enhancement of CC3

CC4.1 COSO Principle 16: Conducts ongoing and/or separate evaluations enhancement of CC4

CC4.2 COSO Principle 17: Evaluates and communicates deficiencies enhancement of CC4

CC5.1 COSO Principle 10: Selects and develops control activities enhancement of CC5

CC5.2 COSO Principle 11: Selects and develops general controls over technology enhancement of CC5

CC5.3 COSO Principle 12: Deploys through policies and procedures enhancement of CC5

CC6.1 Implements logical access security measures to authorized users 55/81 detectable

CC6.2 Prior to issuing credentials and granting access, registers and authorizes new users 59/85 detectable

CC6.3 Removes access to protected information when appropriate 4/4 detectable

T1078 T1078.002 T1078.003 T1078.004

CC6.4 Restricts access to protected information using physical security controls 82/118 detectable

T1020.001 T1021.008 T1048.002 T1052 T1052.001 T1059.008 T1070.002 T1070.008 T1098.002 T1110.003 T1110.004 T1111 T1114.002 T1127.002 T1213.001 T1213.002 T1213.005 T1530 T1547.012 T1547.013 T1556.001 T1556.003 T1558.002 T1558.004 T1563 T1563.001 T1567.003 T1567.004 T1578.005 T1602 T1602.001 T1602.002 T1612 T1647 T1651 T1659 T1021 T1021.001 T1021.002 T1021.003 T1021.004 T1021.005 T1021.006 T1021.007 T1037 T1037.001 T1040 T1041 T1047 T1048 T1048.003 T1059 T1059.001 T1059.002 T1059.003 T1059.004 T1059.005 T1059.006 T1059.007 T1070 T1070.001 T1072 T1078.002 T1078.004 T1098.001 T1098.003 T1098.004 T1098.005 T1110 T1110.001 T1110.002 T1114 T1114.001 T1114.003 T1119 T1133 T1134.005 T1136 T1136.001 T1136.002 T1136.003 T1137 T1137.002 T1200 T1213 T1219 T1505.004 T1505.005 T1537 T1539 T1543 T1547.003 T1547.004 T1547.009 T1550.001 T1552 T1552.002 T1552.004 T1552.005 T1552.007 T1555 T1556 T1556.004 T1557 T1557.002 T1558 T1558.003 T1563.002 T1565 T1565.001 T1565.002 T1567 T1567.001 T1567.002 T1609 T1610 T1613 T1619

CC6.5 Authenticates entities and authorizes their access to protected information assets enhancement of CC6

CC6.6 Implements controls to prevent or detect and act upon introduction of unauthorized or malicious software enhancement of CC6

CC6.7 Restricts the transmission, movement, and removal of information enhancement of CC6

CC6.8 Implements controls to prevent or detect and act upon unauthorized physical access enhancement of CC6

CC7.1 Detects and monitors for new vulnerabilities enhancement of CC7

CC7.2 Monitors system components for anomalous behavior enhancement of CC7

CC7.3 Evaluates security events to determine whether they could or have resulted in failure enhancement of CC7

CC7.4 Responds to identified security incidents per incident response program enhancement of CC7

CC7.5 Identifies, develops, and implements activities to recover from identified security incidents 8/12 detectable

T1485.001 T1491 T1491.002 T1561 T1485 T1486 T1490 T1491.001 T1561.001 T1561.002 T1565 T1565.001

CC8.1 Authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes 15/27 detectable

CC9.1 Identifies, selects, and develops risk mitigation activities enhancement of CC9

CC9.2 Assesses and manages risks associated with vendors and business partners enhancement of CC9

C1.1 Identifies and maintains confidential information to meet objectives related to confidentiality 26/42 detectable

C1.2 Disposes of confidential information to meet objectives related to confidentiality 39/64 detectable

P1.1 Provides notice to data subjects about its privacy practices enhancement of P1

P2.1 Communicates choices available to data subjects and obtains implicit or explicit consent enhancement of P2

P3.1 Collects personal information consistent with the entity's objectives enhancement of P3

P3.2 Collects personal information using methods consistent with commitments to data subjects 20/34 detectable

P4.1 Limits the use of personal information to the purposes identified in the notice enhancement of P4

P4.2 Retains personal information consistent with entity's privacy commitments 20/34 detectable

P4.3 Disposes of personal information consistent with entity's privacy commitments 20/34 detectable

P5.1 Grants data subjects the ability to access their personal information 4/4 detectable

T1078 T1078.002 T1078.003 T1078.004

P5.2 Corrects or amends personal information upon request 78/101 detectable

P6.1 Discloses personal information to third parties with the implicit or explicit consent of data subjects enhancement of P6

P6.2 Creates and retains a complete, accurate, and timely record of authorized disclosures enhancement of P6

P6.3 Creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures enhancement of P6

P7.1 Collects and maintains accurate, up-to-date, complete, and relevant personal information 78/101 detectable

P8.1 Provides data subjects with an accounting of personal information held and corrects errors 4/4 detectable

T1078 T1078.002 T1078.003 T1078.004

PI1.1 Obtains or generates, uses, and communicates relevant, quality information enhancement of PI1

PI1.2 Implements policies and procedures over system inputs, including controls over completeness and accuracy 78/101 detectable

PI1.3 Implements policies and procedures over system processing enhancement of PI1

PI1.4 Implements policies and procedures to make available or deliver output completely, accurately, and timely enhancement of PI1

PI1.5 Implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely enhancement of PI1

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin