oscal-control-mapper

To map NIST 800-53 controls to ISO 27001, the skill builds OSCAL 1.2.0 control mappings using authoritative catalogs. It generates a structured, machine-readable control-mappings document defining relationship types like equal or subset with clear rationale.

An OSCAL control-mapping document is used to express relationships between source and target security framework controls. It supports multi-framework compliance, framework migration, and vendor control correlation by capturing mapping rationales in a machine-readable format.

Yes, you can define specific relationship types such as equal, subset, superset, intersects, and not-equal when mapping security frameworks. This ensures precise correlation between source and target controls within your OSCAL mapping sets.

Yes, you need OSCAL 1.2.0-compatible catalogs to generate control mappings. The process requires importing authoritative catalogs to ensure validation via oscal-validator and to produce a ready-to-consume, machine-readable control-mappings document.

The oscal-validator ensures mapping accuracy by enforcing the use of authoritative catalogs, unique UUIDs, and the OSCAL 1.2.0 control-mapping model. This validation produces a ready-to-consume document suitable for auditors and tooling.