Map one control to clauses in three frameworks

short · 40 min · Objective 1.5

Task

Take one implemented control and map it across three frameworks, recording partial mappings AS partial -- which is the discipline the whole approach rests on.

Steps

  1. Pick one control you actually implemented in the lab build -- multi-factor on administrative access is a good choice.
  2. Extend lab/control-matrix.csv with columns clause_c,coverage,gap_note so each control carries three clause references and a coverage value of full or partial.
  3. For every partial, write the specific sub-requirement not met in gap_note. A partial with an empty gap note is the accumulation of 80%-true ticks the lesson warns about.
  4. Add three more controls, mapped the same way, deliberately including one clause that requires SEVERAL controls together.
  5. Write lab/mapping-review.md naming the owner of the mapping and the event that would force a review of it.

Verify

awk -F, 'NR>1 {print $NF}' lab/control-matrix.csv | head -1
awk -F, 'NR>1 && NF>=8 {n++} END {print n" fully mapped control(s)"}' lab/control-matrix.csv
awk -F, 'NR>1 && $(NF-1)=="partial" && $NF=="" {n++} END {print n+0" partial(s) with no gap note"}' lab/control-matrix.csv
grep -Eci 'owner|review' lab/mapping-review.md

Four or more controls mapped to three frameworks, and ZERO partials with an empty gap note. If you have no partials at all, the mapping is optimistic -- one control rarely satisfies a whole clause in three different regimes.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.