Framework mappings

The public mapping set registers supported framework families and preserves their assessment state. Registration is not applicability, implementation, conformity, certification, or control-effectiveness evidence.

Current mapping set

Property	Value
Mapping set	[email protected]
Frameworks registered	14
Requirement denominator	1
Mapping denominator	1
Current implementation status	1 Not Assessed
Current applicability	1 Applicability Unknown
Success percentage	Not calculated
Next review	2027-01-29

The exact generated data is available as the mapping catalog and mapping manifest. The manifest binds the catalog digest and keeps every applicability and implementation-status denominator visible. Not Applicable and Not Assessed records are never counted as successes.

Registered framework families

• BSI IT-Grundschutz and BSI Standards 200-1 through 200-4;
• CIS Benchmarks;
• OpenSSF Best Practices and OpenSSF Scorecard;
• SLSA, SPDX, CycloneDX, in-toto, and Sigstore; and
• NIST Secure Software Development Framework.

All are currently registered as Not Assessed. Framework requirements are added only after authority/version review; licensed or normative text is linked rather than copied.

Evidence and claim boundary

Mapping evidence is joined by immutable Evidence Center record reference and a controlled relation. An Implemented statement is rejected unless its exact scope has current admissible supporting evidence. Unavailable, withheld, failed, expired, or revoked evidence cannot establish implementation.

The migrated BSI record retains only public documentation context. Applicability and target-object decisions remain in an authorized protected assessment. Review the BSI mapping approach for the current navigation guidance and the compliance mapping model for the governance contract.