Compliance mapping

Auditors, especially in banking and finance, expect a pentest report to say which compliance control each finding relates to. PEART builds that map for you, and it does so under one firm principle: it relates, it does not certify. A finding relates to control X of framework Y; whether the organization is compliant is the auditor's conclusion, not the tool's.

A report displays NIST SP 800-53 Rev. 5, derived through a redistributed MITRE CWE-to-800-53 crosswalk. The mechanism is framework-generic, but not every framework arrives the same way. Privacy laws (LGPD, GDPR) are related through a separate, PEART-authored crosswalk that maps a finding to potential regulatory nexuses rather than to controls, and never asserts certification; frameworks are chosen per engagement, so a report carries only the ones relevant to its jurisdiction. ISO 27001 and CIS are constrained by the licence of their control text.

Derived, not hand-tagged

The pentester tags nothing for compliance. Each technique already carries its CWE codes; a curated CWE-to-NIST crosswalk turns those into related NIST controls, and a finding inherits the controls of its linked techniques as the union, live. Change the linked techniques or the crosswalk, and the derived controls follow. Coverage is honest: a weakness with no clean control contributes nothing rather than a forced one, and the deliberately blank entries are recorded for auditability.

The wording carries the confidence rather than a badge. A firm relation is asserted directly ("related NIST 800-53 controls: ..."); a conditional one enters more softly, with its condition stated, and is never asserted with the same force. There is no "confidence: medium" label on a finding, because in a professional report a low-confidence badge reads as sloppiness and undermines the report it sits in.

Expert curation

The derived map is a baseline, not a verdict. In the normal finding editor, the Mappings card has a compliance section where an expert can add, remove or refine a control, refining meaning overriding its relation, confidence or condition. A curated finding shows a marker, the way an adjusted severity shows it was adjusted, so it is always visible that a human shaped the map.

Derived and curated behave differently on purpose. The derived controls stay live, following the catalog. An expert's override freezes: the decision sticks, and a later change to the catalog does not silently overwrite it. Removing a control by hand keeps it removed even if the crosswalk would derive it again.

Review at release

Releasing a report opens a review of every finding's compliance mappings, live, before you confirm. This is a review step, not a gate: the DPO passes an eye over the composed map and proceeds. On release, the mappings freeze into that report, so a delivered report is a fixed record of what it stated, even as the live view of the finding keeps evolving afterward. Withdrawing and re-releasing re-freezes from the current live view.

Provenance

A report carries the provenance of the map on three axes, so it is auditable: NIST SP 800-53 Rev. 5, the crosswalk version, and CWE 4.20. A framework and a crosswalk both change over time; the version is what turns numbers on a page into a map an auditor can trust.