Catalog provenance and licenses

PEART's catalogs reference external standards, and it keeps the provenance and license of each explicit, because for an auditor a map is only as trustworthy as its stated source and version.

The technique catalog

The technique content is authored for PEART and licensed CC-BY-SA-4.0. Its mapping codes and any verbatim mapping titles reference OWASP WSTG 4.2, OWASP ASVS 5.0.0 (CC-BY-SA-4.0), and MITRE CWE 4.20, each under its own license. The catalog declares these versions rather than leaving them implied, so a reader knows exactly which release of each standard the codes are read against.

The compliance crosswalk

The CWE-to-NIST 800-53 rev5 crosswalk is PEART's own work-product, curated and reviewed with a certified DPO, and licensed CC-BY-4.0. It is licensed more permissively than the technique content on purpose: it maps CWE identifiers to NIST controls, neither of which is share-alike (NIST SP 800-53 identifiers are US-Government public domain, CWE identifiers reference MITRE), so it carries no share-alike obligation, and CC-BY lets the map be cited and reused freely while keeping attribution to PEART.

Every mapping is a relation, not a certification. Coverage is honest: a weakness with no clean control is left blank rather than forced, and the deliberately blank entries are listed for auditability.

Provenance in the report

When a report shows related compliance controls, it carries the provenance on three axes so the map is auditable: NIST SP 800-53 Rev. 5, the crosswalk version, and CWE 4.20. A framework and a crosswalk both evolve, and without the version the map is just numbers on a page; with it, the auditor can see exactly where each relation came from.

Vendored front-end

The front-end packages vendored under web/vendor/ are recorded with their fixed versions and licenses in web/vendor/MANIFEST.md, and they appear in the release SBOM as CycloneDX components alongside the Go modules, so the published bill of materials is complete across both ecosystems.