| name | control-mapping |
| description | Maps controls across cybersecurity frameworks using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Use when helping with control implementation, compliance mapping, cross-framework alignment, or understanding control relationships. |
When mapping controls:
- Cross-reference NIST SP 800-53 control definitions with target frameworks
- Identify baseline control families (AC, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, RA, SA, SC, SI, SR)
- Use IR 8477 set-theory relationships to characterize mappings (equal, subset_of, superset_of, intersects_with, not_related)
- Flag any control gaps or special framework-specific considerations
- Provide implementation examples and rationale (syntactic, semantic, functional)
- Include control enhancements and strength scores (1-10 STRM scale)
NIST IR 8477 Methodology
Mappings follow IR 8477 Set-Theory Relationship Mapping (STRM):
- Focal Document Element (FDE): The source control being mapped FROM
- Reference Document Element (RDE): The target control being mapped TO
- Relationship types: equal (A=B), subset_of (A subset B), superset_of (A superset B), intersects_with (partial overlap), not_related (disjoint)
- Rationale types: syntactic (wording), semantic (meaning), functional (outcome)
- Strength score: 1-10 computed from relation type, confidence, and rationale
- Transitivity: Derive A to C from A to B and B to C chains using set-theory rules
MCP Tools
When the grc-mcp-server is available, prefer these tools:
| MCP Tool | Use For |
|---|
grc_map_control | Map controls between frameworks with IR 8477 set-theory relationships |
grc_strm_analyze | Detailed IR 8477 STRM analysis (relation, rationale, strength, inverse) |
grc_transitive_map | Derive transitive mappings using set-theory transitivity rules |
grc_strm_summary | Distribution of relation/rationale/confidence across all mappings |
grc_reverse_map | Find all source mappings for a target control |
grc_coverage_report | Coverage percentage between source and target frameworks |
grc_get_oscal_control | Extract full NIST/FedRAMP control details (statement, params, assessment) |
grc_lookup_control | Control catalog lookup by ID |
grc_search_controls | Full-text search across control catalog |
Fallback: If MCP tools are unavailable, read mapping files from grc-pro/knowledge/mappings/ and OSCAL data from grc-pro/knowledge/oscal/.
