code-to-control-mapper

name	code-to-control-mapper
description	Maps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied.
allowed-tools	Bash, Read, Glob, Write, Edit

Code-to-Control Mapper

Maps infrastructure-as-code (IaC) files to specific compliance framework controls. Translates technical implementations into audit-ready compliance evidence.

Quick Commands

Map a Terraform file to SOC 2:

node plugins/grc-engineer/scripts/map-control.js main.tf SOC2

Map Kubernetes manifests to ISO 27001:

node plugins/grc-engineer/scripts/map-control.js k8s/deployment.yaml ISO27001

Map CloudFormation template to NIST 800-53:

node plugins/grc-engineer/scripts/map-control.js template.yaml NIST80053

Supported Frameworks

• SOC2 - Service Organization Control 2 (CC6.1, CC7.2, etc.)
• ISO27001 - ISO/IEC 27001 (Annex A controls)
• NIST80053 - NIST Special Publication 800-53
• PCIDSS - Payment Card Industry Data Security Standard
• HIPAA - Health Insurance Portability and Accountability Act
• GDPR - General Data Protection Regulation

Supported IaC Formats

• Terraform (.tf, .tfvars)
• Kubernetes (.yaml, .yml)
• CloudFormation (.yaml, .json)
• Ansible (.yml)
• Pulumi (.ts, .js, .py)

Output Format

Generates markdown reports with:

• Control ID and description
• Evidence location (file:line)
• Compliance status (Satisfied/Partial/Not Satisfied)
• Recommendations for improvement

Example Output

# Compliance Mapping Report

## SOC 2 - CC6.1: Logical and Physical Access Controls

**Status:** ✅ Satisfied

**Evidence:**
- `main.tf:45` - `aws_db_instance` with `storage_encrypted = true`
- `main.tf:52` - IAM role with least privilege policy

**Mapping:** Data at rest encryption via AWS KMS satisfies encryption requirements.

Prerequisites

• IaC file to analyze
• Optional: Framework name (defaults to SOC2)