/cyber-framework-mapping

name: cyber-framework-mapping
guardrail: true
description: Maintains sparse, reviewable cybersecurity framework edges with versioned IDs, relation, rationale, source, and review status. Use when mapping exercise observations or procedures to NIST, ATT&CK, or another named framework.
metadata:
  labels: [cybersecurity, framework-mapping, provenance]
  triggers:
    keywords: [framework mapping, control mapping, ATT&CK mapping, NIST mapping, framework edge, mapping review]

Cyber Framework Mapping

**Priority: P1 (HIGH)**

Map only evidenced relationships; catalog context is not proof of efficacy, compliance, or coverage.

Structure

cyber-framework-mapping/
├── SKILL.md
├── references/edge-record.md
└── evals/evals.json

Workflow

1. Name framework, version, stable ID, and exact source URL or document section. 2. Choose relation (`supports`, `describes`, `observed-as`, `partial`, `unknown`, or `conflicts`). 3. Write a bounded rationale tied to an evidence record, not a generic similarity. 4. Set review status: `reviewed`, `needs-review`, or `unreviewed`; include reviewer and date when reviewed. 5. Preserve empty or unknown mappings explicitly; do not infer a complete catalog. 6. On a version/source change, preserve the prior versioned edge and its evidence unchanged. Create a separately versioned candidate linked to the prior record, mark it `needs-review`, and re-review; never overwrite historical mappings.

Rules

• Prefer primary framework publications and official technique catalogs.
• Keep framework IDs version-qualified; never silently merge revisions.
• Separate a mapped edge from a control claim, measured efficacy, or compliance assertion.
• Link [shared evidence fields](../cyber-evidence/SKILL.md) for observation provenance.

For mapped observations, carry `engagement_scope_ref`, `skill_version`, `source`, `observed_at`, `finding_status`, `evidence_refs`, `limitations`, and `accountable_owner`.

Anti-Patterns

• **No broad equivalence**: One keyword does not establish a mapping.
• **No version drift**: Verify the current revision before reusing an ID.
• **No compliance leap**: Mapping never certifies a control or outcome.
• **No fabricated completeness**: Mark unknown edges and gaps.

References

• [Framework edge schema](references/edge-record.md)