complymap

Control mapping engine — jfind findings → DORA / NIS2 / ISO 27001 / CSSF

v1.0.0

NixOS x86_64

Quick Start

Install via jcli

jcli install complymap

End-to-end pipeline (all five jfind-emitting tools → complymap → gap report)

credsweep  --path .                  --output jfind > /tmp/a.ndjson
urlrecon   --target client.example   --output jfind > /tmp/b.ndjson
phishprobe --url 'https://suspect…'  --output jfind > /tmp/c.ndjson
specter    analyze /tmp/sample.bin   --output jfind > /tmp/d.ndjson
avwatch    check --path /etc         --output jfind > /tmp/e.ndjson

cat /tmp/{a,b,c,d,e}.ndjson > /tmp/engagement.ndjson

complymap map /tmp/engagement.ndjson -f dora,nis2,iso27001,cssf -o mapped.json --pretty
complymap gap /tmp/engagement.ndjson -f dora --entity credit-institution --format human
complymap delta /tmp/engagement.ndjson --baseline iso27001 --target dora --pretty
complymap coverage /tmp/engagement.ndjson -f dora,nis2,iso27001,cssf

What it does

complymap is the bridge between security-tool findings (everything the cli.johlem.net suite emits as jfind/v1) and the regulatory controls a Luxembourg consultant has to defend to a client. It reads a jfind bundle, maps each finding to controls in four frameworks (DORA, NIS2, ISO 27001:2022, CSSF circulars 20/750 + 22/806), and surfaces a gap matrix in shapes downstream tools (dossier, future inciclass / roigen) can render.

Luxembourg differentiator. CSSF circular coverage AND a curated dora_specific[] crosswalk block that flags the five things DORA demands ISO alone does not satisfy: Art. 18 incident-classification thresholds, Art. 19 reporting deadlines, Art. 24 TLPT scope, Art. 30 contractual clauses, Art. 31 Register of Information.
Deterministic + explainable. A finding maps to a control via category match OR MITRE-technique match OR keyword substring — every rule is unit-test-pinned, so reviewing a map decision is a `grep` away. No "AI scoring", no opaque heuristics.
Offline-only. Framework data is vendored into the binary (data/frameworks/*.json). No network calls, no third-party API keys, no dependency on hosted services.
jfind-compatible everywhere. Reads jfind/v1 findings, bundles, JSON arrays, or NDJSON streams. Writes jfind-bundle/v1 (map), complymap-gap/v1 (gap), or complymap-delta/v1 (delta) — all consumable by the next tool in the consulting layer.
Pipe-clean. Stdout is structured JSON or human tables; logs go to stderr; exit codes follow the suite-wide convention.

Subcommands

Command	What it does
`complymap map <bundle>`	Enriches each finding's `controls[]` with matches from the requested frameworks. Output: `jfind-bundle/v1` or NDJSON jfind/v1.
`complymap gap <bundle>`	Per-control coverage matrix (covered / partial / gap / unknown). Output: `complymap-gap/v1` JSON or a human table. Exit 1 on any `gap`.
`complymap delta`	"You have `--baseline`; here is the `--target`-only work left." Output: `complymap-delta/v1`. Exit 1 if non-empty.
`complymap coverage`	Flat per-framework rollup with coverage percentages. Output: JSON or human table.

Frameworks shipped (v1.0)

DORA — Regulation (EU) 2022/2554. 13 articles + RTS 2024/1774 (ICT security), RTS 2024/1772 (incident classification), RTS 2025/301 / ITS 2025/302 (incident reporting), RTS 2024/1773 + ITS 2024/2956 (third-party + RoI), batch-2 TLPT RTS.
NIS2 — Directive (EU) 2022/2555. 11 controls incl. Art. 21(2)(a)-(j) security measures and Art. 23 24h/72h/1-month reporting timing.
ISO/IEC 27001:2022 — 12 Annex A controls covering the categories the five jfind-emitting tools produce (asset inventory, crypto, privileged access, malware, vulnerability, monitoring, networks, supplier relationships, incident management).
CSSF Luxembourg — 13 control points across Circulars 20/750 (ICT & security risk management) and 22/806 (outsourcing).

Extending the catalogue: drop additional { id, ref, title, keywords[], maps_to_categories[], maps_to_techniques[] } records into the framework JSONs and recompile. There's no plugin mechanism — the data IS the source of truth.

Acceptance gate

Per the consulting-layer spec (Phase 2): given a sample jfind bundle, complymap delta --baseline iso27001 --target dora lists exactly the DORA-specific items as remaining with dora_specific: true:

Art. 18 — Incident classification thresholds
Art. 19 — Reporting timing (24h / 72h / 1 month)
Art. 24 — Threat-led penetration testing (TLPT)
Art. 30 — Key contractual provisions with third-parties
Art. 31 — Register of Information (ITS 2024/2956)

Pinned by an end-to-end integration test in tests/integration/cli_tests.rs.

Exit codes

Code	Meaning
`0`	Ok — no gap status hit, or delta is empty
`1`	Gap present (gap matrix has at least one `gap`, or delta has remaining items) — use in CI to fail builds when controls slip
`2`	Usage error (clap)
`3`	Runtime — bad input file, schema parse failure, unknown framework

Touches / Produces / Gates

Touches (read-only): the jfind/v1 input file you point it at.
Touches (write): only the -o <PATH> destination, when given.
Produces: jfind-bundle/v1 (map), complymap-gap/v1 (gap), complymap-delta/v1 (delta), or GapSummary JSON (coverage). All deterministic.
Gates: none. complymap is fully offline — no network, no Anthropic API, no cloud calls.

Build from source

cd tools/complymap/rust
cargo build --release        # ./target/release/complymap
cargo test                   # 12 unit + 11 integration tests

Toolchain pin: Rust 1.85.0. Dependencies: clap, serde, serde_json, chrono, uuid, anyhow, thiserror, and the in-repo jfind library crate.

Compliance crosswalk

This table lists controls where complymap's output may form part of the evidence set presented to an assessor. It does not claim complymap alone satisfies any framework — every control still requires assessor judgment and typically evidence from other sources.

Schema: compliance-crosswalk/v1 · Machine-readable: tools/complymap/compliance.json

DORA — Digital Operational Resilience Act (Reg. 2022/2554)

Ref	Name	How	Coverage
`Art. 6`	ICT risk-management framework	gap subcommand renders a control-by-control coverage matrix for the ICT-RMF baseline.	evidences
`Art. 8`	Identification of ICT-supported functions	Reads jfind/v1 findings tagged with asset+function scope; cross-references function inventory.	supports
`Art. 18`	Classification & reporting of major ICT-related incidents	delta subcommand shows which incident-classification controls are DORA-only vs shared with NIS2.	evidences
`Art. 24`	Advanced testing (TLPT)	Consumes tiberscope scope + plan; treats them as evidence of Art.24 §3 scoping documentation.	supports

NIS2 — NIS2 Directive (Dir. 2022/2555)

Ref	Name	How	Coverage
`Art. 21 §2(a)`	Policies on risk analysis + information system security	Gap matrix aligns risk-analysis controls across DORA / NIS2 / ISO 27001.	evidences
`Art. 23`	Reporting obligations	Cross-walks with DORA Art. 17–19 incident classification.	supports

ISO27001 — ISO/IEC 27001:2022

Ref	Name	How	Coverage
`A.5.7`	Threat intelligence	Crosswalk of ISO 27001 A.5.7 to DORA Art. 13 threat-led testing.	supports
`A.5.24`	Information security incident management planning	delta subcommand highlights ISO A.5.24–A.5.30 mapping to DORA Art. 17.	evidences

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.

manifest.json — pinned SHA-256 + .sig URL + SBOM URL per platform
johlem-release.pub — Ed25519 public key used by signify -V (fingerprint: 4532510f…6748, pinned in jcli verify)
CHANGELOG.md — semver-tagged release notes
Security contact: security@johlem.net