{
  "schema": "compliance-crosswalk/v1",
  "tool": "shard",
  "frameworks": [
    {
      "id": "GDPR",
      "name": "General Data Protection Regulation (Reg. 2016/679)",
      "controls": [
        { "ref": "Art. 17", "name": "Right to erasure",                    "how": "Certificate of destruction is a written record of secure erasure per operator/data-subject request.", "coverage": "evidences" }
      ]
    },
    {
      "id": "HIPAA",
      "name": "HIPAA (45 CFR §164)",
      "controls": [
        { "ref": "§164.310(d)(2)(i)", "name": "Disposal",                  "how": "Certificate of destruction documents disposal of media containing ePHI.", "coverage": "evidences" },
        { "ref": "§164.310(d)(2)(ii)","name": "Media re-use",              "how": "wipefs + erase modes prepare media for safe re-use.", "coverage": "evidences" }
      ]
    },
    {
      "id": "PCI-DSS",
      "name": "PCI-DSS v4.0",
      "controls": [
        { "ref": "Req. 9.8.1", "name": "Media destruction",                "how": "Certificate of destruction documents destruction of media containing cardholder data.", "coverage": "evidences" }
      ]
    },
    {
      "id": "ISO27001",
      "name": "ISO/IEC 27001:2022",
      "controls": [
        { "ref": "A.7.14", "name": "Secure disposal or re-use of equipment", "how": "Certificate of destruction + audit-log chain evidences the control.", "coverage": "evidences" }
      ]
    }
  ]
}