Home · Auto-Evidence Expansion Roadmap

Auto-Evidence Expansion Roadmap

Created: 2026-05-19 (W4 audit closure — D12-F3 honest framing) Authored by: W4 fix agent 5 Related finding: docs/audit_20260518/stage2_findings/gemini/D12_coverage_honesty.md → D12-F3 "Over-claiming automated coverage (mapping gap)"

Why this doc exists

URIP markets "24 pre-built compliance frameworks · ~1,642 mapped controls" — in reality that figure is a count of control records, not controls automated end-to-end. The Stage-2 Gemini audit flagged the gap between that marketing claim and the actual code-supported automation surface (backend/services/auto_evidence_mapping.py).

Honest position (INV-5):

  • ~1,642 = total control records seeded across all 24 frameworks in the compliance DB (compliance/backend/compliance_backend/seeders/). This is a count of rows, not a count of controls automated end-to-end.
  • 13 = distinct controls that today receive automatic evidence rows from connector findings without any manual upload (see table below). NOTE (2026-08-16): marketing copy elsewhere in this repo currently cites 12 for this figure. That number could not be independently reproduced against AUTO_EVIDENCE_MAP — the live table still resolves to 13 distinct (framework_code, control_code) pairs, matching the table below. Flagged as an open discrepancy pending owner review.
  • 13 = distinct connector sources mapped today (13 connector slugs, no further de-duplication into a smaller "source class" count).
  • Every other control in the 1,642 record set still requires manual evidence upload by the customer's auditor / GRC team through the auditor portal — exactly the same workflow as Sprinto / Drata / Vanta, with the difference that URIP's auditor portal binds the evidence to the same risk-register row that drove the finding.

This doc holds the canonical mapping snapshot so marketing copy in frontend/index.html, MASTER_BLUEPRINT.md, and README.md can link here for the exact numbers instead of using language that implies 1,642-control automation.

Snapshot — what is auto-evidenced today (2026-05-19)

Source: backend/services/auto_evidence_mapping.py — AUTO_EVIDENCE_MAP dict.

Connector → control surface

Connector source Severity bands triggered Frameworks touched
defender_endpoint critical, high ISO 27001, ISO 9001, ISO 45001
sentinelone critical, high ISO 27001, ISO 9001, ISO 45001
crowdstrike critical, high ISO 27001, ISO 9001
tenable critical, high ISO 27001, ISO 9001
rapid7 critical, high ISO 27001, ISO 9001
easm critical, high ISO 27001, ISO 9001
netskope critical, high ISO 27001, ISO 9001
abusech_threatfox critical, high ISO 27001
rtip critical, high ISO 27001
cert_in critical, high ISO 27001
ms_entra critical, high ISO 27001, ISO 9001
okta critical, high ISO 27001, ISO 9001
jira critical, high ISO 27001, ISO 9001, ISO 45001

13 connector slugs — 13 distinct auto-evidence-emitting connector sources (no further de-duplication into a smaller "source class" count).

Distinct controls auto-evidenced

Framework Control Evidence label
ISO 27001 A.8.7 (Malware protection) Malware Protection Log
ISO 27001 A.8.8 (Tech vulnerability mgmt) Vulnerability Management Log
ISO 27001 A.5.7 (Threat intelligence) Threat Intelligence Record
ISO 27001 A.5.6 (Authority contacts) Authority Contact Record
ISO 27001 A.5.16 (Identity management) Identity Management Record
ISO 27001 A.5.24 (Incident mgmt planning) Incident Management Plan
ISO 27001 A.5.25 (Security event assess.) Security Event Assessment
ISO 27001 A.5.34 (Privacy / PII) Privacy & Data Protection Evidence
ISO 27001 A.8.5 (Secure authentication) Secure Authentication Log
ISO 27001 A.8.12 (DLP) Data Leakage Prevention Log
ISO 9001 10.2 (Nonconformity) Nonconformity Record
ISO 9001 8.4 (Externally provided proc) Externally Provided Process Evidence
ISO 45001 10.2 (Incident investigation) Incident Investigation Report

Total: 13 distinct controls. 10 ISO 27001 (out of 93 Annex A controls = ~11% Annex A coverage). 2 ISO 9001. 1 ISO 45001.

Frameworks with zero auto-evidence today

SOC 2, GDPR, HIPAA, PCI DSS v4.0, India DPDP Act 2023, NIST CSF 2.0, ISO 42001, EU AI Act, DORA, NIS2, ISO 27017, ISO 27018, ISO 27701, CIS Controls v8, SEC Cybersecurity Disclosure, CMMC 2.0, HITRUST CSF v11, SOC 1 SSAE 18, ISO 22301:2019 BCMS, ISO 14001:2015, ISO 50001:2018.

(ISO 9001:2015 and ISO 45001:2018 are NOT in this list — both already receive auto-evidenced Nonconformity/Incident-Investigation rows today, see the connector→control table above.)

These all rely on manual auditor evidence upload through the auditor portal today. Their control catalogues are seeded so customers can run their audit through URIP, but URIP is not generating evidence rows for them from connector data yet.

Expansion priorities (FUTURE WORK — not committed)

This section is intentionally not a delivery commitment. It's a sketch of the order in which auto-evidence mappings should grow if/when a follow-up engagement is funded for it.

Tier 1 — High customer value, low GRC analysis effort

Framework / source pair Why
SOC 2 TSC ← all 13 existing connectors SOC 2 is the #1 ask for SaaS prospects
ISO 27001 expansion (next ~30 controls) Extend already-mapped framework rather than new
HIPAA Security Rule ← EDR + DLP + IAM Healthcare prospects need this for §164.308/.312
PCI DSS v4.0 ← EDR + vuln + IAM + DLP Payment prospects need 6.x / 8.x / 10.x evidence

Tier 2 — Compliance-heavy regions

Framework Notes
GDPR (Art. 32 technical measures) Maps cleanly to EDR + DLP + IAM connectors
India DPDP Act 2023 Same shape as GDPR Art. 32
NIST CSF 2.0 DETECT, RESPOND, RECOVER pillars overlap existing maps

Tier 3 — Specialised / scaffold-grade today

Framework Why deferred
CMMC 2.0 DIB-only customer base; needs NIST 800-171 r2 analysis
HITRUST CSF v11 Paywalled canonical text; risk of misquote
SOC 1 SSAE 18 / ICFR Financial reporting controls; different evidence shape
ISO 22301:2019 BCMS Business continuity has process evidence, not security
SEC Cybersecurity Disclosure Disclosure controls = quarterly attestation, not events

Honest caveats (INV-5)

  1. Severity gate. Only critical and high connector findings trigger auto-evidence rows today. medium/low findings are intentionally excluded — an auditor doesn't want every low-sev event in the nonconformity log, and including them would dilute the evidence pile.
  2. Single-source bias. ISO 27001 is the only deeply-mapped framework today because the original implementation prioritised the most-requested security cert. We have not built equivalent depth for the other 23 frameworks.
  3. Control catalogue grade varies. 7 of the 24 frameworks ship audit-grade control text (SOC 2, ISO 27001:2022, GDPR, HIPAA, PCI DSS v4.0, India DPDP, NIST CSF 2.0). The other 17 are scaffold-grade (paraphrased from public summaries because canonical PDFs are paywalled). Customers should reconcile against the licensed reference before audit submission. This applies independently of automation.
  4. No backfill on already-closed events. Auto-evidence rows are only created at the time the finding is ingested. Historical findings from before the auto-evidence engine was wired in (pre-2026-05-18) do not have evidence rows attached retroactively.

Pointers to actual code

What File
Mapping table backend/services/auto_evidence_mapping.py
Mapping invoker backend/services/connector_runner.py (call to lookup)
Evidence model compliance/backend/compliance_backend/models/evidence.py
Auditor portal (manual upload) compliance/frontend/auditor_portal.html
Marketing copy to keep honest frontend/index.html, MASTER_BLUEPRINT.md, README.md

Maintenance rule

If AUTO_EVIDENCE_MAP is ever extended:

  1. Update the connector→framework table above.
  2. Update the "Distinct controls auto-evidenced" table.
  3. Update the per-surface marketing copy in frontend/index.html and MASTER_BLUEPRINT.md to reflect the new number. Do not let the gap between the "1,642" control records total and what's actually auto-evidenced widen again without updating this doc.