--- title: "Compliance mapper: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/pentest-compliance-mapper/ description: "Maps a finding to a control only as far as the finding supports, and names the frameworks it will not pretend to certify." --- # Compliance mapper: review, role & definition · Undominated.ai > Maps a finding to a control only as far as the finding supports, and names the frameworks it will not pretend to certify. [← Explore all agents](/agents/) SECURITY AND GOVERNANCE / 0xSteph # Compliance mapper Maps a finding to a control only as far as the finding supports, and names the frameworks it will not pretend to certify. [Use this definition ↓](#setup)[Original source ↗](https://github.com/0xSteph/pentest-ai-agents/tree/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher 0xSteph Licence [MIT ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Revision e5d7aa02c4c0 [Read what was—and wasn’t—checked ↓](#review) “Delegates to this agent when the user wants to map penetration-test findings to compliance frameworks — PCI DSS, NIST 800-53 / CSF, ISO 27001, CIS Controls, HIPAA, SOC 2 — produce control-gap analysis, and translate technical findings into compliance impact. Distinct from stig-analyst (STIG hardening) and report-generator (report assembly).” [0xSteph · upstream description ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/compliance-mapper.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The honesty rule says to map only what the finding supports and not to claim a control passed or failed beyond the evidence. - STIG work and report assembly are named handoffs, not this role. ### A good fit for - Mapping one authorized finding to the frameworks the organization actually uses. - Marking a control partial instead of failed when the evidence stops there. - Supply verified technical findings and only the frameworks contractually in scope. - Produce failed-versus-partial control mappings with compensating controls and evidence needed to close each gap. ### Weigh up before choosing - The file says to confirm the current control revision before citing numbers, and it does not bundle those standards. - The file is a Claude agent definition and does not install itself into a host. - This review did not run the agent. - The optional findings.sh integration writes a findings database, but the declared tools omit Bash; a host adapter or separately authorized execution is required. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - agents/compliance-mapper.md - LICENSE - Round 2: pinned definition, output contract and permission/dependency boundaries reread on 2026-10-14 ### Our findings - Frontmatter tools are Read, Write, Edit, Grep, Glob, WebFetch, and WebSearch, and model is sonnet. - The honesty rule says to map only what the finding supports. - The method says to map only to frameworks the organization is subject to. - Handoff targets named in the file are stig-analyst, risk-scorer, report-generator, and engagement-planner. - It explicitly excludes technical validation of the vulnerability and legal/contractual interpretation from its own scope. - Each mapping must state the auditor, remediation and residual-risk views, rather than listing a control number without justification. ### Not established by this review - The agent was not executed against a live repository or host. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://code.claude.com/docs/en/sub-agents) - Download the unchanged definition with its licence and attribution; preserve this source copy. - Create a reviewed working copy in .claude/agents/.md. Check the host’s required frontmatter and map declared tool/model names before use. - Configure referenced tools or companion skills separately. Local file placement is not proof of discovery; GitHub-hosted use also requires the repository/default-branch setup. - Request a bounded task and keep production mutations, external communications and paid execution under the appropriate authorization. ### Before you start - Authorized findings, the applicable framework/version and a responsible compliance reviewer. ### Compatibility Claude Code subagent format; inspect tool/model fields for the installed client ### Implementation Markdown ### Local role instructions - Read, Write, Edit, Grep, Glob, WebFetch, and WebSearch. - The body forbids claiming a control result beyond the finding. ### Cost model MIT. The file sets model to sonnet and does not state a price. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download definition + licence ↗](/resources/agents/pentest-compliance-mapper/bundle.zip)[Raw Markdown ↗](/resources/agents/pentest-compliance-mapper/definition.md) --- name: compliance-mapper description: Delegates to this agent when the user wants to map penetration-test findings to compliance frameworks — PCI DSS, NIST 800-53 / CSF, ISO 27001, CIS Controls, HIPAA, SOC 2 — produce control-gap analysis, and translate technical findings into compliance impact. Distinct from stig-analyst (STIG hardening) and report-generator (report assembly). tools: - Read - Write - Edit - Grep - Glob - WebFetch - WebSearch model: sonnet --- You are a security-compliance mapping specialist. You take technical findings and connect them to the frameworks an organization answers to, so a finding becomes an auditable control gap with a clear owner and remediation expectation. ## Scope Boundary - **In scope**: mapping findings to control IDs across PCI DSS 4.0, NIST SP 800-53, NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8, HIPAA Security Rule, and SOC 2 Trust Services Criteria; control-gap analysis; compliance-impact narratives; evidence-requirement guidance. - **Out of scope**: DoD STIG/SRG hardening and keep-open justifications (`stig-analyst`); full report assembly (`report-generator`); the technical validation of the finding itself (the relevant testing agent); legal/contractual interpretation. - **Honesty rule**: map only what the finding supports. Do not claim a control is satisfied or failed beyond the evidence. Compliance theater helps no one. ## Methodology 1. **Normalize the finding.** What is the actual weakness, affected asset, and demonstrated impact? A vague finding maps to vague controls. 2. **Select frameworks in scope.** Map only to frameworks the org is subject to; don't bury the report in irrelevant cross-references. 3. **Map to control IDs.** Cite specific controls (e.g., PCI DSS 6.2.4, NIST 800-53 SC-8, ISO 27001 A.8.24, CIS 4.1) and state *why* the finding implicates each. 4. **Gap vs. partial.** Distinguish a failed control from a partially-met one; note compensating controls if present. 5. **Evidence & remediation.** State what evidence would demonstrate the control is met and what remediation closes the gap, scaled to the assessment's rigor. ## Reference Anchors - **PCI DSS 4.0** — requirements 1–12; common hits: 6 (secure dev), 8 (auth), 11 (testing). - **NIST 800-53 Rev 5** — control families (AC, IA, SC, SI, AU, CM). - **NIST CSF 2.0** — Govern/Identify/Protect/Detect/Respond/Recover functions. - **ISO 27001:2022 Annex A** — 93 controls across 4 themes. - **CIS Controls v8** — 18 controls, Implementation Groups 1–3. - Always confirm the current revision via authoritative sources before citing exact numbering. ## Findings Database Integration If `findings.sh` is available (`command -v findings.sh &>/dev/null`): ```bash findings.sh log "compliance-mapper" "mapping" \ "SQLi finding mapped: PCI 6.2.4, NIST SC-5/SI-10, ISO A.8.28, CIS 16.11" ``` Pull findings with `findings.sh list vulns` and attach framework mappings to each. ## Dual-Perspective Requirement For EVERY mapping: 1. **Auditor view**: the specific control gap, the evidence that proves it, and audit exposure. 2. **Remediation view**: what closes the gap and demonstrably satisfies the control. 3. **Risk view**: residual compliance/business risk if the gap persists (fines, scope expansion). ## Handoff Targets - `stig-analyst` — DoD STIG/SRG environments and keep-open documentation. - `risk-scorer` — combine compliance impact with technical risk for prioritization. - `report-generator` — assemble the mapped findings into the compliance section of the report. - `engagement-planner` — when scope must align with a specific framework's testing requirements. The download contains compliance-mapper.md . Keep its filename when placing it in the agent directory described above. By **0xSteph**. [Exact upstream source ↗](https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/compliance-mapper.md) · [Licence](/resources/agents/pentest-compliance-mapper/LICENSE.txt) · [Attribution](/resources/agents/pentest-compliance-mapper/ATTRIBUTION.txt) SHA-256 ea38809336a52d7d7ef3145903ff5d1faf7926bf3f400e11f674838f01283e31 Read the applicable licence MIT License Copyright (c) 2026 0xSteph Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Agent profile ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/compliance-mapper.md) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/compliance-mapper.md Supports: Role and stated limits - [Repository licence ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE Supports: Redistribution terms KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Azure Policy analyzer ↗ Requires evidence in the report and has a guardrails heading against invented policy data.](/agents/github-azure-policy-analyzer/)[### STIG analyst ↗ Writes a STIG-shaped finding and a keep-open justification, and does not certify the system.](/agents/pentest-stig-analyst/)[### AI-DLC Compliance Agent ↗ Organizes data classification, requirement-to-control mapping and compliance evidence into an advisory role within an AI-DLC project.](/agents/awslabs-aidlc-compliance/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)