<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Control Framework Mapping — API Reference

## Common Control Schema

```json
{
  "common_id": "CC-MFA-001",
  "description": "Multi-factor authentication for privileged access",
  "frameworks": {
    "nist-csf": "PR.AA-02",
    "iso-27001": "A.8.5",
    "cis-v8": "6.3",
    "soc2": "CC6.1",
    "pci-dss": "8.4.2"
  },
  "implemented": true,
  "evidence": ["mfa-config-screenshot.png", "iam-policy.json"]
}
```

## Agent Commands

```bash
# Build cross-framework control map
node agent.js --action map --input controls.json

# Gap analysis for specific framework
node agent.js --action gap-analysis --framework pci-dss --input mapping.json

# Generate mapping report
node agent.js --action report --input mapping.json --output report.json
```

## Framework Control Counts

| Framework | Total Controls | Typical Overlap |
|-----------|---------------|-----------------|
| NIST CSF 2.0 | 106 subcategories | 60-70% with ISO |
| ISO 27001:2022 | 93 Annex A controls | 65-75% with NIST |
| CIS Controls v8 | 153 safeguards | 50-60% with NIST |
| SOC 2 | 33 TSC points | 70-80% with ISO |
| PCI DSS v4.0 | ~250 requirements | 40-50% with NIST |
