Control-to-code mapping
Control-to-code mapping links a compliance requirement (a SOC 2 Trust Services Criterion, a HIPAA technical safeguard) to the specific code that implements it and the evidence proving that code runs. Caisson's Compliance bundle ships this as a canonical control registry crosswalked to CC6.x / 164.312 citations, with key controls wired to live evidence collectors.
In code
{
id: "ACCESS-CONTROL.MFA",
title: "Multi-factor authentication for privileged access",
family: "Access Control",
statement:
"Privileged access to production systems and the tenant data plane requires a second " +
"authentication factor beyond a password; single-factor privileged sessions are denied.",
crosswalk: [
{ framework: "SOC2-TSC", reference: "CC6.1" },
{
framework: "HIPAA-Security",
reference: "164.312(d)",
note: "Person-or-entity authentication strengthened by a second factor.",
},
],
},How it holds
Clean-room control, crosswalked not copied
CanonicalControl (registry/control.ts) is own-authored Caisson prose with a crosswalk array of {framework, reference} pointers, bare requirement IDs like CC6.1 or 164.312(d), never the licensed AICPA/SCF criteria text. Crosswalk entries are validated unique on (framework, reference) at author time.
Evidence collectors pin to a controlId
Each EvidenceCollector declares the controlId it evidences (e.g. fieldCryptoPolicyCollector defaults to DATA-PROTECTION.PHI-ENCRYPTION) and turns a live at-rest sample into a pass/flagged/unresolved verdict, fail-closed: zero PHI fields inspected returns unresolved, never a guessed pass.
Greppable code-to-ADR trail
Control-bearing code carries a one-line Control: ADR-NNNN, <policy name> docstring (the soc2Tsc pack cites ADR-0057), so grep -rn "Control: ADR-" packages/*/src is the auditor's control-to-code index with no separate spreadsheet to drift.
Goldens pin the policy revision
Golden fixtures capturing control-logic output carry a policyVersion field naming the ADR/catalog version the fixture was blessed under, so a drifted golden shows which policy revision the last-blessed evidence belongs to, the code-to-evidence leg of the trail.