Compliance Map

Mapping table from third-party control catalogs to mechanisms that exist in this repository’s production code paths today.

1. No aspirational rows. If the mechanism is not implemented and merged, it does not appear in the table below.
2. Machine-readable IDs. Control IDs match the catalog’s canonical identifier (e.g. AU-2 for NIST SP 800-53, CC7.2 for SOC 2 TSC 2017, Art. 32 for GDPR).
3. One row per (control, mechanism) pair. If two mechanisms jointly satisfy a control, add two rows.
4. Evidence column — pointer to tests, ADRs, or docs that prove the mechanism is live (not a design note alone).

Control	Source	Mechanism	Evidence
AU-2	NIST SP 800-53	Canonical audit-event production and tenant-scoped audit ingestion.	services/audit/src/consumer.rs
AU-9	NIST SP 800-53	Batched audit rows are protected by canonical hashes, Merkle roots, signatures, and a database trigger that rejects mutation after batching.	services/audit/migrations/0001_audit_init.sql, services/audit/src/sequencer.rs
AU-10	NIST SP 800-53	Signed batch envelopes and verifier CLI provide non-repudiation evidence for sealed audit events.	services/audit/src/bin/nexus-audit-verify.rs, Audit Proof Format
AU-11	NIST SP 800-53	Audit archive writer stores meta-root manifests and compressed batch event archives in the configured archive store.	services/audit/src/anchor.rs, deploy/compose/minio/bucket-init.sh
RA-5	NIST SP 800-53	Release image and SBOM scanning gates block High and Critical vulnerabilities unless an approved exception is checked in.	.gitlab-ci.yml, CI/CD Pipeline
SI-2	NIST SP 800-53	Dependency and vulnerability checks run before release artifacts are published, with findings resolved or documented through reviewed exceptions.	deny.toml, CI/CD Pipeline
SR-4	NIST SP 800-53	Provenance attestations link release image digests to the source repository, commit, tag, and GitLab CI job.	docs/ops/releases.md, CI/CD Pipeline
SR-11	NIST SP 800-53	Released container images are signed with the Nexus cosign release key and consumer verification commands are published with release notes.	docs/ops/releases.md, CI/CD Pipeline
SR-11	NIST SP 800-53	CycloneDX SBOM attestations are attached to released image digests and verified before release publication.	docs/ops/releases.md, CI/CD Pipeline

1. Identify the control in the source catalog and use its canonical ID.
2. Land the code + tests that implement the control.
3. Add a row here in the same Merge Request, with an Evidence link reviewers can follow.

• This is not an audit-readiness attestation. Compliance requires process, policy, and evidence beyond engineering tables.
• This is not a complete control catalog.