Choosing a framework

An engagement carries exactly one framework. You pick it at step 4 of the New engagement wizard, and it is stored on the engagement when you press Create engagement. The framework decides which control identifiers appear beside each finding in the report and in the SARIF and CSV exports.

The six that ship¶

Framework	Version	Controls
SOC 2 Type II	2017	10
ISO/IEC 27001:2022	2022	12
PCI DSS v4.0	4.0	10
OWASP Application Security Verification Standard	4.0.3	9
NIST Cybersecurity Framework	2.0	9
Esquema Nacional de Seguridad (ENS)	RD 311/2022	12

The name and version are the ones each framework's YAML file declares.

Each one is a control list plus three lookup tables: MITRE ATT&CK technique id to control, OWASP WSTG id to control, and keyword category to control. The ATT&CK and WSTG tables are the same size in all six — ten techniques and twelve WSTG ids each — so one framework does not buy wider coverage than another. Frameworks lists the tables control by control.

How to choose¶

Pick the standard you are going to be assessed against. The framework is a labelling choice on the output. Three places act on it — the report and its exports, the control ids written into the seal, and the rules-of-engagement document. Everywhere else it is echoed back as a label: on the engagement in the API, on the schedule, and in the console header and the wizard's review step.

If you are assessed against two standards, run two engagements. An engagement holds one framework name and there is no endpoint that changes it afterwards. The mapping itself is not fixed: the SARIF and CSV exports read the framework file again at every download, so a change to the file reaches them and not the PDF or the seal. A schedule's stored engagement template is not editable either, so a schedule that should fire against a different framework is deleted and recreated.

What the choice does not affect¶

The framework does not direct the testing. The agent's container receives the framework name in its configuration, and the single place that name is used is the rules-of-engagement document, which states the framework at the top and names it again in the reporting section. No phase, tool, check or prompt varies by framework.

Scope and rules are what constrain the run. See Scope and Rules of engagement.

Where the mapping is applied¶

Mapping runs when the run is sealed, when the PDF is generated, and at every SARIF or CSV download. The seal uses the ATT&CK and WSTG tables alone; the report and the exports fall back to keyword categories when those tables produce nothing. Frameworks describes the steps, and When mapping runs how the results can differ for one run.

A control identifier beside a finding records that the finding carried an ATT&CK or WSTG id, or matched a keyword pattern, that the framework's tables map to that control. It is not a judgement that the control passed or failed; What the result means explains what each case tells you.