Strm mapping

NIST IR 8477 STRM Mapping — GRC Toolkit Skill

When to Activate

Activate this skill whenever the user asks to:

• Map, crosswalk, align, or compare any two frameworks, catalogs, or control sets
• Create a STRM CSV output file between any two documents
• Perform a gap analysis between any source and target document
• Extend or verify an existing STRM mapping file

---

Working Directory

All work must be performed inside the working-directory/ folder at the repository root. Open Qoder from the repository root so relative paths resolve correctly.

• Read input files from working-directory/, knowledge/, or examples/
• Write all in-progress and output files to working-directory/
• Never write output to the repo root or any other location

---

Saving Completed Mappings

When a mapping is fully complete, create a dated artifact folder:

working-directory/mapping-artifacts/YYYY-MM-DD_<FocalFramework>-to-<TargetFramework>/

Place the completed CSV inside the dated folder.

---

Runtime Parameters

Before beginning any work, confirm both parameters with the user:

Parameter	Description	Example
Source (Focal) Document	The framework being mapped FROM	FFIEC CAT, ISO/IEC 27001:2022
Target (Reference) Document	The framework being mapped TO	CIS Controls v8, NIST CSF 2.0

---

Step-by-Step Workflow

Scripts to Call (by Step)

Step	Script to call
Step 1 (Gather)	node scripts/bin/strm-check-existing-mapping.mjs --focal "<Focal>" --target "<Target>" --working-dir working-directory
Step 1 (JSON input)	node scripts/bin/strm-extract-json.mjs <file.json>
Step 4 (Write CSV)	node scripts/bin/strm-init-mapping.mjs --focal "<Focal>" --target "<Target>" --working-dir working-directory, then node scripts/bin/strm-generate-filename.mjs --focal "<Focal>" --target "<Target>" [--bridge "<Bridge>"]
Post-completion (required)	node scripts/bin/strm-validate-csv.mjs --file "<output.csv>"
Post-completion	node scripts/bin/strm-gap-report.mjs --file "<output.csv>" --focal "<Focal>" --target "<Target>" --working-dir working-directory

1. Gather Source Files

Read before generating output:

knowledge/ir8477-strm-reference.md                                 ← STRM methodology rules
working-directory/<source-document>.csv/.pdf/.md/.json/.yml/.toml  ← Focal document
working-directory/<target-document>.csv/.pdf/.md/.json/.yml/.toml  ← Reference document

Search order: working-directory/ → repo root → knowledge/

When an input is JSON and uses HTML-tagged descriptions, run:

node scripts/bin/strm-extract-json.mjs <input.json> [output.csv]

Default output is working-directory/<framework>-extracted.csv with columns: controlId,title,family,description.

Write all intermediate files (extracted control lists, partial drafts) to working-directory/scratch/. Do not use system temp directories.

Check for an existing STRM file for this source→target pair before starting.

2. Identify FDE and RDE

• FDE (Focal Document Element) = one control from the source document
• RDE (Reference Document Element) = one control from the target document

For each document: record full name, URL/citation, control ID format.

3. Assign STRM Attributes per Mapping Row

Attribute	Allowed Values	Scoring Rule
Confidence Levels	high, medium, low	high=+0, medium=−1, low=−2
NIST IR-8477 Rational	semantic, functional, syntactic	syntactic=−1, others=+0
STRM Relationship	equal, subset_of, superset_of, intersects_with, not_related	equal=10, subset/superset=7, intersects=4, not_related=0
Strength of Relationship	Integer 1–10	base + confidence adj + rationale adj, clamped to [1,10]
STRM Rationale	Free text	Explain both FDE and RDE, then why the relationship holds
Notes	Free text	Flag scope differences, partial overlaps, or gaps

Strength Score Formula

strength = base_score + confidence_adj + rationale_adj
base_score  : equal=10  subset_of=7  superset_of=7  intersects_with=4  not_related=0
confidence  : high=0    medium=-1    low=-2
rationale   : syntactic=-1   semantic=0   functional=0
result      : clamp(strength, 1, 10)

Calibration Defaults

Attribute	Default	Override Condition
Confidence Levels	high	medium for ambiguity; low for significant inference
NIST IR-8477 Rational	semantic	functional for same outcome via different mechanisms. When mapping across different regulatory domains (for example healthcare → law enforcement, financial → defense), default to functional unless control wording and scope are substantially identical. Use syntactic only for word-for-word similarity (<1%).

4. Write the Output CSV

File Naming Convention

Set Theory Relationship Mapping (STRM)_ [(<Focal>-to-<Bridge>)-to-<Target>] - <Focal> to <Target>.csv

For direct mappings, repeat the focal name as bridge.

CSV Structure

Copy TEMPLATE_Set Theory Relationship Mapping (STRM).csv and add data from Row 2:

Row 1: FDE#,FDE Name,Focal Document Element (FDE),Confidence Levels,NIST IR-8477 Rational,STRM Rationale,STRM Relationship,Strength of Relationship,<Target> Requirement Title,Target ID #,<Target> Requirement Description,Notes
Row 2+: <data rows>

Column definitions:

Col	Header	Content
A	FDE#	Source control ID
B	FDE Name	Short label for the source control
C	Focal Document Element (FDE)	Full source control text
D	Confidence Levels	high / medium / low
E	NIST IR-8477 Rational	semantic / functional / syntactic
F	STRM Rationale	Narrative explaining both controls and the relationship
G	STRM Relationship	equal / subset_of / superset_of / intersects_with / not_related
H	Strength of Relationship	Integer 1–10 (computed)
I	<Target> Requirement Title	Target document short title (replace <Target> with actual target name)
J	Target ID #	Target control ID
K	<Target> Requirement Description	First sentence of target control text (replace <Target> with actual target name)
L	Notes	Scope differences, gaps, or caveats

5. Rationale Writing Pattern

<Source> <FDE#> requires <what FDE requires>. <Target> <Target ID#> requires <what RDE requires>. Both <shared objective>.

For intersects_with: append "Both address <overlap>. <Source> additionally covers <A>; <Target> additionally covers <B>."

---

Transitivity Rules

A→B	B→C	Derived A→C
equal	equal	equal
equal	X	X
X	equal	X
subset_of	subset_of	subset_of
superset_of	superset_of	superset_of
not_related	anything	not_related
intersects_with	anything	indeterminate — flag for manual review

---

Inverse Relationships

Forward	Inverse
equal	equal
subset_of	superset_of
superset_of	subset_of
intersects_with	intersects_with
not_related	not_related

---

Quality Rules

1. Never leave Rationale (Column F) empty — every row needs a narrative.
2. Strength score must match the formula — compute explicitly, do not guess.
3. One FDE can map to multiple target controls — one row per target control.
4. not_related is rare — only when there is genuinely zero overlap.
5. Do not invent target control IDs — every Target ID# must come from the actual target document.
6. Confidence defaults to high — lower only when ambiguity or inference is required.
7. Focus on Baseline maturity first — prioritize baseline/foundational controls.
8. Adapt column header labels — replace <Target> in columns I and K with the actual target document name (e.g., ISO 27001 Requirement Title, ISO 27001 Requirement Description).
9. Run a relationship distribution self-check after all rows are complete:
   • If subset_of + superset_of = 0%, review equal rows; many may actually be subset_of.
   • If equal > 50%, review each equal row and confirm neither control explicitly requires more than the other.
   • If one control says "SHALL" and the other says "SHOULD", this is typically subset_of, not equal.

---

Optional: Risk and Threat-Enriched Mappings

Load these files only when explicitly requested by the user:

File	Contents
knowledge/library/risks.json	SCF 2025.4 risk catalog
knowledge/library/threats.json	Threat catalog

Trigger phrases: "include risk data", "add threat context", "risk-to-control mapping", "threat-to-control", "use the risk library".

Chain: Threat → Risk → Control — apply transitivity rules when traversing.

---

Key Resources

Resource	Purpose
TEMPLATE_Set Theory Relationship Mapping (STRM).csv	Blank template — copy, never modify
knowledge/ir8477-strm-reference.md	Full NIST IR 8477 methodology
examples/	Worked examples for each mapping type
knowledge/library/risks.json	Risk catalog (opt-in only)
knowledge/library/threats.json	Threat catalog (opt-in only)