Strm Mapping

NIST IR 8477 STRM Mapping — GRC Toolkit Skill

When to Activate

Activate this skill whenever the user asks to:

• Map, crosswalk, align, or compare any two frameworks, catalogs, or control sets
• Create a STRM CSV output file between any two documents
• Perform a gap analysis between any source and target document
• Extend or verify an existing STRM mapping file

Working Directory

All work must be performed inside the working-directory/ folder at the repository root. Open Qoder from the repository root so relative paths resolve correctly.

• Read input files from working-directory/, knowledge/, or examples/
• Write all in-progress and output files to working-directory/
• Never write output to the repo root or any other location

Saving Completed Mappings

When a mapping is fully complete, create a dated artifact folder:

working-directory/mapping-artifacts/YYYY-MM-DD_<FocalFramework>-to-<TargetFramework>/

Place the completed CSV inside the dated folder.

Runtime Parameters

Before beginning any work, confirm both parameters with the user:

Step-by-Step Workflow

Scripts to Call (by Step)

1. Gather Source Files

Read before generating output:

knowledge/ir8477-strm-reference.md                                 ← STRM methodology rules
working-directory/<source-document>.csv/.pdf/.md/.json/.yml/.toml  ← Focal document
working-directory/<target-document>.csv/.pdf/.md/.json/.yml/.toml  ← Reference document

Search order: working-directory/ → repo root → knowledge/

When an input is JSON and uses HTML-tagged descriptions, run:

node scripts/bin/strm-extract-json.mjs <input.json> [output.csv]

Default output is working-directory/<framework>-extracted.csv with columns: controlId,title,family,description.

Write all intermediate files (extracted control lists, partial drafts) to working-directory/scratch/. Do not use system temp directories.

Check for an existing STRM file for this source→target pair before starting.

2. Identify FDE and RDE

• FDE (Focal Document Element) = one control from the source document
• RDE (Reference Document Element) = one control from the target document

For each document: record full name, URL/citation, control ID format.

3. Assign STRM Attributes per Mapping Row

Strength Score Formula

strength = base_score + confidence_adj + rationale_adj
base_score  : equal=10  subset_of=7  superset_of=7  intersects_with=4  not_related=0
confidence  : high=0    medium=-1    low=-2
rationale   : syntactic=-1   semantic=0   functional=0
result      : clamp(strength, 1, 10)

Calibration Defaults

4. Write the Output CSV

File Naming Convention

Set Theory Relationship Mapping (STRM)_ [(<Focal>-to-<Bridge>)-to-<Target>] - <Focal> to <Target>.csv

For direct mappings, repeat the focal name as bridge.

CSV Structure

Copy TEMPLATE_Set Theory Relationship Mapping (STRM).csv and add data from Row 2:

Row 1: FDE#,FDE Name,Focal Document Element (FDE),Confidence Levels,NIST IR-8477 Rational,STRM Rationale,STRM Relationship,Strength of Relationship,<Target> Requirement Title,Target ID #,<Target> Requirement Description,Notes
Row 2+: <data rows>

Column definitions:

5. Rationale Writing Pattern

<Source> <FDE#> requires <what FDE requires>. <Target> <Target ID#> requires <what RDE requires>. Both <shared objective>.

For intersects_with: append "Both address . additionally covers ; additionally covers ."

Transitivity Rules

Inverse Relationships

Quality Rules

1. Never leave Rationale (Column F) empty — every row needs a narrative.
2. Strength score must match the formula — compute explicitly, do not guess.
3. One FDE can map to multiple target controls — one row per target control.
4. not_related is rare — only when there is genuinely zero overlap.
5. Do not invent target control IDs — every Target ID# must come from the actual target document.
6. Confidence defaults to high — lower only when ambiguity or inference is required.
7. Focus on Baseline maturity first — prioritize baseline/foundational controls.
8. Adapt column header labels — replace <Target> in columns I and K with the actual target document name (e.g., ISO 27001 Requirement Title, ISO 27001 Requirement Description).
9. Run a relationship distribution self-check after all rows are complete:
   • If subset_of + superset_of = 0%, review equal rows; many may actually be subset_of.
   • If equal > 50%, review each equal row and confirm neither control explicitly requires more than the other.
   • If one control says "SHALL" and the other says "SHOULD", this is typically subset_of, not equal.

Optional: Risk and Threat-Enriched Mappings

Load these files only when explicitly requested by the user:

Trigger phrases: "include risk data", "add threat context", "risk-to-control mapping", "threat-to-control", "use the risk library".

Chain: Threat → Risk → Control — apply transitivity rules when traversing.

Key Resources