mapping.schema.json

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://github.com/cystack/security-controls/blob/main/mapping.schema.json",
  "title": "CyStack Security Controls",
  "description": "JSON Schema for a mapping of a compliance standard to CyStack Security Controls",
  "type": "object",
  "properties": {
    "notice": {
      "description": "Copyright notice",
      "type": "string"
    },
    "standard": {
      "description": "A compliance standard, split into sections",
      "type": "object",
      "properties": {
        "name": {
          "description": "The name of the standard",
          "type": "string"
        },
        "principles": {
          "description": "Top level sections/principles of the standard",
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "name": {
                "description": "The name of the principle",
                "type": "string"
              },
              "section": {
                "description": "The section in the official standard to which this principle refers",
                "type": "string"
              },
              "requirements": {
                "description": "Requirements of this principle",
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "description": "The name of the requirement",
                      "type": "string"
                    },
                    "section": {
                      "description": "The subsection in the official standard to which this requirement refers",
                      "type": "string"
                    },
                    "control_ids": {
                      "description": "The IDs of all Vanta Controls that correspond to this requirement",
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    }
                  },
                  "required": [
                    "name",
                    "section",
                    "control_ids"
                  ]
                }
              }
            },
            "required": [
              "name",
              "section",
              "requirements"
            ]
          }
        }
      },
      "required": [
        "name",
        "principles"
      ]
    }
  },
  "required": [
    "standard",
    "notice"
  ]
}