Cyber Framework Mapping
Priority: P1 (HIGH)
Map only evidenced relationships; catalog context is not proof of efficacy, compliance, or coverage.
Structure
textcyber-framework-mapping/ ├── SKILL.md ├── references/edge-record.md └── evals/evals.json
Workflow
- Name framework, version, stable ID, and exact source URL or document section.
- Choose relation (
supports,describes,observed-as,partial,unknown, orconflicts). - Write a bounded rationale tied to an evidence record, not a generic similarity.
- Set review status:
reviewed,needs-review, orunreviewed; include reviewer and date when reviewed. - Preserve empty or unknown mappings explicitly; do not infer a complete catalog.
- On a version/source change, preserve the prior versioned edge and its evidence unchanged. Create a separately versioned candidate linked to the prior record, mark it
needs-review, and re-review; never overwrite historical mappings.
Rules
- Prefer primary framework publications and official technique catalogs.
- Keep framework IDs version-qualified; never silently merge revisions.
- Separate a mapped edge from a control claim, measured efficacy, or compliance assertion.
- Link shared evidence fields for observation provenance.
For mapped observations, carry
engagement_scope_ref,skill_version,source,observed_at,finding_status,evidence_refs,limitations, andaccountable_owner.
Anti-Patterns
- No broad equivalence: One keyword does not establish a mapping.
- No version drift: Verify the current revision before reusing an ID.
- No compliance leap: Mapping never certifies a control or outcome.
- No fabricated completeness: Mark unknown edges and gaps.


