🙏 Mapping of built-in tests to other control framework (ISO, SOC2, etc)

[ehrnst]

Describe the feature

I tried to find a way to add additional information to each test. I want the report to have a column of which ISO27001 control the test can be linked to.

Describe alternatives you've considered
I tested building a wrapper that will edit the reports after they are created. However, it would be great if we can use for example the format test functionality to add additional information which can be sorted and filtered

[SamErde]

Thanks for this — and great thinking on the wrapper approach, that shows you’ve already dug into how this might work!

Good news: there’s already a mechanism that looks like a natural fit for your feature request. The maester-config.json file stores per-test metadata including Id, Title, and Severity. Adding a dedicated compliance framework property there would be a clean, non-invasive extension — something like:

{
  "Id": "CIS.M365.1.1.1",
  "Severity": "High",
  "Title": "(L1) Ensure Administrative accounts are cloud-only",
  "ComplianceFrameworks": ["NIST.AC-2", "ISO.A.8.2"]
}

We’d want to keep this separate from the existing Pester test tags to avoid tag sprawl and make it a straightforward way to surface compliance mappings distinctly in reports.

One thing worth discussing before we dive in: framework fit. ISO 27001 and SOC 2 are both management/audit frameworks with high-level, outcome-oriented controls — a single ISO 27001 Annex A control could loosely map to dozens of Maester checks at once, which may make the column less useful than it sounds. Frameworks like NIST 800-53 or CIS Controls (which we already partially map to) have specific, technical controls that align much more cleanly with individual Maester checks.

That said, keeping ComplianceFrameworks as a flexible array means the community can contribute mappings for whichever frameworks matter to them — whether that’s ISO 27001, SOC 2, NIST 800-53, NIST 800-171, or others.

It would be really helpful to know:

• Which frameworks are most important to you?
• Is your primary use case report filtering/sorting, or feeding results into a GRC tool?

That would help us design something useful for the broadest set of users. Would you be interested in contributing to this?! 🙌

[ehrnst]

Thanks Sam! Are you saying I can actually add an additional property for each test in the config file, or is it a proposed solution? Either way, I think it’s a good approach. The mapping can be done by the community (including me). Most compliance frameworks overlap the controls/tests, so it needs to be flexible Sent from Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Sam Erde ***@***.***> Sent: Friday, April 24, 2026 1:41:13 PM To: maester365/maester ***@***.***> Cc: Martin Ehrnst ***@***.***>; Author ***@***.***> Subject: Re: [maester365/maester] 🙏 Mapping of built-in tests to other control framework (ISO, SOC2, etc) (Issue #1679) [https://avatars.githubusercontent.com/u/20478745?s=20&v=4]SamErde left a comment (maester365/maester#1679)<#1679 (comment)> Thanks for this — and great thinking on the wrapper approach, that shows you’ve already dug into how this might work! Good news: there’s already a mechanism that looks like a natural fit for your feature request. The maester-config.json<https://github.com/maester365/maester/blob/main/tests/maester-config.json> file stores per-test metadata including Id, Title, and Severity. Adding a dedicated compliance framework property there would be a clean, non-invasive extension — something like: { "Id": "CIS.M365.1.1.1", "Severity": "High", "Title": "(L1) Ensure Administrative accounts are cloud-only", "ComplianceFrameworks": ["NIST.AC-2", "ISO.A.8.2"] } We’d want to keep this separate from the existing Pester test tags to avoid tag sprawl and make it a straightforward way to surface compliance mappings distinctly in reports. One thing worth discussing before we dive in: framework fit. ISO 27001 and SOC 2 are both management/audit frameworks with high-level, outcome-oriented controls — a single ISO 27001 Annex A control could loosely map to dozens of Maester checks at once, which may make the column less useful than it sounds. Frameworks like NIST 800-53 or CIS Controls (which we already partially map to) have specific, technical controls that align much more cleanly with individual Maester checks. That said, keeping ComplianceFrameworks as a flexible array means the community can contribute mappings for whichever frameworks matter to them — whether that’s ISO 27001, SOC 2, NIST 800-53, NIST 800-171, or others. It would be really helpful to know: * Which frameworks are most important to you? * Is your primary use case report filtering/sorting, or feeding results into a GRC tool? That would help us design something useful for the broadest set of users. Would you be interested in contributing to this?! 🙌 — Reply to this email directly, view it on GitHub<#1679 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AFC6E5SVGDRZ2IVWEM4UF3L4XNHFTAVCNFSM6AAAAACYFAKED2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DGMJSHA2TONJRG4>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://github.com/notifications/mobile/ios/AFC6E5XVAEI2UMX5SSHOCQT4XNHFTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMZRGI4DKNZVGE32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android<https://github.com/notifications/mobile/android/AFC6E5XXI7DDCPZVH25XJ2L4XNHFTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMZRGI4DKNZVGE32M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[SamErde]

I would like to hear @merill's thoughts but see no reason why we couldn't add this detail to the JSON and update the schema. We would then follow up with a look at how to surface this information in the results JSON and final reporting.