Security Scan Mapper

The problem

A public company's government business unit has to prove its systems match DISA Security Technical Implementation Guides. The scanning part is solved. Tooling produces findings all day. The expensive part is what happens next: somebody has to sit with each finding and decide what it means.

That adjudication was manual and it was enormous. Every cycle, engineers worked through scan output finding by finding, deciding whether each one applied to the system in question, whether it was already accepted risk, which control it mapped to, and what the justification was. Prior cycles' decisions lived in spreadsheets and people's memory, so the same findings got re-litigated every round.

The cost landed at more than 350 engineer hours per review cycle. That is not just a budget problem. It is a program problem, because a review that expensive cannot run often, and a control baseline you only check twice a year is a baseline you do not really know.

What I built

The insight was that almost none of those 350 hours were spent on genuine judgment calls. They were spent on correlation and re-entry: matching findings to controls, matching this cycle's findings to last cycle's decisions, and retyping justifications that had not changed. That is machine work.

1. Normalize the scan output.Parse the raw findings into one consistent internal shape so every downstream step works off a single representation instead of a report format.
2. Map findings to controls automatically.Resolve each finding to the control it implicates, so reviewers stop doing lookup work by hand.
3. Carry prior determinations forward.Match each finding against previous adjudications. An unchanged finding with a standing decision and justification arrives already answered.
4. Collapse duplicates across baselines.The same underlying issue surfacing under several baselines becomes one item to decide, not several.
5. Surface only the exceptions.What reaches a human is the new, the changed, and the genuinely ambiguous. That residue is the 11 hours.

The design principle was narrow on purpose. The tool never decides whether a finding is acceptable. It does the correlation and the bookkeeping, then puts a human in front of the decisions that actually need a human. Compliance automation that quietly makes risk acceptances on your behalf is how you fail an audit with a very tidy dashboard.

What it changed

The hours are the headline, but the useful outcome was cadence. A review that costs 11 hours can run whenever something changes rather than whenever the calendar forces it. The baseline stopped being a semiannual snapshot and started being something the team could actually keep current.

It also moved the expertise out of individual heads. Once prior determinations and their justifications live in the tool rather than in a spreadsheet somebody owns, the program survives that person going on leave or leaving the company. That is the part I care about most, and it is the same thing I mean when I say I build programs that run without me.

The tool shipped as part of a broader federal compliance program I owned, alongside CMMC Level 2 readiness work, FOCI remediation, and SOC 2 delivery across four frameworks.

On the code

If you want to see how I write software when the code is mine, the delivery stack behind my consulting practice is a closer look: an encrypted client vault on LUKS2 with YubiKey custody, a hash-chained audit ledger, a deterministic reporting pipeline, and a client portal on Cloudflare Workers. I am also building an OSCAL-native compliance evidence engine designed to map 12 control frameworks.