Every claim shows its working
A coverage percentage is worth nothing if you cannot see what it rests on. Pick any released pair below and read the actual claims: which control does the work, what it satisfies, why, which document each control was verified against, on what date, who judged it, and whether the claim survived a pass whose job was to refute it.
Then read what did not survive. The mappings that were proposed for the same pair and rejected are published here too, with the reason each one failed. A coverage figure that never threw anything away has not been tested, and you cannot tell the difference from the number alone.
This is read live from the same endpoints your agent would call, and reading it here is free. An agent calls them with an API key or pays per call. Change the pair and watch it change. Nothing on this page is a picture of an audit trail.
598 released pairs to choose from.
Level of review
machine_verifiedMappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.
25 claims, in full
GET /api/agent/crosswalk/provenance?source=ISO 27001:2022&target=SOC 2
Each claim names the source control whose evidence does the work, the target control it satisfies, and the reasoning. `argued_against_and_upheld` means a second pass tried to refute the claim and failed; claims that failed it are kept in the graph as refuted rather than deleted. The document fields say what each control was verified against and when.
Capacity management
A1.1 Managing processing capacity
Capacity management is how availability commitments are kept.
Information backup
A1.2 Environmental protection, backup and recovery infrastructure
Information backup is the data backup limb of this criterion.
Supporting utilities
A1.2 Environmental protection, backup and recovery infrastructure
Supporting utilities cover the power and cooling this criterion names.
Protecting against physical and environmental threats
A1.2 Environmental protection, backup and recovery infrastructure
Protecting against physical and environmental threats is the environmental limb.
ICT readiness for business continuity
A1.3 Testing recovery plan procedures
ICT readiness for continuity requires recovery plans be exercised.
Data masking
C1.1 Identifying and maintaining confidential information
Data masking protects confidential information during processing and display.
Confidentiality or non-disclosure agreements
C1.1 Identifying and maintaining confidential information
Confidentiality agreements bind those who handle confidential information.
Labelling of information
C1.1 Identifying and maintaining confidential information
Labelling makes classification actionable during handling.
Classification of information
C1.1 Identifying and maintaining confidential information
Classification of information is how confidential information gets identified.
Information deletion
C1.2 Disposing of confidential information
Information deletion is the disposal requirement of this criterion.
Secure disposal or re-use of equipment
C1.2 Disposing of confidential information
Secure disposal of equipment covers media holding confidential information.
Disciplinary process
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
A disciplinary process is how deviations from expected conduct are addressed.
Segregation of duties
CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
Segregation of duties defines reporting lines that limit conflicting authority.
Information security roles and responsibilities
CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
Defined security roles and responsibilities establish structures and authorities.
Information security awareness, education and training
CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Awareness, education and training evidence developing and retaining competence.
Screening
CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
Screening evidences the entity attracts individuals suited to their responsibilities.
Disciplinary process
CC1.5 Accountability for internal control responsibilities (COSO principle 5)
A disciplinary process holds individuals accountable for control responsibilities.
Management responsibilities
CC1.5 Accountability for internal control responsibilities (COSO principle 5)
Management responsibilities require staff to apply security per defined rules.
Information security awareness, education and training
CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Awareness and training is how objectives and responsibilities reach personnel.
Policies for information security
CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Communicated security policies carry objectives and responsibilities internally.
Information security roles and responsibilities
CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
Assigned roles tell individuals what they are internally responsible for.
Addressing information security within supplier agreements
CC2.3 Communication with external parties about internal control (COSO principle 15)
Supplier agreements communicate security expectations to external parties.
Contact with special interest groups
CC2.3 Communication with external parties about internal control (COSO principle 15)
Contact with special interest groups is external communication on security matters.
Contact with authorities
CC2.3 Communication with external parties about internal control (COSO principle 15)
Contact with authorities is defined external communication about security matters.
Compliance with policies, rules and standards for information security
CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
Compliance reviews against policies and standards are the ongoing evaluations.
102 mappings were refuted and are not in that number
GET /api/agent/crosswalk/refuted?source=ISO 27001:2022&target=SOC 2
These were proposed for this same pair and then thrown out. They are not deleted from the graph, they are kept marked as refuted, which is what stops a failed claim quietly coming back later. The coverage figure above is what is left after they were removed.
The pair summary counts every mapping removed in review. This section lists the ones marked refuted, which is the set that carries a record per mapping. Showing the first 25 of 102.
Read the sample as the best documented end of the list, not a fair slice of it. The endpoint returns the rejections that carry a stated reason first, and on several pairs most of the refutations behind them carry none. Raise the limit on the endpoint and you will see those too.
Information security during disruption
A1.2 Environmental protection, backup and recovery infrastructure
Cover backup, redundancy, continuity, and physical protections
ICT readiness for business continuity
A1.2 Environmental protection, backup and recovery infrastructure
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Redundancy of information processing facilities
A1.2 Environmental protection, backup and recovery infrastructure
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Information security during disruption
A1.3 Testing recovery plan procedures
Held back 2026-08-19. Generated by the retired metered path, refuted at 56 percent wherever re-judged. Pair pulled from sale pending a rebuild on the Max plan.
Information backup
A1.3 Testing recovery plan procedures
5.30 and 5.29 cover testing and continuity during disruption
Information backup
C1.1 Identifying and maintaining confidential information
Classification, labeling, and transfer cover identification and protection
Data leakage prevention
C1.1 Identifying and maintaining confidential information
Classification, labeling, and transfer cover identification and protection
Information transfer
C1.1 Identifying and maintaining confidential information
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Confidentiality or non-disclosure agreements
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Independent review of information security
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
Policies, training, and NDAs show ethical commitment
Information security roles and responsibilities
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
Policies, training, and NDAs show ethical commitment
Compliance with policies, rules and standards for information security
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
Policies, training, and NDAs show ethical commitment
Information security awareness, education and training
CC1.1 Commitment to integrity and ethical values (COSO principle 1)
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Independent review of information security
CC1.2 Board independence and oversight of internal control (COSO principle 2)
Independent review not equivalent to board oversight
Management responsibilities
CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Information security roles and responsibilities
CC1.5 Accountability for internal control responsibilities (COSO principle 5)
Held back 2026-08-19. Generated by the retired metered path, refuted at 56 percent wherever re-judged. Pair pulled from sale pending a rebuild on the Max plan.
Information security awareness, education and training
CC1.5 Accountability for internal control responsibilities (COSO principle 5)
Roles, compliance, and discipline enforce accountability
Compliance with policies, rules and standards for information security
CC1.5 Accountability for internal control responsibilities (COSO principle 5)
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Monitoring, review and change management of supplier services
CC2.3 Communication with external parties about internal control (COSO principle 15)
None address external communication about control functionality
Disciplinary process
CC3.3 Considering fraud risk (COSO principle 8)
Neither addresses fraud risk assessment directly
Information security incident management planning and preparation
CC3.3 Considering fraud risk (COSO principle 8)
Neither addresses fraud risk assessment directly
Monitoring activities
CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Change management
CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
Ongoing monitoring and independent review directly support control evaluations
Monitoring activities
CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
None ensure timely communication to senior management or board
Response to information security incidents
CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
None ensure timely communication to senior management or board
This is a sample, and the report is not
The endpoint returns up to twenty five claims so you can judge the work before paying for it. The paid report is every evidenced control and every gap, not a sample, as a report you can hand to an assessor.
What this is not
A mapping between two frameworks is a judgement, not text printed in either standard. Publishing the reasoning does not make a claim correct, it makes it checkable, and your assessor may still take a different view on individual controls. That is why the reasoning is here rather than a bare number.
Claims that failed the refutation pass are not deleted from the graph, they are kept marked as refuted, which is what stops a failed claim from quietly coming back. If you think one of the claims above is wrong, say so at support@theartofservice.com and it gets re-judged.