Every claim shows its working
A coverage percentage is worth nothing if you cannot see what it rests on. Pick any released pair below and read the actual claims: which control does the work, what it satisfies, why, which document each control was verified against, on what date, who judged it, and whether the claim survived a pass whose job was to refute it.
Then read what did not survive. The mappings that were proposed for the same pair and rejected are published here too, with the reason each one failed. A coverage figure that never threw anything away has not been tested, and you cannot tell the difference from the number alone.
This is fetched live from the same free, unauthenticated endpoint your agent would call. Change the pair and watch it change. Nothing on this page is a picture of an audit trail.
595 released pairs to choose from.
Level of review
machine_verifiedMappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.
25 claims, in full
GET /api/agent/crosswalk/provenance?source=ISO 27001:2022&target=SOC 2
Each claim names the source control whose evidence does the work, the target control it satisfies, and the reasoning. `argued_against_and_upheld` means a second pass tried to refute the claim and failed; claims that failed it are kept in the graph as refuted rather than deleted. The document fields say what each control was verified against and when.
Capacity management
Maintains capacity to meet availability commitments
Capacity management is how availability commitments are kept.
Information backup
Environmental protections, data backups, and recovery infrastructure support availability
Information backup is the data backup limb of this criterion.
Supporting utilities
Environmental protections, data backups, and recovery infrastructure support availability
Supporting utilities cover the power and cooling this criterion names.
Protecting against physical and environmental threats
Environmental protections, data backups, and recovery infrastructure support availability
Protecting against physical and environmental threats is the environmental limb.
ICT readiness for business continuity
Recovery plan procedures support system recovery from failures
ICT readiness for continuity requires recovery plans be exercised.
Data masking
Confidential information is identified and protected during receipt, processing, storage
Data masking protects confidential information during processing and display.
Confidentiality or non-disclosure agreements
Confidential information is identified and protected during receipt, processing, storage
Confidentiality agreements bind those who handle confidential information.
Labelling of information
Confidential information is identified and protected during receipt, processing, storage
Labelling makes classification actionable during handling.
Classification of information
Confidential information is identified and protected during receipt, processing, storage
Classification of information is how confidential information gets identified.
Information deletion
Confidential information is disposed of securely
Information deletion is the disposal requirement of this criterion.
Secure disposal or re-use of equipment
Confidential information is disposed of securely
Secure disposal of equipment covers media holding confidential information.
Disciplinary process
COSO principle 1: Demonstrates commitment to integrity and ethical values
A disciplinary process is how deviations from expected conduct are addressed.
Segregation of duties
COSO principle 3: Management establishes structures, reporting lines, and authorities
Segregation of duties defines reporting lines that limit conflicting authority.
Information security roles and responsibilities
COSO principle 3: Management establishes structures, reporting lines, and authorities
Defined security roles and responsibilities establish structures and authorities.
Information security awareness, education and training
COSO principle 4: Demonstrates commitment to attract and retain competent individuals
Awareness, education and training evidence developing and retaining competence.
Screening
COSO principle 4: Demonstrates commitment to attract and retain competent individuals
Screening evidences the entity attracts individuals suited to their responsibilities.
Disciplinary process
COSO principle 5: Holds individuals accountable for internal control responsibilities
A disciplinary process holds individuals accountable for control responsibilities.
Management responsibilities
COSO principle 5: Holds individuals accountable for internal control responsibilities
Management responsibilities require staff to apply security per defined rules.
Information security awareness, education and training
COSO principle 14: Internally communicates information including objectives and responsibilities
Awareness and training is how objectives and responsibilities reach personnel.
Policies for information security
COSO principle 14: Internally communicates information including objectives and responsibilities
Communicated security policies carry objectives and responsibilities internally.
Information security roles and responsibilities
COSO principle 14: Internally communicates information including objectives and responsibilities
Assigned roles tell individuals what they are internally responsible for.
Addressing information security within supplier agreements
COSO principle 15: Communicates with external parties regarding matters affecting controls
Supplier agreements communicate security expectations to external parties.
Contact with special interest groups
COSO principle 15: Communicates with external parties regarding matters affecting controls
Contact with special interest groups is external communication on security matters.
Contact with authorities
COSO principle 15: Communicates with external parties regarding matters affecting controls
Contact with authorities is defined external communication about security matters.
Compliance with policies, rules and standards for information security
COSO principle 16: Selects and develops ongoing and separate evaluations
Compliance reviews against policies and standards are the ongoing evaluations.
102 mappings were refuted and are not in that number
GET /api/agent/crosswalk/refuted?source=ISO 27001:2022&target=SOC 2
These were proposed for this same pair and then thrown out. They are not deleted from the graph, they are kept marked as refuted, which is what stops a failed claim quietly coming back later. The coverage figure above is what is left after they were removed.
The pair summary counts every mapping removed in review. This section lists the ones marked refuted, which is the set that carries a record per mapping. Showing the first 25 of 102.
Read the sample as the best documented end of the list, not a fair slice of it. The endpoint returns the rejections that carry a stated reason first, and on several pairs most of the refutations behind them carry none. Raise the limit on the endpoint and you will see those too.
Information security during disruption
Environmental protections, data backups, and recovery infrastructure support availability
Cover backup, redundancy, continuity, and physical protections
ICT readiness for business continuity
Environmental protections, data backups, and recovery infrastructure support availability
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Redundancy of information processing facilities
Environmental protections, data backups, and recovery infrastructure support availability
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Information security during disruption
Recovery plan procedures support system recovery from failures
Held back 2026-08-19. Generated by the retired metered path, refuted at 56 percent wherever re-judged. Pair pulled from sale pending a rebuild on the Max plan.
Information backup
Recovery plan procedures support system recovery from failures
5.30 and 5.29 cover testing and continuity during disruption
Information backup
Confidential information is identified and protected during receipt, processing, storage
Classification, labeling, and transfer cover identification and protection
Data leakage prevention
Confidential information is identified and protected during receipt, processing, storage
Classification, labeling, and transfer cover identification and protection
Information transfer
Confidential information is identified and protected during receipt, processing, storage
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Confidentiality or non-disclosure agreements
COSO principle 1: Demonstrates commitment to integrity and ethical values
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Independent review of information security
COSO principle 1: Demonstrates commitment to integrity and ethical values
Policies, training, and NDAs show ethical commitment
Information security roles and responsibilities
COSO principle 1: Demonstrates commitment to integrity and ethical values
Policies, training, and NDAs show ethical commitment
Compliance with policies, rules and standards for information security
COSO principle 1: Demonstrates commitment to integrity and ethical values
Policies, training, and NDAs show ethical commitment
Information security awareness, education and training
COSO principle 1: Demonstrates commitment to integrity and ethical values
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Independent review of information security
COSO principle 2: Board exercises oversight responsibility
Independent review not equivalent to board oversight
Management responsibilities
COSO principle 3: Management establishes structures, reporting lines, and authorities
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Information security roles and responsibilities
COSO principle 5: Holds individuals accountable for internal control responsibilities
Held back 2026-08-19. Generated by the retired metered path, refuted at 56 percent wherever re-judged. Pair pulled from sale pending a rebuild on the Max plan.
Information security awareness, education and training
COSO principle 5: Holds individuals accountable for internal control responsibilities
Roles, compliance, and discipline enforce accountability
Compliance with policies, rules and standards for information security
COSO principle 5: Holds individuals accountable for internal control responsibilities
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Monitoring, review and change management of supplier services
COSO principle 15: Communicates with external parties regarding matters affecting controls
None address external communication about control functionality
Disciplinary process
COSO principle 8: Considers potential for fraud
Neither addresses fraud risk assessment directly
Information security incident management planning and preparation
COSO principle 8: Considers potential for fraud
Neither addresses fraud risk assessment directly
Monitoring activities
COSO principle 16: Selects and develops ongoing and separate evaluations
retired metered-API path. 56 percent of its output was refuted wherever it was re-judged, so its residue is not trusted evidence. Superseded by judgement on the Claude Max plan 2026-08-19.
Change management
COSO principle 16: Selects and develops ongoing and separate evaluations
Ongoing monitoring and independent review directly support control evaluations
Monitoring activities
COSO principle 17: Evaluates and communicates deficiencies in a timely manner
None ensure timely communication to senior management or board
Response to information security incidents
COSO principle 17: Evaluates and communicates deficiencies in a timely manner
None ensure timely communication to senior management or board
This is a sample, and the report is not
The endpoint returns up to twenty five claims so you can judge the work before paying for it. The paid report is every evidenced control and every gap, not a sample, as a report you can hand to an assessor.
What this is not
A mapping between two frameworks is a judgement, not text printed in either standard. Publishing the reasoning does not make a claim correct, it makes it checkable, and your assessor may still take a different view on individual controls. That is why the reasoning is here rather than a bare number.
Claims that failed the refutation pass are not deleted from the graph, they are kept marked as refuted, which is what stops a failed claim from quietly coming back. If you think one of the claims above is wrong, say so at support@theartofservice.com and it gets re-judged.