Quick question: I’m standardizing audit evidence in OSCAL after our Q3 control testing, and I’m looking for reusable profiles that map NIST 800–53 Rev… 5 to ISO 27001:2022 and SOC 2, ideally with parameterized statements for AC-2(1) and CM-6. If you’ve used compliance-trestle or GovReady to generate control narratives and POA&Ms from those profiles, did it hold up under external audit?
I’ve standardized OSCAL after Q3 testing by starting from the FedRAMP Rev. 5 profiles here: GitHub - GSA/fedramp-automation: FedRAMP Automation, then layering a top-level profile with set-parameter for AC-2(1) and CM-6 so compliance-trestle resolved them into the SSP and narratives. That let us generate POA&Ms that passed review, though the ISO 27001:2022 and SOC 2 crosswalk wasn’t turnkey — I kept those mappings in a component-definition with props and a small CSV crosswalk that trestle merged.
Following @nwood49’s layering idea, I kept ISO 27001 and SOC 2 as component-definitions with cross-refs and pulled 800–53 r5 from GitHub - usnistgov/oscal-content: NIST SP 800-53 content and other OSCAL content examples; in compliance-trestle I added ‘set-parameter’ for AC-2(1) and CM-6 so GovReady would emit the params cleanly into narratives/POA&Ms (not pretty, but it holds)… Want a tiny snippet of the profile.yaml for the parameter IDs?
For the Q3 batch I set the AC-2(1) and CM-6 values right in the profile via set-parameter and kept ISO 27001/SOC 2 as component-definitions, which let compliance-trestle keep the narratives reusable across audits. GovReady-Q’s OSCAL assessment-results exported cleanly to a POA&M as long as each finding had a back-matter evidence resource and consistent UUIDs, which our auditor accepted. I pulled the catalog from GitHub - usnistgov/oscal-content: NIST SP 800-53 content and other OSCAL content examples and layered an org profile on top — close to @nwood49’s flow — but watch for parameter-id drift between Rev.