Data/ComplianceCrosswalk.json

{
  "version": "2.1.0",
  "description": "Maps PSGuerrilla audit check IDs to compliance framework requirements. Covers FERPA, COPPA, CIPA, NIST SP 800-171, and state education technology privacy laws.",
  "frameworks": {
    "FERPA": {
      "fullName": "Family Educational Rights and Privacy Act",
      "description": "Federal law protecting the privacy of student education records",
      "authority": "20 U.S.C. § 1232g; 34 CFR Part 99"
    },
    "COPPA": {
      "fullName": "Children's Online Privacy Protection Act",
      "description": "Federal law protecting personal information of children under 13",
      "authority": "15 U.S.C. §§ 6501–6506; 16 CFR Part 312"
    },
    "CIPA": {
      "fullName": "Children's Internet Protection Act",
      "description": "Federal law requiring E-rate recipients to filter internet access and monitor online activity",
      "authority": "47 U.S.C. § 254(h)(5)"
    },
    "NIST-171": {
      "fullName": "NIST SP 800-171",
      "description": "Protecting Controlled Unclassified Information in nonfederal systems",
      "authority": "NIST Special Publication 800-171 Rev. 2"
    },
    "STATE-EDTECH": {
      "fullName": "State Student Data Privacy Laws",
      "description": "Aggregate of common state education technology privacy requirements (e.g., SOPIPA, state SPAs)",
      "authority": "Various state statutes"
    }
  },
  "mappings": {
    "AUTH-001": {
      "checkName": "2SV Enforcement",
      "frameworks": {
        "FERPA": { "requirement": "Reasonable methods to ensure only authorized access to education records", "citation": "34 CFR § 99.31(a)(1)" },
        "COPPA": { "requirement": "Reasonable security for children's personal information", "citation": "16 CFR § 312.8" },
        "NIST-171": { "requirement": "Multi-factor authentication for privileged and network accounts", "citation": "3.5.3" },
        "STATE-EDTECH": { "requirement": "Multi-factor authentication for systems containing student data", "citation": "Common requirement" }
      }
    },
    "AUTH-002": {
      "checkName": "2SV Enrollment Rate",
      "frameworks": {
        "FERPA": { "requirement": "Technical safeguards for education records", "citation": "34 CFR § 99.31" },
        "NIST-171": { "requirement": "Employ multi-factor authentication", "citation": "3.5.3" }
      }
    },
    "AUTH-004": {
      "checkName": "Password Minimum Length",
      "frameworks": {
        "NIST-171": { "requirement": "Enforce minimum password complexity and length", "citation": "3.5.7" },
        "STATE-EDTECH": { "requirement": "Strong password requirements for accounts accessing student data", "citation": "Common requirement" }
      }
    },
    "AUTH-007": {
      "checkName": "Session Duration Limits",
      "frameworks": {
        "NIST-171": { "requirement": "Terminate sessions after defined inactivity period", "citation": "3.1.11" }
      }
    },
    "ADMIN-005": {
      "checkName": "Admin Account 2SV",
      "frameworks": {
        "FERPA": { "requirement": "Administrative safeguards for education records", "citation": "34 CFR § 99.31" },
        "NIST-171": { "requirement": "Multi-factor authentication for privileged accounts", "citation": "3.5.3" },
        "STATE-EDTECH": { "requirement": "Enhanced authentication for administrative access to student data systems", "citation": "Common requirement" }
      }
    },
    "ADMIN-007": {
      "checkName": "Admin Account Inventory",
      "frameworks": {
        "NIST-171": { "requirement": "Employ the principle of least privilege", "citation": "3.1.5" }
      }
    },
    "DRIVE-001": {
      "checkName": "External Sharing Policy",
      "frameworks": {
        "FERPA": { "requirement": "Limit disclosure of education records to authorized parties", "citation": "34 CFR § 99.30" },
        "COPPA": { "requirement": "Limit sharing of children's personal information", "citation": "16 CFR § 312.5(c)" },
        "STATE-EDTECH": { "requirement": "Restrict external sharing of student data files", "citation": "Common requirement" }
      }
    },
    "DRIVE-002": {
      "checkName": "Drive DLP Policies",
      "frameworks": {
        "FERPA": { "requirement": "Prevent unauthorized disclosure of education records", "citation": "34 CFR § 99.33" },
        "STATE-EDTECH": { "requirement": "Data loss prevention for student PII", "citation": "Common requirement" }
      }
    },
    "OAUTH-001": {
      "checkName": "Third-Party App Access Control",
      "frameworks": {
        "COPPA": { "requirement": "Verifiable parental consent before collecting children's data via third parties", "citation": "16 CFR § 312.5(b)" },
        "FERPA": { "requirement": "Limit access to education records to school officials with legitimate interest", "citation": "34 CFR § 99.31(a)(1)" },
        "STATE-EDTECH": { "requirement": "Vet and approve third-party applications accessing student data", "citation": "Common requirement" }
      }
    },
    "OAUTH-003": {
      "checkName": "OAuth Scope Review",
      "frameworks": {
        "COPPA": { "requirement": "Collect only necessary personal information from children", "citation": "16 CFR § 312.7" },
        "STATE-EDTECH": { "requirement": "Minimize third-party app access to student data scopes", "citation": "Common requirement" }
      }
    },
    "EMAIL-003": {
      "checkName": "Email Auto-Forwarding Policy",
      "frameworks": {
        "FERPA": { "requirement": "Prevent unauthorized disclosure of education records via email forwarding", "citation": "34 CFR § 99.33" },
        "STATE-EDTECH": { "requirement": "Block automatic email forwarding to external domains for accounts with student data access", "citation": "Common requirement" }
      }
    },
    "EMAIL-005": {
      "checkName": "Email Content Compliance",
      "frameworks": {
        "FERPA": { "requirement": "Content scanning for PII in outbound email", "citation": "34 CFR § 99.33" },
        "CIPA": { "requirement": "Technology protection measures for electronic communications", "citation": "47 U.S.C. § 254(h)(5)(B)" }
      }
    },
    "COLLAB-001": {
      "checkName": "External Collaboration Restrictions",
      "frameworks": {
        "FERPA": { "requirement": "Control external access to systems containing education records", "citation": "34 CFR § 99.31" },
        "COPPA": { "requirement": "Restrict children's ability to share personal information publicly", "citation": "16 CFR § 312.5(c)" }
      }
    },
    "LOG-001": {
      "checkName": "Audit Logging Enabled",
      "frameworks": {
        "FERPA": { "requirement": "Maintain record of access to education records", "citation": "34 CFR § 99.32" },
        "NIST-171": { "requirement": "Create and retain system audit logs", "citation": "3.3.1" },
        "STATE-EDTECH": { "requirement": "Audit logging for all access to student data systems", "citation": "Common requirement" }
      }
    },
    "LOG-002": {
      "checkName": "Audit Log Retention",
      "frameworks": {
        "FERPA": { "requirement": "Maintain access records for the life of the education record", "citation": "34 CFR § 99.32(a)(1)" },
        "NIST-171": { "requirement": "Retain audit logs per organizational policy", "citation": "3.3.1" }
      }
    },
    "DEVICE-001": {
      "checkName": "Device Management Enrollment",
      "frameworks": {
        "COPPA": { "requirement": "Reasonable security for children's data on devices", "citation": "16 CFR § 312.8" },
        "CIPA": { "requirement": "Technology protection measures on devices used by minors", "citation": "47 U.S.C. § 254(h)(5)(B)" }
      }
    },
    "M365EXO-001": {
      "checkName": "Exchange External Forwarding",
      "frameworks": {
        "FERPA": { "requirement": "Prevent unauthorized disclosure via mail forwarding", "citation": "34 CFR § 99.33" },
        "STATE-EDTECH": { "requirement": "Block external mail forwarding for accounts with student data", "citation": "Common requirement" }
      }
    },
    "M365SPO-001": {
      "checkName": "SharePoint External Sharing",
      "frameworks": {
        "FERPA": { "requirement": "Restrict external access to document repositories containing education records", "citation": "34 CFR § 99.30" },
        "COPPA": { "requirement": "Limit sharing of documents containing children's personal information", "citation": "16 CFR § 312.5(c)" }
      }
    },
    "EIDAUTH-001": {
      "checkName": "Entra MFA Enforcement",
      "frameworks": {
        "FERPA": { "requirement": "Access controls for education records", "citation": "34 CFR § 99.31" },
        "NIST-171": { "requirement": "Multi-factor authentication", "citation": "3.5.3" }
      }
    },
    "EIDCA-001": {
      "checkName": "Conditional Access Policies",
      "frameworks": {
        "NIST-171": { "requirement": "Limit system access to authorized users and devices", "citation": "3.1.1" },
        "STATE-EDTECH": { "requirement": "Context-aware access controls for student data systems", "citation": "Common requirement" }
      }
    },
    "ADPWD-001": {
      "checkName": "AD Password Policy",
      "frameworks": {
        "NIST-171": { "requirement": "Enforce password complexity and minimum length", "citation": "3.5.7" }
      }
    },
    "ADPRIV-001": {
      "checkName": "Privileged Account Review",
      "frameworks": {
        "NIST-171": { "requirement": "Employ the principle of least privilege", "citation": "3.1.5" },
        "FERPA": { "requirement": "Limit access to education records to officials with legitimate interest", "citation": "34 CFR § 99.31(a)(1)" }
      }
    },
    "INTUNE-001": {
      "checkName": "Intune Compliance Policies",
      "frameworks": {
        "COPPA": { "requirement": "Reasonable security on devices accessing children's data", "citation": "16 CFR § 312.8" },
        "CIPA": { "requirement": "Technology protection measures on school-issued devices", "citation": "47 U.S.C. § 254(h)(5)" }
      }
    }
  }
}