Between "something happened somewhere again" and "here is the auditable proof that we assessed it" lies a lot of manual work. SecTepe.CTI.Compliance automates exactly this stretch: from around 62 sources, classified, framework-mapped compliance reports are created that end up as evidence in SecTepe.Core.
The Four-Axis Classification
At the core is a classification along four axes that mirror the downstream MISP/Core portal – so every report can be filtered and audited by sector, geography, method, and source trust:
- CATEGORY – sector/theme: including KRITIS, energy, defense, espionage, supply chain, cloud security, data protection, financial sector, automotive, healthcare.
- TECHNIQUE – measures/angle: measures, risks, mitigation, compliance, TOM, BCM, SBOM, framework, patch management, resilience.
- LOCATION – with automatic country-to-region derivation:
DE/FR/GB → [Europe, NATO],US → [Americas, NATO], etc. NATO is added only for member states. - TRUST – trust level (default
MEDIUM) plus TLP (defaultAMBER, optional+STRICT).
Unknown tokens are tolerated (and logged) so the feeds may outpace the vocabulary – a pragmatic way of dealing with a constantly changing threat landscape.
The Pipeline From Source to Evidence
The end-to-end flow across four repositories reads: ~62 RSS/HTTP sources + supply-chain advisories → ingest (dedup, Readability) → classify (18 rules → topic + framework + severity) → analyze (IOC entities, story clustering, LLM advisor) → render (Markdown/JSON/HTML/PDF + dashboard). Optionally, enrichment follows via the MISP intel API of SecTepe.Core.CTI.
Framework Mapping at the Core
Classification runs against the major frameworks: NIS2 (24h/72h reporting, supply chain, management liability), DORA (ICT risk management, incident reporting, resilience testing, TLPT), GDPR (72h notification, DPIA), ISO/IEC 27001 (Annex A), BSI IT-Grundschutz, TISAX, PCI-DSS, and HIPAA. Cross-source stories bundle the same topic across several sources into one narrative instead of eight duplicates.
The Loop Closes in SecTepe.Core
Finally, the reports are handed to SecTepe.Core (POST /api/v1/ingest/compliance-reports). There, the EvidenceMappingService maps each finding via its framework to an ISMS control, computes coverage and a gap list, and an audit-package service bundles the result. A threat news item thus traceably becomes auditable governance evidence – the continuation of the logic from the supply-chain advisory pipeline.
Conclusion
Four classification axes, a framework mapping across eight frameworks, and an end-to-end flow into ISMS evidence: SecTepe.CTI.Compliance closes the gap between threat landscape and proof obligation. That is exactly what NIS2 and DORA demand when they call for continuous, provable risk work.