From Threat News to Auditable Governance Evidence

There is a lot of manual work between "something happened somewhere again" and "here is the proof that we assessed it, ready for the audit". SecTepe.CTI.Compliance automates just that stretch. It draws on about 62 sources. From them it builds classified compliance reports, mapped to frameworks. These reports end up as evidence in SecTepe.Core.

Four Axes for Each Report

At the core, each report is sorted along four axes. They mirror the MISP/Core portal further down the line. So you can filter and audit each report by sector, location, method, and how far you trust the source:

• CATEGORY – sector or theme. Among them: KRITIS, energy, defense, espionage, supply chain, cloud security, data protection, financial sector, automotive, and healthcare.
• TECHNIQUE – the measure or angle: measures, risks, mitigation, compliance, TOM, BCM, SBOM, framework, patch management, and resilience.
• LOCATION – the region is derived from the country on its own: DE/FR/GB → [Europe, NATO], US → [Americas, NATO], and so on. NATO is added only for member states.
• TRUST – trust level (default MEDIUM) plus TLP (default AMBER, optional +STRICT).

Unknown tokens are allowed and logged. That way the feeds can move faster than the word list. It is a practical way to cope with threats that keep changing.

The Pipeline From Source to Evidence

The full flow runs across four repositories in these steps:

1. Ingest: ~62 RSS/HTTP sources plus supply-chain advisories come in (dedup, Readability).
2. Classify: 18 rules set the topic, framework, and severity.
3. Analyze: IOC entities, story clustering, and an LLM advisor.
4. Render: Markdown/JSON/HTML/PDF plus a dashboard.

If you want, enrichment follows through the MISP intel API of SecTepe.Core.CTI.

Framework Mapping at the Core

Each report is mapped to the major frameworks:

• NIS2 (24h/72h reporting, supply chain, management liability)
• DORA (ICT risk management, incident reporting, resilience testing, TLPT)
• GDPR (72h notice, DPIA)
• ISO/IEC 27001 (Annex A)
• BSI IT-Grundschutz, TISAX, PCI-DSS, and HIPAA

Stories across sources group the same topic from several sources into one story. You read one item, not eight copies.

The Loop Closes in SecTepe.Core

At the end, the reports go to SecTepe.Core (POST /api/v1/ingest/compliance-reports). There, the EvidenceMappingService maps each finding through its framework to an ISMS control. It works out the coverage and a list of gaps. An audit-package service then bundles the result. In this way, a threat news item becomes auditable governance evidence, and you can trace each step. It carries on the logic of the supply-chain advisory pipeline.

Conclusion

Four axes, mapping to eight frameworks, and a full flow into ISMS evidence: SecTepe.CTI.Compliance closes the gap between the threats out there and your duty to prove what you did. That is just what NIS2 and DORA ask for when they call for risk work that is ongoing and can be proven.