feat(compliance): add CIS Controls v8.1 universal framework (#11700)

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>

api/src/backend/api/v1/views.py

@@ -1888,8 +1888,8 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
         description=(
             "Download a specific compliance report as an OCSF JSON file. "
             "Only universal frameworks that declare an output configuration "
-            "produce this artifact (currently 'dora_2022_2554' and 'csa_ccm_4.0'); any "
-            "other framework returns 404."
+            "produce this artifact (currently 'dora_2022_2554', 'csa_ccm_4.0' "
+            "and 'cis_controls_8.1'); any other framework returns 404."
         ),
         parameters=[
             OpenApiParameter(

prowler/CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_conditional_access_policy_explicitly_targets_azure_devops` check for M365 provider, verifying at least one enabled Conditional Access policy explicitly includes the Azure DevOps cloud application instead of relying on a broad "All cloud apps" policy [(#11182)](https://github.com/prowler-cloud/prowler/pull/11182)
 - `entra_conditional_access_policy_no_exclusion_gaps` check for M365 provider, verifying every user, group, role, or application excluded from an enabled Conditional Access policy stays in scope of another enabled policy [(#11577)](https://github.com/prowler-cloud/prowler/pull/11577)
 - `stepfunctions_statemachine_encrypted_with_cmk` check for AWS provider, verifying that each Step Functions state machine uses a customer-managed KMS key for encryption at rest rather than the default AWS-owned key [(#11538)](https://github.com/prowler-cloud/prowler/pull/11538)
+- CIS Controls v8.1 universal compliance framework mapping existing checks across 18 providers (AWS, Azure, GCP, Kubernetes, M365, GitHub, AlibabaCloud, OracleCloud, GoogleWorkspace, Okta, Cloudflare, Vercel, MongoDB Atlas, OpenStack, Linode, StackIT, NHN, and Scaleway) to the 18 CIS Critical Security Controls and their Safeguards [(#11700)](https://github.com/prowler-cloud/prowler/pull/11700)
 - CIS Microsoft 365 Foundations Benchmark v7.0.0 compliance framework for the M365 provider [(#11699)](https://github.com/prowler-cloud/prowler/pull/11699)
 - `waf_regional_webacl_logging_enabled` check for AWS provider, verifying that each AWS WAF Classic Regional Web ACL has logging enabled to a Kinesis Data Firehose stream [(#11539)](https://github.com/prowler-cloud/prowler/pull/11539)
 

ui/CHANGELOG.md

@@ -10,6 +10,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 - Scan configuration management page (`/scan-config`) to create, edit, and manage scan configs with live YAML validation against the server JSON Schema (only available in Prowler Cloud) [(#11695)](https://github.com/prowler-cloud/prowler/pull/11695)
 - Surface an "invalid scan configuration" note on compliance requirements that fail solely because the applied scan config does not meet them [(#11695)](https://github.com/prowler-cloud/prowler/pull/11695)
 - Filter the Overview, Findings, Resources, Scans, and Providers views by provider group [(#11659)](https://github.com/prowler-cloud/prowler/pull/11659)
+- CIS Controls v8.1 compliance support, including its detail view and report mapping [(#11700)](https://github.com/prowler-cloud/prowler/pull/11700)
 
 ---
 

ui/components/compliance/compliance-custom-details/cis-controls-details.tsx

@@ -0,0 +1,56 @@
+import { Requirement } from "@/types/compliance";
+
+import {
+  ComplianceBadge,
+  ComplianceBadgeContainer,
+  ComplianceDetailContainer,
+  ComplianceDetailSection,
+  ComplianceDetailText,
+} from "./shared-components";
+
+interface CISControlsDetailsProps {
+  requirement: Requirement;
+}
+
+export const CISControlsCustomDetails = ({
+  requirement,
+}: CISControlsDetailsProps) => {
+  const implementationGroups = Array.isArray(requirement.implementation_groups)
+    ? (requirement.implementation_groups as string[])
+    : [];
+
+  return (
+    <ComplianceDetailContainer>
+      {requirement.description && (
+        <ComplianceDetailSection title="Description">
+          <ComplianceDetailText>{requirement.description}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      <ComplianceBadgeContainer>
+        {requirement.function && (
+          <ComplianceBadge
+            label="Security Function"
+            value={requirement.function as string}
+            variant="info"
+          />
+        )}
+        {requirement.asset_type && (
+          <ComplianceBadge
+            label="Asset Type"
+            value={requirement.asset_type as string}
+            variant="secondary"
+          />
+        )}
+        {implementationGroups.map((group) => (
+          <ComplianceBadge
+            key={group}
+            label="Implementation Group"
+            value={group}
+            variant="tag"
+          />
+        ))}
+      </ComplianceBadgeContainer>
+    </ComplianceDetailContainer>
+  );
+};

ui/lib/compliance/cis-controls.tsx

@@ -0,0 +1,143 @@
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
+import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import {
+  AttributesData,
+  CISControlsAttributesMetadata,
+  Framework,
+  Requirement,
+  REQUIREMENT_STATUS,
+  RequirementsData,
+  RequirementStatus,
+} from "@/types/compliance";
+
+import {
+  calculateFrameworkCounters,
+  createRequirementsMap,
+  findOrCreateCategory,
+  findOrCreateControl,
+  findOrCreateFramework,
+} from "./commons";
+
+const getStatusCounters = (status: RequirementStatus) => ({
+  pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
+  fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
+  manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
+});
+
+// Sort the 18 CIS Controls by their leading number ("1. ...", "2. ...", ...,
+// "18. ...") so the accordion always reads in canonical control order
+// regardless of how the API returns the sections.
+const sectionOrder = (section: string): number => {
+  const match = section.match(/^(\d+)/);
+  return match ? parseInt(match[1], 10) : Number.MAX_SAFE_INTEGER;
+};
+
+export const mapComplianceData = (
+  attributesData: AttributesData,
+  requirementsData: RequirementsData,
+): Framework[] => {
+  const attributes = attributesData?.data || [];
+  const requirementsMap = createRequirementsMap(requirementsData);
+  const frameworks: Framework[] = [];
+
+  for (const attributeItem of attributes) {
+    const id = attributeItem.id;
+    const metadataArray = attributeItem.attributes?.attributes
+      ?.metadata as unknown as CISControlsAttributesMetadata[];
+    const attrs = metadataArray?.[0];
+    if (!attrs) continue;
+
+    const requirementData = requirementsMap.get(id);
+    if (!requirementData) continue;
+
+    const frameworkName = attributeItem.attributes.framework;
+    // Group by Section (the top-level CIS Control). Function, AssetType and
+    // ImplementationGroups live inside the requirement so they show up on the
+    // detail drawer.
+    const categoryName = attrs.Section;
+    const requirementName = attributeItem.attributes.name || "";
+    const description = attributeItem.attributes.description;
+    const status = requirementData.attributes.status || "";
+    const checks = attributeItem.attributes.attributes.check_ids || [];
+
+    const framework = findOrCreateFramework(frameworks, frameworkName);
+    const category = findOrCreateCategory(framework.categories, categoryName);
+    // Flat 2-level structure: control → safeguards (no intermediate level).
+    const control = findOrCreateControl(category.controls, categoryName);
+
+    const finalStatus: RequirementStatus = status as RequirementStatus;
+    const requirement: Requirement = {
+      name: requirementName ? `${id} - ${requirementName}` : id,
+      description,
+      status: finalStatus,
+      check_ids: checks,
+      ...getStatusCounters(finalStatus),
+      function: attrs.Function ?? undefined,
+      asset_type: attrs.AssetType ?? undefined,
+      implementation_groups: attrs.ImplementationGroups ?? undefined,
+    };
+
+    control.requirements.push(requirement);
+  }
+
+  for (const framework of frameworks) {
+    framework.categories.sort(
+      (a, b) => sectionOrder(a.name) - sectionOrder(b.name),
+    );
+  }
+
+  calculateFrameworkCounters(frameworks);
+
+  return frameworks;
+};
+
+export const toAccordionItems = (
+  data: Framework[],
+  scanId: string | undefined,
+): AccordionItemProps[] => {
+  const safeId = scanId || "";
+
+  return data.flatMap((framework) =>
+    framework.categories.map((category) => ({
+      key: `${framework.name}-${category.name}`,
+      title: (
+        <ComplianceAccordionTitle
+          label={category.name}
+          pass={category.pass}
+          fail={category.fail}
+          manual={category.manual}
+          isParentLevel={true}
+        />
+      ),
+      content: "",
+      // Control → safeguards (flat, no intermediate level).
+      items: category.controls.flatMap((control) =>
+        control.requirements.map((requirement, reqIndex) => ({
+          key: `${framework.name}-${category.name}-req-${reqIndex}`,
+          title: (
+            <ComplianceAccordionRequirementTitle
+              type=""
+              name={requirement.name}
+              status={requirement.status as FindingStatus}
+            />
+          ),
+          content: (
+            <ClientAccordionContent
+              key={`content-${framework.name}-${category.name}-req-${reqIndex}`}
+              requirement={requirement}
+              scanId={safeId}
+              framework={framework.name}
+              disableFindings={
+                requirement.check_ids.length === 0 && requirement.manual === 0
+              }
+            />
+          ),
+          items: [],
+        })),
+      ),
+    })),
+  );
+};

ui/lib/compliance/compliance-mapper.ts

@@ -4,6 +4,7 @@ import { ASDEssentialEightCustomDetails } from "@/components/compliance/complian
 import { AWSWellArchitectedCustomDetails } from "@/components/compliance/compliance-custom-details/aws-well-architected-details";
 import { C5CustomDetails } from "@/components/compliance/compliance-custom-details/c5-details";
 import { CCCCustomDetails } from "@/components/compliance/compliance-custom-details/ccc-details";
+import { CISControlsCustomDetails } from "@/components/compliance/compliance-custom-details/cis-controls-details";
 import { CISCustomDetails } from "@/components/compliance/compliance-custom-details/cis-details";
 import { CSACustomDetails } from "@/components/compliance/compliance-custom-details/csa-details";
 import { DORACustomDetails } from "@/components/compliance/compliance-custom-details/dora-details";
@@ -44,6 +45,10 @@ import {
   mapComplianceData as mapCISComplianceData,
   toAccordionItems as toCISAccordionItems,
 } from "./cis";
+import {
+  mapComplianceData as mapCISControlsComplianceData,
+  toAccordionItems as toCISControlsAccordionItems,
+} from "./cis-controls";
 import { calculateCategoryHeatmapData, getTopFailedSections } from "./commons";
 import {
   mapComplianceData as mapCSAComplianceData,
@@ -156,6 +161,20 @@ const getComplianceMappers = (): Record<string, ComplianceMapper> => ({
     getDetailsComponent: (requirement: Requirement) =>
       createElement(CISCustomDetails, { requirement }),
   },
+  // CIS Controls v8.1 — universal framework keyed by the `framework` field of
+  // `prowler/compliance/cis_controls_8.1.json` ("CIS-Controls"). Distinct from
+  // the per-provider CIS Benchmarks (keyed "CIS"). Groups by Section (the 18
+  // CIS Controls) and surfaces Security Function / Asset Type / Implementation
+  // Groups in the requirement detail drawer.
+  "CIS-Controls": {
+    mapComplianceData: mapCISControlsComplianceData,
+    toAccordionItems: toCISControlsAccordionItems,
+    getTopFailedSections,
+    calculateCategoryHeatmapData: (data: Framework[]) =>
+      calculateCategoryHeatmapData(data),
+    getDetailsComponent: (requirement: Requirement) =>
+      createElement(CISControlsCustomDetails, { requirement }),
+  },
   "AWS-Well-Architected-Framework-Security-Pillar": {
     mapComplianceData: mapAWSWellArchitectedComplianceData,
     toAccordionItems: toAWSWellArchitectedAccordionItems,

ui/lib/compliance/compliance-report-types.test.ts

@@ -39,6 +39,7 @@ describe("isOcsfSupported", () => {
   it("returns true for universal frameworks shipping an OCSF artifact", () => {
     expect(isOcsfSupported("dora_2022_2554")).toBe(true);
     expect(isOcsfSupported("csa_ccm_4.0")).toBe(true);
+    expect(isOcsfSupported("cis_controls_8.1")).toBe(true);
   });
 
   it("returns false for legacy/per-provider frameworks without OCSF output", () => {

ui/lib/compliance/compliance-report-types.ts

@@ -180,6 +180,7 @@ export const pickLatestCisPerProvider = (
 const OCSF_SUPPORTED_COMPLIANCE_IDS: ReadonlySet<string> = new Set([
   "dora_2022_2554",
   "csa_ccm_4.0",
+  "cis_controls_8.1",
 ]);
 
 export const isOcsfSupported = (complianceId: string | undefined): boolean =>

ui/types/compliance.ts

@@ -397,6 +397,19 @@ export interface DORARequirement extends Requirement {
   article_title: DORAAttributesMetadata["ArticleTitle"];
 }
 
+export interface CISControlsAttributesMetadata {
+  Section: string;
+  Function: string | null;
+  AssetType: string | null;
+  ImplementationGroups: string[] | null;
+}
+
+export interface CISControlsRequirement extends Requirement {
+  function?: string;
+  asset_type?: string;
+  implementation_groups?: string[];
+}
+
 export interface AttributesItemData {
   type: "compliance-requirements-attributes";
   id: string;
@@ -421,6 +434,7 @@ export interface AttributesItemData {
         | ASDEssentialEightAttributesMetadata[]
         | OktaIDaaSStigAttributesMetadata[]
         | DORAAttributesMetadata[]
+        | CISControlsAttributesMetadata[]
         | GenericAttributesMetadata[];
       check_ids: string[];
       // MITRE structure