Compliance Signal Enumeration

A neutral, machine-readable registry of compliance-relevant technical signals for interoperability across security tools, compliance platforms, and GRC systems.

Community
Open Infrastructure
1,143
Signals
2,062
Mappings
12
Frameworks
12
Domains
155
Categories
4
Schemas
Pro
Cross-Framework Analysis
95K+
Crosswalks
44
Framework Pairs
53
Multi-FW Signals
1,228
Controls
Included
Control Sources
Included
Gap Analysis
Teams
Enterprise Collaboration
284
Tool Mappings
20
Security Tools
1,143
Finding Templates
46
Artifact Types
129+
Provider Mappings
10 GB
Storage

The Interoperability Gap

Security tools report findings using proprietary identifiers. Without a shared vocabulary, correlation requires manual effort at every boundary.

!Without CSE

Tool A: "S3_BUCKET_SSE_DISABLED"
Tool B: "storage-encryption-missing"
Tool C: "Finding: AES-256 not enabled"
Organization asks:
"Are these 3 different problems or the same one?"
"Which finding should we prioritize?"
"What controls are we actually violating?"
"How do we report this to auditors?"

With CSE

CSE-HIPAA-TECH-NO-ENCRYPTION-004
activev1.0.0High
Name:No Encryption at Rest
Canonical Name:Unencrypted Data Storage
Domain:HIPAACategory:TECH
Description
Data storage service does not have encryption at rest enabled, potentially exposing sensitive data if physical access is compromised.
Applicability
Cloud Providers:
awsazuregcp
Resource Types:
storagedatabasevolume
Environments:
productionstaging
Metadata
Suggested Severity:high
Risk Domains:
data-protectioncomplianceprivacy
Related Controls:
164.312(a)(2)(iv)164.312(e)(2)(ii)
Metadata Sources
Type:regulation
Name:HIPAA Security Rule
Section:164.312(a)(2)(iv)

More Than a Catalog

CSE provides standardized infrastructure for compliance data exchange.

Signal Registry

1,143 canonical definitions for compliance-relevant technical conditions across 12 frameworks.

Control Mappings

2,062 mappings: 1,228 signal-to-control mappings linking CSE signals to framework requirements, plus 834 equivalence mappings.

Tool Mappings

284 rule mappings from 20 security tools (Prowler, Checkov, Trivy, etc.) to CSE signals with confidence scores.

Finding Templates

1,143 actionable finding templates with severity factors, detection indicators, and platform-specific remediation.

Framework Crosswalks

95K+ control crosswalks across 44 framework pairs, enabling seamless multi-compliance mapping.

SDKs & CLI

Python and TypeScript SDKs with offline normalization, API clients, and CLI tools for batch processing.

Gap Analysis

Identify compliance gaps by mapping findings to framework controls with remediation guidance.

Built on Industry Standards

CSE follows established conventions from industry-recognized enumerations and schema standards, with integrations across leading security tools and cloud platforms.

Follows Industry Enumeration Patterns

Modeled after established cybersecurity taxonomies

CSE identifiers follow the same design principles as CVE, CWE, and ATT&CK: stable, immutable, and universally referenceable.

Security Tool Mappings

1,854 rule mappings from 20 security tools

Prowler218 rules
Checkov137 rules
Trivy108 rules
Semgrep95 rules
AWS Config156 rules
Azure Policy142 rules
GCP SCC118 rules
Snyk87 rules
SonarQube92 rules
KICS76 rules

+ 10 more tools including tfsec, Falco, CloudSploit, ScoutSuite, and Terrascan

Cloud Platform Coverage

OCSF-aligned artifact types with provider mappings

AWS200+ resources
Azure180+ resources
GCP150+ resources
Kubernetes50+ resources

57 artifact types covering compute, storage, network, identity, database, and container resources

Framework Authorities

CSE signals map to controls defined by these regulatory bodies and standards organizations

DoDCMMC
NISTNIST CSF
HHSHIPAA
GSAFedRAMP
ISOISO 27001
PCI SSCPCI DSS
AICPASOC 2
HITRUST AllianceHITRUST CSF

CSE does not claim endorsement by these organizations. Framework controls are mapped based on publicly available documentation.

Quick API Examples

Query the registry programmatically. Click on examples to see live responses.

API Examples

Click to explore

GEThttps://cseregistry.org/api/v1/signals?domain=HIPAA&category=TECH&per_page=2
200 OK
{
  "data": [
    {
      "id": "CSE-HIPAA-TECH-NO-AUDIT-CONTROLS-005",
      "name": "No Audit Controls",
      "canonical_name": "No Audit Controls",
      "description": "No hardware, software, or procedural mechanisms to record and examine activity in systems containing ePHI.",
      "domain": "HIPAA",
      "category": "TECH",
      "status": "active",
      "introduced_in": "1.0.0",
      "metadata": {
        "suggested_severity": "high",
        "related_controls": [
          "45 CFR 164.312(b)"
        ],
        "sources": [
          {
            "type": "regulation",
            "title": "45 CFR Part 164 Subpart C",
            "authority": "HHS"
          }
        ]
      }
    },
    {
      "id": "CSE-HIPAA-TECH-NO-ENCRYPTION-004",
      "name": "No Encryption and Decryption",
      "canonical_name": "No Encryption and Decryption",
      "description": "No mechanism to encrypt and decrypt ePHI.",
      "domain": "HIPAA",
      "category": "TECH",
      "status": "active",
      "introduced_in": "1.0.0",
      "metadata": {
        "suggested_severity": "medium",
        "related_controls": [
          "45 CFR 164.312(a)(2)(iv)"
        ],
        "sources": [
          {
            "type": "regulation",
            "title": "45 CFR Part 164 Subpart C",
            "authority": "HHS"
          }
        ]
      }
    }
  ],
  "meta": {
    "version": "1.0.0",
    "generated_at": "2025-12-30T00:00:00Z",
    "total": 9,
    "page": 1,
    "per_page": 2
  }
}
CSE Registry - Compliance Signal Enumeration