Compliance Attestation Report
Framework-oriented control mapping for audit and governance workflows
local-upload/ShiftOps-master | 7/17/2026, 6:07:26 PM
70%
Ready With ConditionsRecommendation: Deploy after fixing: identified readiness gaps.
0Critical
0High
3Medium
0Low
Framework Mapping
| Framework | Mapped Controls | Status |
|---|---|---|
| OWASP Top 10 | A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components | Partial |
| CIS Controls | Secure configuration, vulnerability management, audit logging | Needs Work |
| NIST CSF | Identify, Protect, Detect, Respond, Recover | Mapped |
| SOC 2 | Security, availability, confidentiality evidence | Partial |
| ISO 27001 | Risk treatment, access control, operational security | Partial |
| PCI DSS | Dependency risk, secrets handling, secure transmission | Partial |
| GDPR | Data exposure, access control, retention and privacy signals | Initial |
Control Evidence Summary
#1
Suite 1 - Build Verification
WARN | medium
Node project detected but node_modules is missing. Install packages before build verification.
- Engine
- Quality
- Evidence
- { "checks": [ "Missing packages" ], "runner": "pnpm" }
- Recommendation
- Fix build failures before production release and add the build command to CI gates.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 2 - Static Code Quality
WARN | medium
Lint script failed. TypeScript compiler reported errors. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.
- Engine
- Quality
- Evidence
- { "lint": "> ShiftOps- Workforce-Planner@0.1.0 lint C:\\Users\\Sunny\\Downloads\\Engineering-validation-platform\\uploaded-repositories\\ShiftOps-master-ad497fa2\n> eslint .\n\n ELIFECYCLE Command failed with exit code 1.\n WARN Local package.json exists, but node_modules missing, did you mean to install?\n\n'eslint' is not recognized as an internal or external command,\r\noperable program or batch file.", "staticScan": { "scannedFiles": 24, "codeSmellCount": 0, "unsafeAnyCount": 17, "duplicatedSymbolCount": 53 }, "typescript": "components/AIAssistant.tsx(39,36): error TS7006: Parameter 't' implicitly has an 'any' type.\r\ncomponents/AIAssistant.tsx(40,35): error TS7006: Parameter 'team' implicitly has an 'any' type.\r\ncomponents/AIAssistant.tsx(41,43): error TS7006: Parameter 'employee' implicitly has an 'any' type.\r\ncomponents/AIAssistant.tsx(41,71): error TS7006: Parameter 'team' implicitly has an 'any' type.\r\ncomponents/AIAssistant.tsx(42,43): error TS7006: Parameter 'schedule'
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 3 - Testing
WARN | medium
No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.
- Engine
- Quality
- Evidence
- { "availableScripts": [ "dev", "build", "start", "lint" ] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline