GAISSF to MITRE ATTACK Crosswalk

1. Executive Summary

CRO-026 documents defensive relationships between all 59 GAISSF v1.0 controls and a source-bounded priority set of 100 MITRE ATT&CK Enterprise techniques across all 14 Enterprise tactics. The register contains 112 control-to-technique mapping records and a reverse tactic-level coverage view.

The crosswalk supports threat modelling, detection and telemetry planning, adversary-emulation scoping, evidence reuse, and assurance design. It does not convert ATT&CK into a compliance checklist and does not prove that any mapped technique is prevented, detected, or mitigated in operation.

2. Purpose and Intended Use

• Translate adversary behavior into GAISSF control and evidence requirements.

• Support SOC, threat-intelligence, red-team, purple-team, architecture, and assurance collaboration.

• Identify control, telemetry, detection, resilience, and testing gaps.

• Provide a repeatable source for GitHub, automation, and assessment tooling.

3. Scope

Primary scope: MITRE ATT&CK Enterprise v19. Mobile and ICS are excluded from this edition because their techniques, platforms, operational consequences, and evidence expectations require separate controlled profiles. The official ATT&CK dataset remains authoritative for the complete current technique, sub-technique, procedure, mitigation, detection-strategy, group, software, and campaign inventory.

4. Source Baseline

5. Mapping Methodology

• Map substantive defensive outcomes, not labels.

• Use technique-level records; sub-technique and procedure analysis remains contextual.

• Separate relationship strength from confidence.

• Treat multiple GAISSF controls supporting one ATT&CK behavior as composite coverage.

• Record residual gaps for telemetry, procedure analysis, threat relevance, emulation, and operating effectiveness.

• Perform reverse tactic coverage to identify silent omissions.

6. Controlled Vocabulary

7. Enterprise Tactic Coverage

8. Function-by-Function Analysis

TA0043 - Reconnaissance

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D2-CTL-04, D3-CTL-05, D7-CTL-H01, D7-CTL-H02, D7-CTL-H04, D8-CTL-01, D8-CTL-02, D8-CTL-03, D8-CTL-04, D8-CTL-05. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0042 - Resource Development

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D4-CTL-01, D4-CTL-02, D4-CTL-03, D4-CTL-04, D4-CTL-05, D4-CTL-07, D6-CTL-06, D8-CTL-05. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0001 - Initial Access

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D1-CTL-01, D1-CTL-02, D1-CTL-03, D1-CTL-04, D1-CTL-05, D1-CTL-06, D1-CTL-07, D1-CTL-08, D1-CTL-09, D2-CTL-01, D2-CTL-03, D2-CTL-05, D3-CTL-01, D3-CTL-02, D3-CTL-03, D3-CTL-06, D3-CTL-07, D4-CTL-01, D4-CTL-02, D4-CTL-03, D4-CTL-04, D4-CTL-05, D4-CTL-06, D4-CTL-07, D6-CTL-03, D6-CTL-05, D6-CTL-06, D7-CTL-H01, D7-CTL-H05, D9-CTL-03, D9-CTL-04, D9-CTL-05. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0002 - Execution

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D2-CTL-04, D2-CTL-05, D2-CTL-06, D3-CTL-04, D7-CTL-H02. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0003 - Persistence

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D1-CTL-01, D1-CTL-02, D1-CTL-03, D1-CTL-04, D1-CTL-05, D1-CTL-07, D1-CTL-08, D1-CTL-09, D6-CTL-01, D6-CTL-04. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0004 - Privilege Escalation

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D7-CTL-H03. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0005 - Defense Evasion

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D2-CTL-01, D2-CTL-06, D3-CTL-02, D3-CTL-03, D3-CTL-04, D3-CTL-05, D3-CTL-07, D6-CTL-02, D9-CTL-06. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0006 - Credential Access

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D7-CTL-H03. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0007 - Discovery

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D4-CTL-06, D6-CTL-02. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0008 - Lateral Movement

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D3-CTL-01, D3-CTL-06. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0009 - Collection

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D2-CTL-03. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0011 - Command and Control

Coverage assessment: Not Addressed (Not Rated confidence). Mapped GAISSF controls: None. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0010 - Exfiltration

Coverage assessment: Partially Addressed (Medium confidence). Mapped GAISSF controls: D9-CTL-01, D9-CTL-02, D9-CTL-03, D9-CTL-04, D9-CTL-05, D9-CTL-06. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

TA0040 - Impact

Coverage assessment: Substantially Addressed (Medium-High confidence). Mapped GAISSF controls: D2-CTL-02, D5-CTL-01, D5-CTL-02, D5-CTL-03, D5-CTL-04, D5-CTL-05, D5-CTL-06, D6-CTL-07, D8-CTL-04, D9-CTL-01, D9-CTL-02, D9-CTL-07. ATT&CK procedure coverage, platform-specific detections, threat-actor relevance, and validated telemetry are outside a framework-level crosswalk.

9. Priority Technique Inventory

10. Detailed Mapping Register

11. Evidence Reuse Guidance

• Threat models, attack-path models, architecture diagrams and trust-boundary records.

• Identity, access, secrets, privileged-access and service-account evidence.

• Secure development, dependency, build, image and supplier assurance records.

• Logging, telemetry, detection, alert triage and incident-response evidence.

• Backup, restoration, resilience, denial-of-service and recovery test records.

• Red-team, purple-team, penetration-test and adversary-emulation evidence.

12. Limitations

• ATT&CK describes adversary behavior and is not a prescriptive control or compliance framework.

• A mapping does not prove prevention, detection, mitigation effectiveness, or test coverage.

• The priority technique inventory is scoped to Enterprise techniques with direct relevance to GAISSF and does not replace the complete official ATT&CK dataset.

• Sub-techniques and procedures require environment-specific analysis.

• Mobile and ICS domains are excluded from this edition and require separate controlled profiles.

• ATT&CK changes require source revalidation.

13. Notably Absent

• No MITRE endorsement, approval, certification, or recognition.

• No claim of complete prevention or detection of an ATT&CK technique.

• No universal ATT&CK coverage score or compliance percentage.

• No substitution for current threat intelligence, procedure analysis, detection engineering, or adversary emulation.

• No Mobile or ICS mapping in this edition.

• No claim that ATT&CK is a control framework or regulatory standard.

14. Maintenance and Revalidation

CRO-026 shall be reviewed after every ATT&CK major or minor release, any material GAISSF control change, new platform scope, significant threat-intelligence change, or evidence that a mapping is ambiguous or no longer operationally useful.

Annex A - Quality Assurance Record