Framework accuracy: CSF 2.0 six functions, ISO 27001:2022, EU AI Act Art. 60→71

[jeftekhari]

Thorough correctness pass after a systematic audit. Every claim that a seasoned GRC professional would recognize as stale or wrong is now fixed. The repo is ready for a GRC-audience LinkedIn post after this merges.

Tier 1 — the headline fixes

NIST CSF 2.0 structural correctness

Framework declared "CSF 2.0" but used CSF 1.1's five-function structure. CSF 2.0 (NIST.CSWP.29, Feb 2024) adds GOVERN as the sixth function — the headline change of the 2.0 release. Now:

• Six functions: Govern, Identify, Protect, Detect, Respond, Recover
• 18 subcategories renumbered to CSF 2.0 format (GV.PO-01, ID.AM-01, PR.AA-01, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-01, DE.CM-09, RS.MA-01, RS.CO-02, RC.RP-01, + new GV.SC-01 supply chain + ID.RA-08 vulnerability disclosure)
• getNistFunctionScores + phase-grid loops iterate all 6 functions
• Category restructures tracked: PR.AC → PR.AA; PR.IP dissolved (config → PR.PS, vuln-mgmt → ID.IM); DE.CM-4/DE.CM-8 → DE.CM-09

ISO 27001:2022 Annex A

All cross-references used :2013 four-component codes. The :2013 → :2022 transition ended October 2025 — any certifier is on :2022. Remapped every code to :2022 two-component form (A.8.1.1 → A.5.9; A.9.4.3 → A.5.17; A.12.6.1 → A.8.8; A.13.1.1 → A.8.20; A.16.1.1 → A.5.24; etc.).

EU AI Act Article 60 misattribution (factual error)

Our ART-60 was "EU database registration". Article 60 in Regulation (EU) 2024/1689 is actually about "testing of high-risk AI systems in real-world conditions outside AI regulatory sandboxes." The EU database is established by Article 71; the registration duties themselves live in Article 49 (providers) and Article 26(8) (public-sector deployers). Renamed ART-60 → ART-71 and corrected every downstream reference.

"Compliance" → "Coverage/Assessment"

Report titles, log lines, and summary labels said "Compliance" despite our own CONTRIBUTING.md warning against it. Titled reports as "Coverage Report" (CSF) / "Assessment Report" (EU AI Act) and added an explicit scope caveat: "This score reflects 18 of NIST CSF 2.0's ~106 subcategories — it is not a claim of full framework compliance."

Tier 2 — correctness on the details

1. Article 5 prohibited practices — listed 4 of 8 prohibitions; now enumerates all eight 5(1)(a)–(h).
2. Article 27 FRIA scope — previously fired on every EU-market high-risk system; now correctly scoped to Article 27(1)(a) public authorities, (b) private providers of public services, or (c) Annex III 5(b)/(c) credit/insurance deployers. Status reports "partial" (verify deployer type) instead of "fail" for everyone.
3. Article 12 record-keeping — dropped unsourced "six-month minimum retention" claim; replaced with Article 12(3) ("appropriate to intended purpose") + Article 19 10-year provider documentation retention.
4. Article 73 tiered deadlines — evidence now quotes the full Article 73(4) tiered schedule (15 days default, 10 days death, 2 days widespread infringement / critical infrastructure).
5. NIST SP 800-61 — IRP claimed a 6-phase lifecycle that isn't in the document. Fixed to the actual Rev. 2 four-phase model (Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity) and cited the revision.
6. EU AI Act timeline + fines — checklist oversimplified "August 2026 + €35M/7%". Added the staggered Article 113 schedule and the tiered Article 99 fine bands.
7. CCPA/CPRA — citation updated to note the CPRA amendments.
8. Framework version disclosure — every report header names the version explicitly: CSF 2.0 (NIST.CSWP.29, Feb 2024); SOC 2 TSC 2017 (rev. 2022); ISO/IEC 27001:2022; ISO/IEC 42001:2023; NIST AI RMF (AI 100-1, v1.0, Jan 2023); EU AI Act (OJ L, 12 July 2024).

Documentation updated

• README.md — framework table reflects all six CSF 2.0 functions + current SOC 2 / ISO 27001 versions
• docs/grc-fundamentals.md — NIST CSF / SOC 2 / ISO 27001 sections rewritten with accurate structure and version info
• docs/implementation-checklist.md — Phase 3 Item 11 framework-mapping section + Phase 8C article list + Phase 8 intro (timeline + fines) all corrected

Test plan

• npm run lint clean (42 files)
• npm test — 71/71 passing (risk classifier + exports tests updated to new IDs; FRIA test updated for new scope-aware check)
• npm run smoke:dashboard green
• npm run scan -- . produces .grc/nist-csf-report.md with all six functions scored and the correct scope disclaimer
• Scan output shows ART-71 (not ART-60) in article table and in the methodology footer
• After merge: live dashboard deploys cleanly; per-repo NIST CSF view renders 6-column phase grid

What remains (Tier 3 — pedantic specialist items, deferred)

• Cross-map to NIST AI RMF and ISO/IEC 42001:2023 specific subcategories are plausible but each individual mapping isn't formally verified. Separate PR if anyone pushes back on specific pairs.
• Article 50 could further split its 50(1)/50(2)/50(3)/50(4) obligations into distinct checks — currently one combined check. Low priority; no one would call it a factual error.