What does the security test coverage map produce?
Map approved security requirements to test results. Identify missing mappings, partial scope, failed tests and stale or missing evidence.
The working area above runs the supported reconciler in the browser. It keeps the result inspectable and preserves every unresolved item for responsible review.
What do you need before you start?
- Define approved requirements, one required method per row, and the evidence window with a responsible reviewer.
- Supply three CSV, single-sheet XLSX or dataset JSON files, each up to 2 MB and 5000 rows. XLSX expanded bytes are limited to 10 MB. Formulas are rejected.
- Confirm mapping scope, declared outcomes and evidence sources before relying on the report. The tool does not perform live testing or authenticate these declarations.
What information do you enter?
Prepare only the bounded inputs listed below for this reconciler.
- requirements. Requirement ID, Requirement, Required method, Maximum age days, Independence required, In scope, Approval status, Approved by, Requirement source.
- mappings. Mapping ID, Requirement ID, Activity ID, Scope confirmation.
- activities. Activity ID, Method, Status, Completed on, Evidence reference, Owner, Outcome, Enabled, Independent.
- Organization (required). Name the organization whose approved requirements and evidence you are reviewing.
- Responsible reviewer (required). Name the reviewer who will confirm scope, source authenticity and the approved method.
- Evidence window starts (required). Activity completed before this date remains outside this review.
- Review date (required). Freeze the date for future-date and evidence-age checks.
- Scope and uncertainty (optional). Record exclusions and assumptions. The map does not infer requirements from a framework.
| Field | What to enter | Fictional example |
|---|---|---|
| OrganizationRequired | Name the organization whose approved requirements and evidence you are reviewing. | Northfield Services, fictional |
| Responsible reviewerRequired | Name the reviewer who will confirm scope, source authenticity and the approved method. | |
| Evidence window startsRequired | Activity completed before this date remains outside this review. | 2026-09-22 |
| Review dateRequired | Freeze the date for future-date and evidence-age checks. | 2026-09-22 |
| Scope and uncertaintyOptional | Record exclusions and assumptions. The map does not infer requirements from a framework. |
What you can download
Every result must identify its supplied facts, assumptions and unresolved items.
| Free result | Included downloads |
|---|---|
Enter your information, inspect the on-screen result and keep a browser backup. Editing and direct copies of your entered information stay free. |
These supported outputs are free. No checkout is required. |
Fictional review report (PDF). Editable review report (DOCX). Complete fictional pack (ZIP). Samples require tailoring. These fictional samples use this tool's customer output renderer and require tailoring. They do not establish real provider acceptance.
How does the security test coverage map work?
- 1Freeze requirements and dates
Name the organization and reviewer. Freeze the evidence window and review date. Record exclusions and uncertainty.
- 2Import three sources
Supply approved requirements, explicit mappings and activity results separately. Use the heading templates or inspect the fictional example.
- 3Inspect every mapping
Review missing references, duplicate identifiers, partial scope, method mismatches, completion status, dates, evidence and outcomes.
- 4Keep the reviewed output
Download complete JSON, requirement CSV and exact-byte browser backups free. Purchase one finalized seven-file evidence pack after reviewing the result.
Method and sources
Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.
- NIST SP 800-53A Revision 5 assessment methodologyGeneral basis for specifying assessment methods, scope and evidence. The tool does not import a control baseline. Assessment methodology and tailored assessment procedures.National Institute of Standards and Technology. Reviewed 2026-10-06.
- NIST SP 800-115, Technical Guide to Information Security Testing and AssessmentGeneral reference for planning tests and reviewing findings. The map does not perform the described tests. Technical testing planning and findings review.National Institute of Standards and Technology. Reviewed 2026-10-06.
Common questions
What information does the security test coverage map need?
Enter requirements. Requirement ID, Requirement, Required method, Maximum age days, Independence required, In scope, Approval status, Approved by, Requirement source; mappings. Mapping ID, Requirement ID, Activity ID, Scope confirmation; activities. Activity ID, Method, Status, Completed on, Evidence reference, Owner, Outcome, Enabled, Independent; organization (required). Name the organization whose approved requirements and evidence you are reviewing; responsible reviewer (required). Name the reviewer who will confirm scope, source authenticity and the approved method. Define approved requirements, one required method per row, and the evidence window with a responsible reviewer.
What does the security test coverage map produce?
Formal PDF and DOCX summaries Complete Excel review with all three source datasets Requirement CSV Complete parsed source and result JSON Delivered-file SHA-256 manifest Review instructions Review unresolved findings and limitations before use.
Who makes the final decision?
A responsible person reviews the result. The map reviews supplied test results. It does not execute security tests, assess attack coverage or authenticate a reported pass. A supported mapping is a recorded evidence relationship, not proof of security.
Is this tool free?
Yes. The on-screen result and listed downloads are free. No checkout is required. Keep local backups and review the stated method and limits.
Can I use the security test coverage map for this task?
Link requirements with executed tests and results. The map reviews supplied test results. It does not execute security tests, assess attack coverage or authenticate a reported pass. A supported mapping is a recorded evidence relationship, not proof of security.
What still needs review?
The map reviews supplied test results. It does not execute security tests, assess attack coverage or authenticate a reported pass. A supported mapping is a recorded evidence relationship, not proof of security.
A requirement remains open when any mapping is adverse or unresolved, even if another mapping is supported. Mappings to excluded, invalid or unknown requirements remain source issues.
Only your requirements are evaluated. Full scope and independence are supplied declarations. Multiple required methods need separate requirement rows.