The problem
Every framework a state government program has to comply with (CJIS v6.0, IRS 1075, PCI SAQ A / SAQ A-EP, ARC-AMPE, HIPAA) publishes its requirements as a policy document — usually a PDF — not as structured data. Before this tooling existed, mapping those requirements against NIST 800-53 controls meant manually reading policy documents and cross-referencing them by hand.
What it does
Python scripts extract requirement text from policy PDFs and transform it into structured, ingestible records that map cleanly onto NIST 800-53 Rev. 5 controls. Those crosswalks then drive the GRC platform’s control library, so a single control update propagates correctly across every framework it’s mapped to, instead of requiring separate manual edits per framework.
Why it matters
This is the layer underneath the risk categorization work (Low/Moderate/High) and the SSP/POA&M documentation — if the control mappings are wrong or stale, everything built on top of them is wrong too. Automating the extraction and mapping step means updates to source policy documents can be reflected in the GRC platform in hours instead of weeks, and the mappings are consistent across frameworks instead of hand-maintained in parallel.
Note: this is an internal State of Michigan tool, so the code isn’t public — happy to talk through the approach in more detail.