Automated SRTM (Security Requirements Traceability Matrix) generation based on assessment findings

[ethanolivertroy]

Overview

Implement automated generation of the Security Requirements Traceability Matrix (SRTM) from security assessment findings.

Source Details

• Official source: https://www.fedramp.gov/rev5/documents-templates/
• FedRAMP SAR Appendix B — SRTM Templates (High / Moderate / Low)

Scope

• Ingest structured assessment findings (control testing results, evidence, deficiencies)
• Map findings to FedRAMP baseline controls (High / Moderate / Low)
• Output FedRAMP SAR Appendix B-compatible SRTM

Acceptance Criteria

1. Accept assessment findings JSON/YAML as input
2. Generate Excel/CSV/JSON SRTM with control IDs, test results, evidence references, and deficiency linkage
3. Support all three FedRAMP impact baselines

Linked Linear Issue

Linear: GRC-58 — https://linear.app/grc-engineering-club/issue/GRC-58/automated-srtm-security-requirements-traceability-matrix-generation