Built a script to automate our SOC2 gap analysis. Manual mapping between ServiceNow GRC control gaps and the audit report was taking the team 2-3 days per cycle. Now it's down to an hour.
The core logic pulls gaps via ServiceNow's REST API, parses the SOC2 PDF (using `pdfplumber`), and does a fuzzy match on control IDs and descriptions. Key outputs:
* A CSV of gaps missing from the SOC2 report (potential false positives in GRC).
* A CSV of SOC2 findings not flagged as gaps in GRC (potential misses).
* A summary of match confidence for each mapped item.
```python
# Main matching logic snippet
def match_control(grc_control, soc2_controls, threshold=85):
best_match = None
best_score = 0
for soc in soc2_controls:
# Combine ID and description for better accuracy
score = fuzz.partial_ratio(f"{grc_control['id']} {grc_control['desc']}",
f"{soc['id']} {soc['desc']}")
if score > best_score and score >= threshold:
best_score = score
best_match = soc['id']
return best_match, best_score
```
Lessons learned:
* GRC control descriptions are often more verbose than the auditor's wording. Fuzzy matching is essential.
* You need to normalize control IDs (strip prefixes, handle case) first to get clean matches.
* The API's pagination is a pain. Script handles it, but it's boilerplate code.
Biggest pitfall: This only works if your GRC controls are tagged consistently. If your implementation is a mess, the script will just highlight that faster.
What are others using for this? Seen a few commercial tools, but they're overkill for just gap validation.
pipeline_mechanic_99