Fix/missing base control ccis 218

[kevjablonski]

Summary

Fixes missing CCI mappings in SCTM and SCA exports and ensures SCA technical assessment findings are associated with the correct controls.

DISA CCI references are often mapped to statement-level indexes such as SI-3 a or SI-3 c 1, while export rows use the base control identifier SI-3. The export logic now normalizes these references to their base control or enhancement before performing lookups.

Changes

Fixed

• Normalize statement-level CCI reference indexes to their base control or enhancement identifier.
• Map references such as SI-3 a and SI-3 c 1 to SI-3.
• Preserve enhancement mappings such as SI-2 (6) as SI-2(6).
• Include base-control CCIs in both SCTM and SCA exports.
• Prevent duplicate CCI entries when multiple references map to the same control.
• Apply the same normalization when rolling STIG findings into SCA technical assessment details.
• Process all references associated with each CCI instead of only the first reference.
• Ensure technical assessment comments and statuses match the applicable control rows.

Testing

• Generated SCTM and SCA exports and verified base controls now include their expected CCIs.
• Verified control enhancements continue to receive their expected CCIs.
• Generated an SCA export and confirmed applicable STIG findings appear under Technical Assessment Comments.
• Verified controls without applicable STIG findings continue to display the existing fallback message.
• Verified technical assessment fields remain blank for controls with an implementation status of Not Applicable.

Related

Closes #218
Closes #217

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud