diff --git a/components/sctm/SecurityAssessment.vue b/components/sctm/SecurityAssessment.vue
index a83e508..17810cb 100644
--- a/components/sctm/SecurityAssessment.vue
+++ b/components/sctm/SecurityAssessment.vue
@@ -54,7 +54,7 @@
             </span>
           </ListboxButton>
 
-          <transition
+          <Transition
             leave-active-class="transition ease-in duration-100"
             leave-from-class="opacity-100"
             leave-to-class="opacity-0"
@@ -93,7 +93,7 @@
                 </li>
               </ListboxOption>
             </ListboxOptions>
-          </transition>
+          </Transition>
         </div>
       </Listbox>
     </div>
@@ -180,7 +180,7 @@
             </span>
           </ListboxButton>
 
-          <transition
+          <Transition
             leave-active-class="transition ease-in duration-100"
             leave-from-class="opacity-100"
             leave-to-class="opacity-0"
@@ -219,7 +219,7 @@
                 </li>
               </ListboxOption>
             </ListboxOptions>
-          </transition>
+          </Transition>
         </div>
       </Listbox>
     </div>
@@ -255,7 +255,7 @@
 
 <script setup lang="ts">
 import { CheckIcon, ChevronDownIcon } from "@heroicons/vue/20/solid";
-import { Listbox, ListboxButton, ListboxLabel, ListboxOption, ListboxOptions, Transition } from "@headlessui/vue";
+import { Listbox, ListboxButton, ListboxLabel, ListboxOption, ListboxOptions } from "@headlessui/vue";
 
 interface DropdownItem {
   id: number;
diff --git a/server/utils/cciMapping.ts b/server/utils/cciMapping.ts
new file mode 100644
index 0000000..dcabb80
--- /dev/null
+++ b/server/utils/cciMapping.ts
@@ -0,0 +1,58 @@
+import { CciItem, CciReference } from "~/db/models";
+
+export function normalizeCciControlIndex(index: string): string | null {
+  const controlMatch = index
+    .trim()
+    .toUpperCase()
+    .match(/^([A-Z]{2}-\s*\d+(?:\s*\(\d+\))?)/);
+
+  return controlMatch
+    ? controlMatch[1].replace(/\s+/g, "")
+    : null;
+}
+
+export async function getCciMappingData(
+  policyDocumentId: number | undefined,
+) {
+  const cciItems = await CciItem.findAll({
+    attributes: ["cciId", "definition"],
+    include: [
+      {
+        model: CciReference,
+        attributes: ["index"],
+        through: { attributes: [] },
+        where: {
+          PolicyDocumentId: policyDocumentId,
+        },
+      },
+    ],
+  });
+
+  const cciMap = new Map<string, string[]>();
+
+  for (const cciItem of cciItems) {
+    const refs = cciItem.CciReferences ?? [];
+
+    for (const ref of refs) {
+      if (!ref.index) continue;
+
+      const normalizedIndex =
+        normalizeCciControlIndex(ref.index);
+
+      if (!normalizedIndex) continue;
+
+      const cciIds = cciMap.get(normalizedIndex) ?? [];
+
+      if (!cciIds.includes(cciItem.cciId)) {
+        cciIds.push(cciItem.cciId);
+      }
+
+      cciMap.set(normalizedIndex, cciIds);
+    }
+  }
+
+  return {
+    cciItems,
+    cciMap,
+  };
+}
\ No newline at end of file
diff --git a/server/utils/excelExport/scaExport.ts b/server/utils/excelExport/scaExport.ts
index bd95c88..3a2decf 100644
--- a/server/utils/excelExport/scaExport.ts
+++ b/server/utils/excelExport/scaExport.ts
@@ -16,10 +16,12 @@ import {
   FrequencyType,
   ImplementationStatus,
   TestMethod,
-  CciItem,
-  CciReference,
   ComplianceStatus,
 } from "~/db/models";
+import {
+  getCciMappingData,
+  normalizeCciControlIndex,
+} from "~/server/utils/cciMapping";
 
 export async function generateSecurityControlAssessment(
   boundaryId: number,
@@ -374,33 +376,13 @@ export async function generateSecurityControlAssessment(
     ],
   });
 
-  const cciItems = await CciItem.findAll({
-    attributes: ["cciId", "definition"],
-    include: [
-      {
-        model: CciReference,
-        attributes: ["index"],
-        through: { attributes: [] },
-        where: {
-          PolicyDocumentId: boundary?.PolicyDocumentId,
-        },
-      },
-    ],
-  });
-  const cciItemMap = new Map(cciItems.map((item) => [item.cciId, item]));
-  const cciMap = new Map<string, string[]>();
-
-  for (const cciItem of cciItems) {
-    const refs = cciItem.CciReferences ?? [];
-    for (const ref of refs) {
-      if (!ref.index) continue;
-      const normalizedIndex = ref.index.replace(/\s+/g, "");
-      if (!cciMap.has(normalizedIndex)) {
-        cciMap.set(normalizedIndex, []);
-      }
-      cciMap.get(normalizedIndex)!.push(cciItem.cciId);
-    }
-  }
+  const { cciItems, cciMap } = await getCciMappingData(
+    boundary?.PolicyDocumentId,
+  );
+
+  const cciItemMap = new Map(
+    cciItems.map((item) => [item.cciId, item]),
+  );
 
   const stigResults = await getEvaluationSummary(boundaryId, undefined, false);
 
@@ -418,19 +400,26 @@ export async function generateSecurityControlAssessment(
 
       for (const cciId of cciIds) {
         const cciItem = cciItemMap.get(cciId);
-        const cciRef = cciItem?.CciReferences?.[0]?.index ?? "";
-        const normalizedControl = cciRef.replace(/\s+/g, "");
-        if (!normalizedControl) continue;
+        const refs = cciItem?.CciReferences ?? [];
 
-        if (!controlToStatusMap.has(normalizedControl)) {
-          controlToStatusMap.set(normalizedControl, new Map());
-        }
+        for (const ref of refs) {
+          if (!ref.index) continue;
+
+          const normalizedControl = normalizeCciControlIndex(ref.index);
+          if (!normalizedControl) continue;
+
+          if (!controlToStatusMap.has(normalizedControl)) {
+            controlToStatusMap.set(normalizedControl, new Map());
+          }
+
+          const statusMap = controlToStatusMap.get(normalizedControl)!;
+
+          if (!statusMap.has(status)) {
+            statusMap.set(status, new Set());
+          }
 
-        const statusMap = controlToStatusMap.get(normalizedControl)!;
-        if (!statusMap.has(status)) {
-          statusMap.set(status, new Set());
+          statusMap.get(status)!.add(displayValue);
         }
-        statusMap.get(status)!.add(displayValue);
       }
     }
   }
@@ -564,7 +553,7 @@ export async function generateSecurityControlAssessment(
     }
 
     newRow[Columns.controlNumber] = controlNumber;
-    const normalizedControlNumber = controlNumber.replace(/\s+/g, "");
+    const normalizedControlNumber = normalizeCciControlIndex(controlNumber) ?? "";
     const statusMap = controlToStatusMap.get(normalizedControlNumber);
     const cciIds = cciMap.get(normalizedControlNumber) || [];
     newRow[Columns.cci] = cciIds.length ? cciIds.join("\n") + "\n" : "";
diff --git a/server/utils/excelExport/sctmExport.ts b/server/utils/excelExport/sctmExport.ts
index ed03c05..99c0a9d 100644
--- a/server/utils/excelExport/sctmExport.ts
+++ b/server/utils/excelExport/sctmExport.ts
@@ -16,9 +16,11 @@ import {
   FrequencyType,
   ImplementationStatus,
   TestMethod,
-  CciItem,
-  CciReference
 } from "~/db/models";
+import {
+  getCciMappingData,
+  normalizeCciControlIndex,
+} from "~/server/utils/cciMapping";
 
 export async function generateSctm(
   boundaryId: number,
@@ -376,36 +378,9 @@ export async function generateSctm(
     ],
   }))
 
-  const cciItems = await CciItem.findAll({
-      attributes: ["cciId", "definition"],
-      include: [
-        {
-          model: CciReference,
-          attributes: ["index"],
-          through: { attributes: [] },
-          where: {
-            PolicyDocumentId: boundary?.PolicyDocumentId,
-          },
-        },
-      ],
-    });
-
-    const cciMap = new Map<string, string[]>();
-
-
-    for (const cciItem of cciItems) {
-      const refs = cciItem.CciReferences ?? []; // safe fallback
-      for (const ref of refs) {
-        if (!ref.index) continue;
-
-        // Normalize by removing spaces for universal matching
-        const normalizedIndex = ref.index.replace(/\s+/g, "");
-        if (!cciMap.has(normalizedIndex)) {
-          cciMap.set(normalizedIndex, []);
-        }
-        cciMap.get(normalizedIndex)!.push(cciItem.cciId);
-      }
-    }
+  const { cciMap } = await getCciMappingData(
+    boundary?.PolicyDocumentId,
+  );
 
   const revName = `rev${boundary?.PolicyDocument?.version}`;
   const revision = await ControlRevision.findOne({ where: { name: revName } });
@@ -521,7 +496,7 @@ export async function generateSctm(
         control.ControlStatements?.map((s: any) => s.description).join("\n") || "";
     }
     newRow[Columns.controlNumber] = controlNumber;
-    const normalizedControlNumber = controlNumber.replace(/\s+/g, "");
+    const normalizedControlNumber = normalizeCciControlIndex(controlNumber) ?? "";
     const cciIds = cciMap.get(normalizedControlNumber) || [];
     newRow[Columns.cci] = cciIds.length ? cciIds.join("\n") + "\n" : "";
     // Map all other fields from ControlRecordItem