Field note one hundred and twenty-eight. Today’s log entry
is a contributor-adoption milestone, not a content milestone.
Eight consecutive ISO/IEC 27001:2022 Annex A crosswalk pull
requests landed against secops-ng-framework in a single day
— all of them opened, iterated on, and merged from a single
community contributor outside the founding maintainer set. A
ninth PR is in flight pending a rebase.
The crosswalk content itself was covered in field notes #126 and #127. This entry is about the pattern the pull requests draw.
What the wave looked like
Between the morning and the evening of 2026-07-05, one contributor from the community shipped:
- PR #656 — Annex A.5.1, and the ISO 27001 crosswalk conventions the subsequent files follow.
- PR #657 — Annex A.6 people-controls (A.6.1 Screening, A.6.3 Awareness).
- PR #658 — Annex A.7 physical-controls first entries (A.7.1 Perimeters, A.7.2 Entry).
- PR #659 — Annex A.8 technological-controls first entries (A.8.1 User endpoint devices, A.8.2 Privileged access).
- PR #660 — Annex A.5 organisational fill-in (A.5.2–A.5.6).
- PR #661 — Annex A.8.3–A.8.7 technological-controls.
- PR #662 — Annex A.8.8–A.8.12 technological-controls.
- PR #663 — Annex A.8.13–A.8.17 technological-controls.
Every one of the eight went through the standard review path: DCO sign-off, the forward-public hygiene linter, the parity tests, and a maintainer review against the ISO 27001:2022 standard text. Nothing was fast-tracked. The wave is a demonstration that the review path scales — that the same gate an in-tree maintainer clears is the gate a first-time external contributor clears, and that the gate can be cleared eight times in a row without slowing anyone down.
A ninth pull request — Annex A.8.18–A.8.22 — is open and mid-rebase against the previous merges. It follows the same convention the A.5.1 pull request established and is expected to land in the next wave.
Why this is the G-06 signal we watch for
G-06 is the contributor-adoption goal. The public-repo strategy is only meaningful if the commons is actually extensible by hands other than the founding maintainers — otherwise “public” is decoration on a single-vendor codebase. Eight consecutive merges from one external contributor in one day is the strongest public signal to date that the extension path works as designed.
Concretely, the wave shows three things:
-
The mapping shape is legible to somebody who did not design it. The crosswalk conventions established in the A.5.1 file — id scheme, control-text quoting, playbook references, neighbouring-regime hooks — were sufficient for the same contributor to produce seven more files in the same shape without back-and-forth on structure. That is what a good schema looks like from the outside.
-
The review loop is fast enough to sustain a working cadence. Eight PRs, iterated to merge, in one day means the reviewer feedback arrived quickly enough that the contributor did not context-switch away and abandon the thread. Every hour of reviewer latency past a working day costs the commons an unbounded number of would-be second contributions.
-
A single non-maintainer can meaningfully move a regime crosswalk from opening entry to opening surface. Before this wave the ISO 27001 crosswalk was one file with one entry. After the wave the A.5, A.6, A.7, and A.8 themes are all seeded with anchor entries and the technological theme has its first seventeen controls populated. The commons is not the same shape at the end of the day.
Why this is the wave to notice
Community-driven infrastructure lives or dies on this pattern. A single external maintainer merging eight PRs in a day is not a customer using a product; it is a peer building alongside the founding maintainers, on the same tree, under the same governance, against the same review bar. The distinction matters for how the commons is read from outside: this is not a codebase with users, it is a codebase with co-authors.
The mapping layer now speaks multiple compliance languages — NIS2, DORA, CRA, GDPR, D3FEND, and ISO 27001 — and the ISO 27001 vocabulary was added by the community. That is the sentence the project has been working toward being able to write.
For anyone who wants to extend the crosswalk further
Annex A has 93 controls across four themes. Today’s wave covers the anchor entries and the first stretch of the A.8 technological theme. The remaining A.5, A.6, A.7, and A.8 entries follow the same shape the A.5 file established:
- One file per Annex A theme, under
content/mappings/iso27001/. - Id scheme
iso27001:a-<theme>-<number>-<slug>. - Annex A control text quoted from the standard as fair-use excerpt, alongside the SecOps-NG playbook and control references that satisfy it, and — where relevant — the neighbouring articles it lines up with across NIS2, DORA, CRA, and GDPR.
The mapping-authoring guide at
docs/contributing/playbook-authoring.md
and the ISO 27001 theme index at
content/mappings/iso27001/README.md
are the two starting points. The good-first-issue list
carries a running set of Annex A controls waiting for their
crosswalk entry — picking one and opening a PR is the fastest
route into the review loop.
There is no gated version of any of this. There is no private fork. The crosswalks are versioned in git, discussed on public PRs, and audited against the standard by the same maintainers who audit the regulation crosswalks. If your read of an Annex A control text disagrees with a merged mapping, the public issue tracker is the way to correct it.
Where to look
- Framework repo:
content/mappings/iso27001/annex-a-5-organisational.yaml— the A.5 organisational-controls file.content/mappings/iso27001/annex-a-6-people.yaml— the A.6 people-controls file.content/mappings/iso27001/annex-a-7-physical.yaml— the A.7 physical-controls file.content/mappings/iso27001/annex-a-8-technological.yaml— the A.8 technological-controls file (A.8.1 through A.8.17 after this wave; A.8.18–A.8.22 land in the next wave).content/mappings/iso27001/README.md— the theme index and the id scheme.docs/contributing/playbook-authoring.md— the mapping and playbook authoring guide.
Eight consecutive merges from a community contributor in a single day is a good day for a Digital Commons. The next good day is the one that starts with a contributor who is not the same one — and the review loop that made this wave possible is the same loop waiting for them.