Struct SecurityTestInCiControl 

pub struct SecurityTestInCiControl;

Validates that security testing (SAST/DAST) is integrated into CI.

Maps to UN-R155 Clause 7.2.2.2 (Security testing throughout lifecycle), NIST 800-53 SA-11 (Developer Testing and Evaluation).

Uses code_scanning_enabled as evidence — this is true when CodeQL or other SAST tools have produced at least one analysis result, indicating active security testing in the CI pipeline.

Trait Implementations

impl Control for SecurityTestInCiControl

fn id(&self) -> ControlId

Returns the unique identifier for this control.

fn description(&self) -> &'static str

Human-readable description for SARIF rule output.

fn evaluate(&self, evidence: &EvidenceBundle) -> Vec<ControlFinding>

Evaluates the evidence bundle and returns one finding per subject.

fn tsc_criteria(&self) -> &'static [&'static str]

SOC2 Trust Services Criteria this control maps to (e.g., &[“CC6.1”, “CC8.1”]). Returns empty slice for controls not mapped to SOC2.

fn remediation_hint(&self) -> Option<&'static str>

Actionable remediation hint shown when the control fails or needs review.