GOST R 56939-2024 assessment workflow

Engineering leads and security specialists need to see which secure-development materials are available and what to prepare for the next review. CodeGraph maps project artifacts to the 25 process identifiers in section 5 of GOST R 56939-2024. The report shows each process status and its evidence; stored history lets the team compare two assessments.

Start with the artifact checklist, generate the report and traceability matrix, then save the results. This gives the team a shared work list: add materials, review links to code and tests, and compare changes with the previous assessment.

$GoCPG = "<GOCPG_BINARY>"
$CpgDirectory = "<CPG_DIRECTORY>"
& $GoCPG serve --host 127.0.0.1 --port 50051 --data-dir $CpgDirectory

$CodeGraphRoot = "<CODEGRAPH_ROOT>"
$env:PYTHONPATH = $CodeGraphRoot + [System.IO.Path]::PathSeparator + $env:PYTHONPATH
$ProjectRoot = "<PROJECT_ROOT>"
Set-Location -LiteralPath $ProjectRoot
$ProjectName = "my-project"
$CpgDb = "D:\codegraph-data\my-project.duckdb"
New-Item -ItemType Directory -Path "data", "reports" -Force | Out-Null

python -m src.cli compliance checklist --project $ProjectName --db $CpgDb --format json

python -m src.cli compliance gost-56939 --project $ProjectName --db $CpgDb --format markdown --language en --include-traceability

python -m src.cli compliance gost-56939 --project $ProjectName --db $CpgDb --format gost --language en --include-traceability --output "gost-56939-report.md"

python -m src.cli compliance gost-56939 --project $ProjectName --db $CpgDb --format json --save-history --output "gost-56939-before.json"

# Repeat after changing the project artifacts.
python -m src.cli compliance gost-56939 --project $ProjectName --db $CpgDb --format json --save-history --output "gost-56939-after.json"

python -m src.cli compliance history --project $ProjectName --limit 10

python -m src.cli compliance delta --old "<older-report-id>" --new "<newer-report-id>"

python -m src.cli compliance traceability --project $ProjectName --db $CpgDb --format markdown --output "gost-56939-traceability.md"

{
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Traceability example",
          "rules": [
            {
              "id": "DOCS-CWE-89",
              "properties": {
                "tags": [
                  "CWE-89"
                ]
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "DOCS-CWE-89",
          "message": {
            "text": "Example input for the traceability matrix"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "source/sample.c"
                },
                "region": {
                  "startLine": 3
                }
              }
            }
          ],
          "fingerprints": {
            "primaryLocationLineHash": "docs-example-89"
          }
        }
      ]
    }
  ]
}

python -m src.cli compliance traceability --project $ProjectName --db $CpgDb --format json --output "gost-56939-traceability.json"

Process registry

The registry below describes evaluation type and coverage. Actual status is derived from available artifacts and evaluator behavior at runtime.

The automated type uses programmatic artifact collection, external uses outputs from other tools, organizational uses organizational evidence, and mixed combines sources.

Status and score

Each process is classified as FULL, PARTIAL, GAP, or N/A.

• FULL contributes 1.0.
• PARTIAL contributes 0.5.
• GAP contributes 0.
• N/A is excluded from the denominator.

The report percentage is the sum of applicable points divided by the count of applicable processes. The percentage reflects evidence recognized by the configured evaluators. Review it alongside the status and artifacts of each process.

manual_overrides can request a status for a process. A FULL override is guarded by the completion threshold and requires the associated completion evidence. Keep the override rationale, approver, and source artifact outside the generated report when governance requires it.

In JSON, the status values are full, partial, gap, and n_a. For example, one FULL, one PARTIAL, and one N/A process produce (1 + 0.5) / 2 × 100 = 75%. If every process is N/A, the model returns 0.0 and the applicable-process list is empty. FULL is assigned when the configured evidence threshold is reached: 0.8 by default. Open the process artifacts to review the basis for its status. Exit code 0 confirms report generation; GAP statuses and collection errors appear in the report itself.

Configuration

gocpg:
  grpc_host: 127.0.0.1
  grpc_port: 50051
security:
  local_cli_enabled: true
compliance:
  gost_56939:
    enabled: true
    auto_evaluate_on_audit: true
    store_history: true
    history_db_path: "data/compliance_history.sqlite"
    organizational_processes_status: "n_a"
    sarif_search_paths:
      - "data/"
      - "reports/"
    manual_overrides: {}
    content_check_min_bytes: 500
    content_check_read_limit: 8192

• enabled controls the feature.
• auto_evaluate_on_audit allows audit integration to request an assessment.
• store_history and history_db_path configure stored assessment history.
• organizational_processes_status is the default organizational status setting.
• sarif_search_paths limits where SARIF evidence is searched.
• manual_overrides supplies explicit per-process requests.
• content_check_min_bytes and content_check_read_limit bound content-presence checks.

These are shared runtime settings. The explicit CLI report path reads history_db_path, sarif_search_paths, manual_overrides, and content-check limits. It does not consult enabled, auto_evaluate_on_audit, store_history, or organizational_processes_status to gate this command. In particular, store_history: true does not replace --save-history. Control history for this invocation with --save-history and local CLI access with security.local_cli_enabled.

Use installation-owned absolute or approved relative paths. Review generated reports before sharing them outside the organization because evidence locations, findings, and project metadata may be sensitive.

Traceability and evidence

The traceability output connects recognized requirements and CWE-related evidence to code, tests, findings, and fixes when those relations are available. An empty relation records that the collected evidence contains no link; evaluate the control through its configured sources.

For an auditable run, record:

• source revision and project identity;
• DuckDB identity and freshness;
• configuration revision;
• exact CLI command and exit code;
• collection flags and input directories;
• generated report and traceability hashes;
• manual evidence and reviewer decision;
• known missing or unavailable sources.

Failure and recovery

• Unknown or database-derived project: rerun with --project and --db.
• Missing artifacts: inspect checklist, correct input paths, then recollect.
• Unexpected FULL or PARTIAL: inspect process artifacts and manual_overrides.
• History missing: confirm --save-history and history_db_path.
• Two reports cannot be compared: check both identifiers in the same history store. For an unknown identifier, the command prints Error: One or both report IDs not found and returns 1.
• Runtime command succeeds but evidence is incomplete: keep the assessment open and complete the compliance review before recording the verdict.

Prepare evidence for the next assessment

Use process statuses to plan the next review. For GAP, collect the materials listed in the checklist. For PARTIAL, add evidence and review links to code and tests. For FULL, open the artifacts and retain the basis for the assessment. After updating the materials, generate another report and compare it with the previous run.

• Architecture control — define components and check dependencies for process 5.6.
• Threat modeling — prepare a model and data-flow diagram for process 5.7.
• Composition analysis and SBOM — collect dependency information for process 5.16.
• Supply-chain security — review build inputs and dependency origins for process 5.17.