# Customer-owned CI policy overlay; not an analyzer ruleset definition.
# Organization-specific MetaSolve analyzer rules require enterprise scoping.
version: 1
mode: report_only
thresholds:
  critical: block
  high: require_review
  medium: track
  low: inform
exceptions:
  require_owner: true
  require_expiry: true
  maximum_days: 30
mappings:
  CWE-89: [SOC2-CC7, ISO27001-A8, PCI-DSS-6.2]
  CWE-78: [SOC2-CC7, ISO27001-A8, PCI-DSS-6.2]
  CWE-22: [SOC2-CC7, ISO27001-A8]
  CWE-94: [SOC2-CC7, ISO27001-A8, PCI-DSS-6.2]
  CWE-798: [SOC2-CC6, ISO27001-A5, PCI-DSS-8]
  CWE-404: [SOC2-CC7, ISO27001-A8]
disclaimer: Mappings identify potentially relevant evidence and do not certify compliance.
