diff --git a/components/security-map/securityMap.generated.ts b/components/security-map/securityMap.generated.ts
index 535038cf..adf3b247 100644
--- a/components/security-map/securityMap.generated.ts
+++ b/components/security-map/securityMap.generated.ts
@@ -782,6 +782,30 @@ export const securityMapGraph = {
       "assessmentEligible": true,
       "framework": "wallet-security"
     },
+    {
+      "id": "control-continuous-remote-identity-review",
+      "type": "control",
+      "title": "Continuous remote identity review",
+      "summary": "Keep checking remote workers after hire: camera-on presence, identity consistency, and access that still matches the role.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "hiring",
+        "identity",
+        "dprk"
+      ],
+      "roles": [
+        "founder-executive"
+      ],
+      "lifecycle": [
+        "normal-operations"
+      ],
+      "controlClass": "detective",
+      "assessmentEligible": true,
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "control-controlled-surrender",
       "type": "control",
@@ -1878,6 +1902,56 @@ export const securityMapGraph = {
       ],
       "href": "/infrastructure/domain-and-dns-security/overview"
     },
+    {
+      "id": "guidance-dprk-general-information",
+      "type": "guidance",
+      "title": "DPRK IT workers: general information",
+      "summary": "False-identity remote IT work that funds a sanctioned regime. Treat it as high-impact insider and sanctions risk, not ordinary freelance noise.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "sanctions"
+      ],
+      "href": "/dprk-it-workers/general-information",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-it-workers",
+      "type": "guidance",
+      "title": "Insider threats (DPRK)",
+      "summary": "Fraudulently hired remote workers who fund a sanctioned regime and can pivot to theft, extortion, or sabotage. Hiring and access control are the primary defenses.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "insider"
+      ],
+      "href": "/dprk-it-workers/overview",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-mitigation",
+      "type": "guidance",
+      "title": "Mitigating DPRK IT workers",
+      "summary": "Hiring verification plus least privilege before a hit. After discovery, revoke access, preserve evidence, and treat sanctions and supply-chain exposure as incidents.",
+      "domains": [
+        "people",
+        "development-supply-chain"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "hiring",
+        "least-privilege"
+      ],
+      "href": "/dprk-it-workers/mitigating-dprk-it-workers",
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "guidance-dprk-playbook",
       "type": "guidance",
@@ -1894,6 +1968,23 @@ export const securityMapGraph = {
       "href": "/incident-management/playbooks/hacked-dprk",
       "framework": "incident-management"
     },
+    {
+      "id": "guidance-dprk-ttps",
+      "type": "guidance",
+      "title": "DPRK IT worker TTPs",
+      "summary": "Spot fraud and inconsistency across identity, code history, and interviews. Do not rely on stereotypes. Tactics change.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "hiring",
+        "ttps"
+      ],
+      "href": "/dprk-it-workers/techniques-tactics-and-procedures",
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "guidance-duress-defensive-principles",
       "type": "guidance",
@@ -2805,6 +2896,30 @@ export const securityMapGraph = {
         "upgrade"
       ]
     },
+    {
+      "id": "surface-contributor-hire-path",
+      "type": "attack-surface",
+      "title": "Contributor-to-hire path",
+      "summary": "Valid pull requests and open-source help used to skip ordinary hiring checks and request repository or infrastructure access.",
+      "domains": [
+        "people",
+        "development-supply-chain"
+      ],
+      "status": "proposed",
+      "tags": [
+        "hiring",
+        "oss",
+        "dprk"
+      ],
+      "roles": [
+        "founder-executive",
+        "engineer-developer"
+      ],
+      "lifecycle": [
+        "normal-operations"
+      ],
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "surface-custodial-admin-access",
       "type": "attack-surface",
@@ -3638,6 +3753,13 @@ export const securityMapGraph = {
       "type": "depends-on",
       "status": "proposed"
     },
+    {
+      "id": "detects:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "detects",
+      "status": "proposed"
+    },
     {
       "id": "detects:control-dns-change-monitoring:threat-frontend-dns-hijacking",
       "source": "control-dns-change-monitoring",
@@ -3708,6 +3830,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:component-hiring-pipeline:guidance-dprk-it-workers",
+      "source": "component-hiring-pipeline",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:component-software-wallet:guidance-wallet-security",
       "source": "component-software-wallet",
@@ -3743,6 +3872,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-continuous-remote-identity-review:guidance-dprk-mitigation",
+      "source": "control-continuous-remote-identity-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-controlled-surrender:guidance-duress-defensive-principles",
       "source": "control-controlled-surrender",
@@ -3855,6 +3991,20 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-hiring-identity-verification:guidance-dprk-mitigation",
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
+    {
+      "id": "documented-by:control-hiring-identity-verification:guidance-dprk-ttps",
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-hiring-identity-verification:guidance-people-controls",
       "source": "control-hiring-identity-verification",
@@ -3890,6 +4040,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-insider-threat-mitigation:guidance-dprk-mitigation",
+      "source": "control-insider-threat-mitigation",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-insider-threat-mitigation:guidance-insider-threat",
       "source": "control-insider-threat-mitigation",
@@ -3911,6 +4068,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-least-privilege-review:guidance-dprk-mitigation",
+      "source": "control-least-privilege-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-least-privilege-review:guidance-iam",
       "source": "control-least-privilege-review",
@@ -4121,6 +4285,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:response-dprk-it-worker:guidance-dprk-mitigation",
+      "source": "response-dprk-it-worker",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:response-dprk-it-worker:guidance-dprk-playbook",
       "source": "response-dprk-it-worker",
@@ -4184,6 +4355,20 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-general-information",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-general-information",
+      "type": "documented-by",
+      "status": "proposed"
+    },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-it-workers",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-playbook",
       "source": "threat-dprk-it-worker-infiltration",
@@ -4191,6 +4376,13 @@ export const securityMapGraph = {
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-ttps",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:threat-duress-coercion:guidance-coercion-duress",
       "source": "threat-duress-coercion",
@@ -4366,6 +4558,13 @@ export const securityMapGraph = {
       "type": "exposes",
       "status": "proposed"
     },
+    {
+      "id": "exposes:component-hiring-pipeline:surface-contributor-hire-path",
+      "source": "component-hiring-pipeline",
+      "target": "surface-contributor-hire-path",
+      "type": "exposes",
+      "status": "proposed"
+    },
     {
       "id": "exposes:component-hiring-pipeline:surface-hiring-contractor-access",
       "source": "component-hiring-pipeline",
@@ -4464,6 +4663,13 @@ export const securityMapGraph = {
       "type": "mitigates",
       "status": "proposed"
     },
+    {
+      "id": "mitigates:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "mitigates",
+      "status": "proposed"
+    },
     {
       "id": "mitigates:control-controlled-surrender:threat-duress-coercion",
       "source": "control-controlled-surrender",
@@ -4821,6 +5027,13 @@ export const securityMapGraph = {
       "type": "protects",
       "status": "proposed"
     },
+    {
+      "id": "protects:control-continuous-remote-identity-review:component-hiring-pipeline",
+      "source": "control-continuous-remote-identity-review",
+      "target": "component-hiring-pipeline",
+      "type": "protects",
+      "status": "proposed"
+    },
     {
       "id": "protects:control-controlled-surrender:asset-key-holder-safety",
       "source": "control-controlled-surrender",
@@ -4877,6 +5090,13 @@ export const securityMapGraph = {
       "type": "protects",
       "status": "proposed"
     },
+    {
+      "id": "protects:control-hiring-identity-verification:surface-contributor-hire-path",
+      "source": "control-hiring-identity-verification",
+      "target": "surface-contributor-hire-path",
+      "type": "protects",
+      "status": "proposed"
+    },
     {
       "id": "protects:control-identity-separation:asset-key-holder-safety",
       "source": "control-identity-separation",
@@ -5136,6 +5356,13 @@ export const securityMapGraph = {
       "type": "targets",
       "status": "proposed"
     },
+    {
+      "id": "targets:threat-dprk-it-worker-infiltration:surface-contributor-hire-path",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "surface-contributor-hire-path",
+      "type": "targets",
+      "status": "proposed"
+    },
     {
       "id": "targets:threat-dprk-it-worker-infiltration:surface-hiring-contractor-access",
       "source": "threat-dprk-it-worker-infiltration",
diff --git a/docs/data/security-map/README.md b/docs/data/security-map/README.md
index 734d2954..37387f07 100644
--- a/docs/data/security-map/README.md
+++ b/docs/data/security-map/README.md
@@ -122,8 +122,9 @@ The first seed is `proposed` on purpose.
 
 1. Run `pnpm run coverage:security-map` and treat the lists as the work queue.
 2. Map one framework per PR (`feat/security-map-<framework>`). Steward review for security semantics.
-   Wallet Security, Physical Security (duress), and Treasury Operations are seeded. Next coverage
-   gaps are empty frameworks on the work queue, not another implied seed.
+   Wallet Security, Physical Security (duress), Treasury Operations, and DPRK IT Workers are seeded.
+   Next gaps are remaining empty frameworks on the work queue.
+
 
 3. Add the missing component, surface, control, or guidance edge. Cross-links appear because two
    frameworks share a node, not because overview pages mention each other.
diff --git a/docs/data/security-map/edges/dprk-it-workers.json b/docs/data/security-map/edges/dprk-it-workers.json
new file mode 100644
index 00000000..cac71758
--- /dev/null
+++ b/docs/data/security-map/edges/dprk-it-workers.json
@@ -0,0 +1,84 @@
+{
+  "edges": [
+    {
+      "source": "component-hiring-pipeline",
+      "target": "surface-contributor-hire-path",
+      "type": "exposes"
+    },
+    {
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "surface-contributor-hire-path",
+      "type": "targets"
+    },
+    {
+      "source": "control-hiring-identity-verification",
+      "target": "surface-contributor-hire-path",
+      "type": "protects"
+    },
+    {
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "mitigates"
+    },
+    {
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "detects"
+    },
+    {
+      "source": "control-continuous-remote-identity-review",
+      "target": "component-hiring-pipeline",
+      "type": "protects"
+    },
+    {
+      "source": "control-least-privilege-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-insider-threat-mitigation",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by"
+    },
+    {
+      "source": "control-continuous-remote-identity-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by"
+    },
+    {
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-general-information",
+      "type": "documented-by"
+    },
+    {
+      "source": "component-hiring-pipeline",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by"
+    },
+    {
+      "source": "response-dprk-it-worker",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by"
+    }
+  ]
+}
diff --git a/docs/data/security-map/nodes/dprk-it-workers.json b/docs/data/security-map/nodes/dprk-it-workers.json
new file mode 100644
index 00000000..4138bff3
--- /dev/null
+++ b/docs/data/security-map/nodes/dprk-it-workers.json
@@ -0,0 +1,75 @@
+{
+  "nodes": [
+    {
+      "id": "surface-contributor-hire-path",
+      "type": "attack-surface",
+      "title": "Contributor-to-hire path",
+      "summary": "Valid pull requests and open-source help used to skip ordinary hiring checks and request repository or infrastructure access.",
+      "domains": ["people", "development-supply-chain"],
+      "status": "proposed",
+      "tags": ["hiring", "oss", "dprk"],
+      "roles": ["founder-executive", "engineer-developer"],
+      "lifecycle": ["normal-operations"],
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "control-continuous-remote-identity-review",
+      "type": "control",
+      "title": "Continuous remote identity review",
+      "summary": "Keep checking remote workers after hire: camera-on presence, identity consistency, and access that still matches the role.",
+      "domains": ["people"],
+      "status": "proposed",
+      "tags": ["hiring", "identity", "dprk"],
+      "controlClass": "detective",
+      "assessmentEligible": true,
+      "roles": ["founder-executive"],
+      "lifecycle": ["normal-operations"],
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-it-workers",
+      "type": "guidance",
+      "title": "Insider threats (DPRK)",
+      "summary": "Fraudulently hired remote workers who fund a sanctioned regime and can pivot to theft, extortion, or sabotage. Hiring and access control are the primary defenses.",
+      "domains": ["people"],
+      "status": "proposed",
+      "tags": ["dprk", "insider"],
+      "href": "/dprk-it-workers/overview",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-general-information",
+      "type": "guidance",
+      "title": "DPRK IT workers: general information",
+      "summary": "False-identity remote IT work that funds a sanctioned regime. Treat it as high-impact insider and sanctions risk, not ordinary freelance noise.",
+
+      "domains": ["people"],
+      "status": "proposed",
+      "tags": ["dprk", "sanctions"],
+      "href": "/dprk-it-workers/general-information",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-ttps",
+      "type": "guidance",
+      "title": "DPRK IT worker TTPs",
+      "summary": "Spot fraud and inconsistency across identity, code history, and interviews. Do not rely on stereotypes. Tactics change.",
+      "domains": ["people"],
+      "status": "proposed",
+      "tags": ["dprk", "hiring", "ttps"],
+      "href": "/dprk-it-workers/techniques-tactics-and-procedures",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-mitigation",
+      "type": "guidance",
+      "title": "Mitigating DPRK IT workers",
+      "summary": "Hiring verification plus least privilege before a hit. After discovery, revoke access, preserve evidence, and treat sanctions and supply-chain exposure as incidents.",
+      "domains": ["people", "development-supply-chain"],
+      "status": "proposed",
+      "tags": ["dprk", "hiring", "least-privilege"],
+      "href": "/dprk-it-workers/mitigating-dprk-it-workers",
+      "framework": "dprk-it-workers"
+    }
+  ]
+}
diff --git a/public/security-map.json b/public/security-map.json
index e37c9867..d34eb68d 100644
--- a/public/security-map.json
+++ b/public/security-map.json
@@ -779,6 +779,30 @@
       "assessmentEligible": true,
       "framework": "wallet-security"
     },
+    {
+      "id": "control-continuous-remote-identity-review",
+      "type": "control",
+      "title": "Continuous remote identity review",
+      "summary": "Keep checking remote workers after hire: camera-on presence, identity consistency, and access that still matches the role.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "hiring",
+        "identity",
+        "dprk"
+      ],
+      "roles": [
+        "founder-executive"
+      ],
+      "lifecycle": [
+        "normal-operations"
+      ],
+      "controlClass": "detective",
+      "assessmentEligible": true,
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "control-controlled-surrender",
       "type": "control",
@@ -1875,6 +1899,56 @@
       ],
       "href": "/infrastructure/domain-and-dns-security/overview"
     },
+    {
+      "id": "guidance-dprk-general-information",
+      "type": "guidance",
+      "title": "DPRK IT workers: general information",
+      "summary": "False-identity remote IT work that funds a sanctioned regime. Treat it as high-impact insider and sanctions risk, not ordinary freelance noise.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "sanctions"
+      ],
+      "href": "/dprk-it-workers/general-information",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-it-workers",
+      "type": "guidance",
+      "title": "Insider threats (DPRK)",
+      "summary": "Fraudulently hired remote workers who fund a sanctioned regime and can pivot to theft, extortion, or sabotage. Hiring and access control are the primary defenses.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "insider"
+      ],
+      "href": "/dprk-it-workers/overview",
+      "framework": "dprk-it-workers"
+    },
+    {
+      "id": "guidance-dprk-mitigation",
+      "type": "guidance",
+      "title": "Mitigating DPRK IT workers",
+      "summary": "Hiring verification plus least privilege before a hit. After discovery, revoke access, preserve evidence, and treat sanctions and supply-chain exposure as incidents.",
+      "domains": [
+        "people",
+        "development-supply-chain"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "hiring",
+        "least-privilege"
+      ],
+      "href": "/dprk-it-workers/mitigating-dprk-it-workers",
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "guidance-dprk-playbook",
       "type": "guidance",
@@ -1891,6 +1965,23 @@
       "href": "/incident-management/playbooks/hacked-dprk",
       "framework": "incident-management"
     },
+    {
+      "id": "guidance-dprk-ttps",
+      "type": "guidance",
+      "title": "DPRK IT worker TTPs",
+      "summary": "Spot fraud and inconsistency across identity, code history, and interviews. Do not rely on stereotypes. Tactics change.",
+      "domains": [
+        "people"
+      ],
+      "status": "proposed",
+      "tags": [
+        "dprk",
+        "hiring",
+        "ttps"
+      ],
+      "href": "/dprk-it-workers/techniques-tactics-and-procedures",
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "guidance-duress-defensive-principles",
       "type": "guidance",
@@ -2802,6 +2893,30 @@
         "upgrade"
       ]
     },
+    {
+      "id": "surface-contributor-hire-path",
+      "type": "attack-surface",
+      "title": "Contributor-to-hire path",
+      "summary": "Valid pull requests and open-source help used to skip ordinary hiring checks and request repository or infrastructure access.",
+      "domains": [
+        "people",
+        "development-supply-chain"
+      ],
+      "status": "proposed",
+      "tags": [
+        "hiring",
+        "oss",
+        "dprk"
+      ],
+      "roles": [
+        "founder-executive",
+        "engineer-developer"
+      ],
+      "lifecycle": [
+        "normal-operations"
+      ],
+      "framework": "dprk-it-workers"
+    },
     {
       "id": "surface-custodial-admin-access",
       "type": "attack-surface",
@@ -3635,6 +3750,13 @@
       "type": "depends-on",
       "status": "proposed"
     },
+    {
+      "id": "detects:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "detects",
+      "status": "proposed"
+    },
     {
       "id": "detects:control-dns-change-monitoring:threat-frontend-dns-hijacking",
       "source": "control-dns-change-monitoring",
@@ -3705,6 +3827,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:component-hiring-pipeline:guidance-dprk-it-workers",
+      "source": "component-hiring-pipeline",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:component-software-wallet:guidance-wallet-security",
       "source": "component-software-wallet",
@@ -3740,6 +3869,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-continuous-remote-identity-review:guidance-dprk-mitigation",
+      "source": "control-continuous-remote-identity-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-controlled-surrender:guidance-duress-defensive-principles",
       "source": "control-controlled-surrender",
@@ -3852,6 +3988,20 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-hiring-identity-verification:guidance-dprk-mitigation",
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
+    {
+      "id": "documented-by:control-hiring-identity-verification:guidance-dprk-ttps",
+      "source": "control-hiring-identity-verification",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-hiring-identity-verification:guidance-people-controls",
       "source": "control-hiring-identity-verification",
@@ -3887,6 +4037,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-insider-threat-mitigation:guidance-dprk-mitigation",
+      "source": "control-insider-threat-mitigation",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-insider-threat-mitigation:guidance-insider-threat",
       "source": "control-insider-threat-mitigation",
@@ -3908,6 +4065,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:control-least-privilege-review:guidance-dprk-mitigation",
+      "source": "control-least-privilege-review",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:control-least-privilege-review:guidance-iam",
       "source": "control-least-privilege-review",
@@ -4118,6 +4282,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:response-dprk-it-worker:guidance-dprk-mitigation",
+      "source": "response-dprk-it-worker",
+      "target": "guidance-dprk-mitigation",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:response-dprk-it-worker:guidance-dprk-playbook",
       "source": "response-dprk-it-worker",
@@ -4181,6 +4352,20 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-general-information",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-general-information",
+      "type": "documented-by",
+      "status": "proposed"
+    },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-it-workers",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-it-workers",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-playbook",
       "source": "threat-dprk-it-worker-infiltration",
@@ -4188,6 +4373,13 @@
       "type": "documented-by",
       "status": "proposed"
     },
+    {
+      "id": "documented-by:threat-dprk-it-worker-infiltration:guidance-dprk-ttps",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "guidance-dprk-ttps",
+      "type": "documented-by",
+      "status": "proposed"
+    },
     {
       "id": "documented-by:threat-duress-coercion:guidance-coercion-duress",
       "source": "threat-duress-coercion",
@@ -4363,6 +4555,13 @@
       "type": "exposes",
       "status": "proposed"
     },
+    {
+      "id": "exposes:component-hiring-pipeline:surface-contributor-hire-path",
+      "source": "component-hiring-pipeline",
+      "target": "surface-contributor-hire-path",
+      "type": "exposes",
+      "status": "proposed"
+    },
     {
       "id": "exposes:component-hiring-pipeline:surface-hiring-contractor-access",
       "source": "component-hiring-pipeline",
@@ -4461,6 +4660,13 @@
       "type": "mitigates",
       "status": "proposed"
     },
+    {
+      "id": "mitigates:control-continuous-remote-identity-review:threat-dprk-it-worker-infiltration",
+      "source": "control-continuous-remote-identity-review",
+      "target": "threat-dprk-it-worker-infiltration",
+      "type": "mitigates",
+      "status": "proposed"
+    },
     {
       "id": "mitigates:control-controlled-surrender:threat-duress-coercion",
       "source": "control-controlled-surrender",
@@ -4818,6 +5024,13 @@
       "type": "protects",
       "status": "proposed"
     },
+    {
+      "id": "protects:control-continuous-remote-identity-review:component-hiring-pipeline",
+      "source": "control-continuous-remote-identity-review",
+      "target": "component-hiring-pipeline",
+      "type": "protects",
+      "status": "proposed"
+    },
     {
       "id": "protects:control-controlled-surrender:asset-key-holder-safety",
       "source": "control-controlled-surrender",
@@ -4874,6 +5087,13 @@
       "type": "protects",
       "status": "proposed"
     },
+    {
+      "id": "protects:control-hiring-identity-verification:surface-contributor-hire-path",
+      "source": "control-hiring-identity-verification",
+      "target": "surface-contributor-hire-path",
+      "type": "protects",
+      "status": "proposed"
+    },
     {
       "id": "protects:control-identity-separation:asset-key-holder-safety",
       "source": "control-identity-separation",
@@ -5133,6 +5353,13 @@
       "type": "targets",
       "status": "proposed"
     },
+    {
+      "id": "targets:threat-dprk-it-worker-infiltration:surface-contributor-hire-path",
+      "source": "threat-dprk-it-worker-infiltration",
+      "target": "surface-contributor-hire-path",
+      "type": "targets",
+      "status": "proposed"
+    },
     {
       "id": "targets:threat-dprk-it-worker-infiltration:surface-hiring-contractor-access",
       "source": "threat-dprk-it-worker-infiltration",
diff --git a/utils/security-map.test.cjs b/utils/security-map.test.cjs
index 1bbc5e6c..7b4d9eb1 100644
--- a/utils/security-map.test.cjs
+++ b/utils/security-map.test.cjs
@@ -161,6 +161,8 @@ describe('production catalogue', () => {
     assert.ok(first.graph.nodes.some((n) => n.id === 'component-hardware-wallet'))
     assert.ok(first.graph.nodes.some((n) => n.id === 'control-controlled-surrender'))
     assert.ok(first.graph.nodes.some((n) => n.id === 'component-custodial-treasury'))
+    assert.ok(first.graph.nodes.some((n) => n.id === 'control-continuous-remote-identity-review'))
+
 
     assert.ok(
       first.graph.edges.some(