Compliance

The Compliance page maps your security findings to industry frameworks and helps collect audit evidence.

Compliance

Supported Frameworks

SOC 2

Security, Availability, Processing Integrity, Confidentiality, Privacy trust principles.

ISO 27001

Information security management system (ISMS) requirements.

PCI-DSS

Payment Card Industry data security controls.

Control Mapping

Findings are automatically mapped to relevant controls:

Finding Type SOC 2 ISO 27001 PCI-DSS
Hardcoded secrets CC6.1 A.9.2.4 8.2.1
SQL injection CC6.1 A.14.2.5 6.5.1
Outdated dependencies CC7.1 A.12.6.1 6.2
Missing encryption CC3.1 A.10.1.1 4.1

Evidence Collection

Automated Evidence

  • Scan execution logs
  • Finding remediation timestamps
  • Policy enforcement records
  • User access audit logs

Manual Evidence

Upload supporting documents:

  • Security policies
  • Procedure documentation
  • Training records
  • Third-party attestations

Compliance Readiness Mode

Guided workflow for SOC 2 / ISO 27001 preparation:

  1. Gap Analysis — Identify missing controls
  2. Policy Packs — Pre-configured policies for common requirements
  3. Evidence Checklist — Track what's collected vs pending
  4. Audit Export — Generate TSV/CSV for auditors

Risk Acceptance Workflow

For findings that cannot be immediately remediated:

  1. Document business justification
  2. Set review date (typically quarterly)
  3. Obtain approval from security team
  4. Track in audit log

Control Testing

Schedule periodic tests for controls:

  • Access reviews (quarterly)
  • Penetration tests (annual)
  • Vulnerability scans (continuous)

Export Options

TSV Format

Tab-separated values for easy import into audit tools.

CSV Format

Comma-separated with full metadata.

PDF Report

Executive summary with charts and control coverage.

Previous: ← Projects
Next: Settings →