Compliance mapping

Frameworks

Findings are mapped to control areas: control coverage for PCI DSS, NIST 800-53, ISO 27001 and HIPAA; readiness evidence for SOC 2; a risk-posture indicator for LGPD and GDPR. A technical finding arrives referenced to the relevant control areas, as due-diligence evidence (not a formal compliance assessment). The PDF report includes SOC 2, ISO 27001, PCI DSS, LGPD and GDPR.

Taxonomies

Findings carry a CWE identifier and OWASP category where one applies.

Example finding

{
  "title":  "SQL Injection · /api/v1/login",
  "cvss":   9.8,
  "cwe":    "CWE-89",
  "owasp":  "A03:2021-Injection"
}