Compliance mapping
See which framework requirements your findings bear on, with links to the evidence, and export it for an assessor.
The Compliance page relates each finding to the requirements of seven frameworks it bears on. It is evidence for an assessor, not an attestation: a link says a finding is relevant to a requirement, not that the requirement is met or failed, and a requirement with no linked findings is not shown to be met.
| Framework | Requirements used |
|---|---|
| OWASP Top 10:2021 | A01 to A10, from OWASP's official mapped-CWE list for each category |
| PCI DSS v4.0.1 | 6.2.4, 6.3.1, 6.3.3, 8.6.2, 11.4.4 |
| ISO/IEC 27001:2022 | Annex A 5.15, 5.17, 8.3, 8.5, 8.8, 8.9, 8.15, 8.16, 8.24, 8.28, 8.29 |
| SOC 2 (2017 TSC) | CC4.1, CC6.1, CC6.6, CC6.7, CC7.1, CC7.2, CC8.1 |
| HIPAA Security Rule | 45 CFR 164.308(a)(1)(ii)(A)-(B), 164.312(a)(1), (b), (c)(1), (d), (e)(1) |
| NIS2 Directive (EU) 2022/2555 | Article 21(2) points (e), (f), (h), (i), (j) |
| DORA, Regulation (EU) 2022/2554 | Article 9(2), 9(4)(c), (d), (f); Article 24(5); Article 25(1) |
How findings are mapped
- Every finding bears on the vulnerability-handling and security-testing requirements, such as PCI DSS 11.4.4 and NIS2 Article 21(2)(e).
- A finding's CWE picks its OWASP 2021 category, and through it the topic-specific requirements: access control, authentication, cryptography, configuration, logging, injection and secure coding.
- A finding without a CWE maps only to the generic requirements and to no OWASP category.
- A dependency finding maps to patching requirements and OWASP A06, not to the upstream package's weakness.
- Each link carries a one-line rationale. The mapping is one reviewed table in the API, so you can check every decision.
Open and remediated
A finding counts as remediated only when its latest governed retest verdict is remediated (see /docs/retests). Everything else is open. File mode has no retests, so the page says remediation is not tracked.
One mapping reads the 1,000 most severe findings in scope and says when it stops there. Choose a single scan for complete counts. The page lists up to 20 findings per requirement; the exports list every link.
API
| Endpoint | Use |
|---|---|
| GET /api/compliance/frameworks | The frameworks, their official sources and the disclaimer. |
| GET /api/compliance/frameworks/{framework}?run= | Each requirement with its linked findings and open and remediated counts, for the workspace or one scan. |
| GET /api/compliance/frameworks/{framework}/export/{json|csv}?run= | Every requirement-finding link. CSV cells are guarded against spreadsheet formulas. |
| GET /api/compliance/findings/{run}/{finding_id} | The requirements one finding bears on, grouped by framework. |
Every endpoint is scoped to the active workspace and needs the read permission every role holds.