vulkro compliance-pack

Scan the project and write a folder of audit evidence that maps findings to the control IDs of one framework.

vulkro compliance-pack .                                   # SOC 2
vulkro compliance-pack . --framework pci-dss-4-0 -o ./audit-q1

Flags

Flag	Description
[PATH]	Project root. Default ..
--framework <NAME>	Framework to map to. Default soc2. Values below.
-o, --output <DIR>	Output directory. Default ./vulkro-compliance-pack.

Frameworks

Value	Framework
soc2, soc2-full	SOC 2 (CC and P controls by category, or the full Trust Service Criteria CC1.1 to CC9.2)
iso27001, iso27001-2022	ISO/IEC 27001:2022 Annex A (category buckets, or per-control)
hipaa	HIPAA Security Rule
pci-dss-4-0	PCI DSS 4.0 requirements 6, 11, 12
nist-800-53	NIST SP 800-53 Rev. 5 moderate baseline
nist-800-171	NIST SP 800-171 Rev. 2
fedramp-moderate, stateramp	FedRAMP Moderate, StateRAMP Moderate
sox-itgc	SOX IT general controls
hitrust	HITRUST CSF v11.2.0
cis-sf	CIS Salesforce Benchmark v1.2.0
dora, nis2	EU DORA, EU NIS2
owasp-llm-2025, owasp-agentic-2026	OWASP Top 10 for LLM and for Agentic Applications
cert-in-sbom	India CERT-In SBOM guidelines v2.0

What the folder contains

vulkro-compliance-pack/
  manifest.json   framework, scan id, status per control
  summary.md      one row per control: status, finding count, evidence file
  findings.csv    control id, severity, file, line, message, remediation
  README.md       what the pack covers
  controls/       one JSON file per control, with file:line evidence

pci-dss-4-0, nist-800-53 and soc2-full also write <framework>.html, a control-by-control table.

A control passes with no findings, is partial with only Medium or Low findings and fails with any High or Critical finding. The pack is one input to an audit, not a full audit: it covers what is in the code, not process controls.

Exit codes

0 no findings, 1 findings reported, 2 bad argument or internal error.

See also: vulkro compliance, Compliance overview.