Compliance overview
Vulkro maps every finding to the controls in common compliance frameworks. To check your code against one, run:
vulkro compliance . --profile <name>
Or add --profile to a normal scan to attach a profile inline.
Frameworks supported
| Profile | Framework | Coverage |
|---|---|---|
owasp-asvs | OWASP Application Security Verification Standard | L1 + L2, V1-V14 |
pci | PCI-DSS 4.0 | Req 6 (Develop and Maintain Secure Systems), Req 11 (Test Security) |
soc2 | SOC 2 Trust Services Criteria | CC6 (Logical Access), CC7 (System Operations) |
hipaa | HIPAA Security Rule | Sec.164.312 |
nist-ssdf | NIST SP 800-218 SSDF | PS, PW, RV practice groups |
nist-800-53 | NIST SP 800-53 | Selected control families |
stateramp | StateRAMP | Selected control baseline |
iso27001 | ISO/IEC 27001:2022 | Annex A.5 (organisational) and A.8 (technological) |
cis | CIS Critical Security Controls v8 | All 18 controls |
cwe-top25 | CWE Top 25 Most Dangerous | Full list |
gdpr | GDPR (data-protection controls) | Article 32 security-of-processing controls |
GDPR also has two output formats for Article 30 Records of Processing:
vulkro compliance . --profile gdpr --format ropa-md # Markdown
vulkro compliance . --profile gdpr --format ropa-html # HTML
These produce a Records-of-Processing template, not a pass/fail control evaluation.
How mapping works
Each finding category carries a compliance_controls list, so one finding can
satisfy several frameworks at once. A single CSRF detection maps to ASVS V13,
OWASP A05:2021, PCI 6.5.9, and CIS 16.10.
We curate the mapping table by hand. Mechanical CWE-to-control mappings miss the intent of each framework, so the extra maintenance buys citations an auditor can defend.
Reading the output
vulkro compliance . --profile soc2
Profile: SOC 2 Trust Services Criteria
Status: 17 controls passed | 4 controls failed | 2 controls partial
CC6.1 Restrict access to information assets FAIL
Citation: API1 - BrokenObjectLevelAuth (115 findings)
Citation: API5 - BrokenFunctionLevelAuth (12 findings)
CC6.6 Implement logical access controls PASS
CC6.7 Restrict transmission to authorised users PASS
CC7.1 Detect security events FAIL
Citation: SecurityMisconfiguration - auditing disabled (47 findings)
...
Each control gets one status:
- PASS: no findings against any of the control's mapped categories.
- FAIL: at least one Critical or High finding against a mapped category.
- PARTIAL: only Medium or Low findings against mapped categories.
In the desktop console
The Compliance tab shows pass / fail per control, with links straight to the findings behind each one. When an auditor asks "show me how you meet PCI 6.5.7," you can answer in one click.
In Vulkro Cloud
Vulkro Cloud keeps the same control mapping for every connected repository and Salesforce org, and can build an evidence pack on a schedule and email it through your own mail server. See Reports and evidence.