`vulkro compliance-pack`

Pro

vulkro compliance-pack is part of Pro: Compliance pack (compliance-pack), the audit-evidence bundle, per framework. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Produce a self-contained audit-evidence directory mapping findings to specific SOC 2, ISO 27001, or HIPAA control IDs. Distinct from vulkro compliance, which is the in-process profile-evaluation flag: compliance-pack writes a packaged bundle on disk for handoff to auditors.

Usage

vulkro compliance-pack .                           # default: SOC 2
vulkro compliance-pack . --framework iso27001
vulkro compliance-pack . --framework hipaa --output ./audit-2026-q1

Arguments

Argument	Description	Default
`PATH`	Project root.	`.`

Flags

Flag	Description	Default
`--framework <NAME>`	`soc2`, `iso27001`, or `hipaa`.	`soc2`
`--output <DIR>`, `-o`	Output directory.	`./vulkro-compliance-pack`

What the pack contains

vulkro-compliance-pack/
+-- manifest.json         <- framework, generated_at, scan_id,
|                            control_summary{ control_id: { status,
|                            finding_count, evidence_files } }
+-- summary.md            <- human-readable markdown table of controls
+-- findings.csv          <- flat: control_id, severity, owasp_category,
|                            file, line, message, remediation
+-- README.md             <- what's in this bundle + auditor's read-me
+-- controls/
    +-- CC.6.1.json       <- per-control evidence with file:line refs
    +-- CC.7.1.json
    +-- ...

Control IDs and filenames are framework-specific:

SOC 2 - CC.6.1.json, CC.7.2.json, P.1.0.json, etc.
ISO 27001 - A.5.15.json, A.8.24.json, etc.
HIPAA - 164.312_a__1_.json ((/) sanitised for filesystems).

Mapping table

Categorisation runs over each finding's OwaspCategory plus message-keyword cues, bucketing into eight classes that map to framework controls:

Bucket	SOC 2	ISO 27001	HIPAA
Auth	CC.6.1	A.5.15, A.8.2	164.312(a)(1)
Misconfig	CC.6.6, CC.7.1	A.5.23, A.8.28	164.312(a)(1)
Secrets	CC.6.1, CC.6.7	A.5.15, A.8.2, A.8.24	164.312(a)(1), 164.308(a)(1)(ii)(D)
Dependencies	CC.7.1, CC.7.2	A.8.28	164.308(a)(1)(ii)(D)
PII	CC.6.1, P.1.0	A.5.15	164.312(c)(1), 164.312(e)(1)
PHI	CC.6.1, P.1.0	A.5.15	164.312(c)(1), 164.312(e)(1)
Crypto	CC.6.7	A.8.24	164.312(e)(1)
Logging	CC.7.3, CC.4.1	A.8.28	164.308(a)(1)(ii)(D)

Status per control:

Pass - no findings tagged to the control.
Partial - only Medium/Low findings.
Fail - at least one High/Critical finding.

ScanResult.credentials and ScanResult.git_secrets (which live outside the unified findings array) are promoted into synthetic Secrets-bucket findings so they show up against the right controls.

What an auditor sees

The summary.md is the auditor's entry point. Example excerpt:

| Control | Status | Findings | Evidence |
|---|---|---:|---|
| CC.6.1 (Logical Access) | Fail | 12 | controls/CC.6.1.json |
| CC.6.6 (Network Filtering) | Partial | 3 | controls/CC.6.6.json |
| CC.7.1 (Detection) | Fail | 41 | controls/CC.7.1.json |
| CC.7.2 (Monitoring) | Pass | 0 | - |
...

Each controls/<id>.json is the structured deep-dive: list of findings tagged to that control, file:line references, severity, and the verbatim remediation guidance. Auditors who want to verify a control independently can jump from summary.md straight to the file:line in source.

Reproducibility

The pack is reproducible from a tagged commit + the same vulkro version. Pin both in your audit narrative so a re-run produces byte-identical evidence (mod the generated_at timestamp).

Disclaimer

The pack is one input to an audit, not a complete audit. It captures what the security engine sees in code; it doesn't replace process controls, training records, or vendor risk assessments. The generated README.md says exactly this so an auditor doesn't mistake the scope.

vulkro compliance - in-process profile evaluation: prints control status without writing files.
Compliance frameworks -> Overview.

Command reference

Generated from vulkro help compliance-pack on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Build a folder of audit evidence mapped to a compliance framework.

[Pro] Generate a self-contained audit-evidence directory mapping findings to control IDs of a chosen compliance framework.

Runs a normal scan first, then writes manifest.json, summary.md, findings.csv, README.md, and a per-control file under controls/. For the deep frameworks (pci-dss-4-0, nist-800-53, soc2-full) also writes <framework>.html with a control-by-control evidence table that cross-references the supporting Vulkro rule IDs.

Supported `--framework` values: soc2          Category-bucket fan-out to SOC 2 CC / P controls. iso27001      Category-bucket fan-out to ISO/IEC 27001:2022 Annex A. hipaa         Category-bucket fan-out to HIPAA Security Rule. pci-dss-4-0   PCI DSS 4.0 Requirements 6, 11, 12 per-control map. nist-800-53   NIST SP 800-53 Rev. 5 moderate baseline (AC, AU, CM, IA, RA, SI families). soc2-full     Full SOC 2 Trust Service Criteria (CC1.1 to CC9.2).

Exit codes: `0` success and no findings; `1` scan completed and findings were reported; `2` arg error or internal failure.

Usage: vulkro compliance-pack [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
      --framework <FRAMEWORK>
          Framework whose control IDs to map findings into. One of: soc2 / iso27001 / hipaa / pci-dss-4-0 / nist-800-53 / soc2-full

          Possible values:
          - soc2
          - iso27001
          - hipaa
          - pci-dss-4-0
          - nist-800-53
          - soc2-full
          - cis-sf:           CIS Salesforce Benchmark v1.2.0. Salesforce-specific deep compliance pack; see `src/security/compliance_frameworks/cis_salesforce.rs`
          - hitrust:          HITRUST CSF v11.2.0. Salesforce Health Cloud compliance pack (HIPAA + HITECH + ISO 27001/27002 + NIST CsF harmonised); see `src/security/compliance_frameworks/hitrust_csf.rs`
          - fedramp-moderate: FedRAMP Moderate (Rev 5 Baseline, May 2023). Federal Salesforce compliance pack covering the 14 NIST 800-53 families that apply to a tenant-controllable Government Cloud Plus deployment. Accepts both `fedramp-moderate` and the shorter `fedramp` alias. See `src/security/compliance_frameworks/fedramp_moderate.rs`
          - nist-800-171:     NIST SP 800-171 Rev. 2. Salesforce defence-contractor compliance pack (DFARS 252.204-7012 / CMMC Level 2); see `src/security/compliance_frameworks/nist_800_171.rs`
          - stateramp:        StateRAMP Moderate (Baseline 2024.05). State and municipal government Salesforce compliance pack. Shares its NIST 800-53 lineage with FedRAMP Moderate plus four state-government distinct rows. Accepts both `stateramp` and the longer `stateramp-moderate` alias. See `src/security/compliance_frameworks/stateramp_moderate.rs`
          - sox-itgc:         SOX IT General Controls (COBIT 2019 Baseline). Salesforce financial-services compliance pack covering the three ITGC families (Access Controls, Change Management, IT Operations); see `src/security/compliance_frameworks/sox_itgc.rs`
          
          [default: soc2]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -o, --output <OUTPUT>
          Output directory
          
          [default: ./vulkro-compliance-pack]

  -h, --help
          Print help (see a summary with '-h')

Usage​

Arguments​

Flags​

What the pack contains​

Mapping table​

What an auditor sees​

Reproducibility​

Disclaimer​

Related​

Command reference​