Compliance overview
Vulkro maps every finding to the controls in common compliance frameworks. To check your code against one, run:
vulkro compliance . --profile <name>
Or add --profile to a normal scan to attach a profile inline.
Frameworks supported
| Profile | Framework | Coverage |
|---|---|---|
owasp-asvs | OWASP Application Security Verification Standard | L1 + L2, V1-V14 |
pci | PCI-DSS 4.0 | Req 6 (Develop and Maintain Secure Systems), Req 11 (Test Security) |
soc2 | SOC 2 Trust Services Criteria | CC6 (Logical Access), CC7 (System Operations) |
hipaa | HIPAA Security Rule | Sec.164.312 |
nist-ssdf | NIST SP 800-218 SSDF | PS, PW, RV practice groups |
nist-800-53 | NIST SP 800-53 | Selected control families |
stateramp | StateRAMP | Selected control baseline |
iso27001 | ISO/IEC 27001:2022 | Annex A.5, A.8, A.14 |
cis | CIS Critical Security Controls v8 | All 18 controls |
cwe-top25 | CWE Top 25 Most Dangerous | Full list |
gdpr | GDPR (data-protection controls) | Article 32 security-of-processing controls |
GDPR also has two output formats for Article 30 Records of Processing:
vulkro compliance . --profile gdpr --format ropa-md # Markdown
vulkro compliance . --profile gdpr --format ropa-html # HTML
These produce a Records-of-Processing template, not a pass/fail control evaluation.
How mapping works
Each finding category carries a compliance_controls list, so one finding can
satisfy several frameworks at once. A single CSRF detection maps to ASVS V13,
OWASP A05:2021, PCI 6.5.9, and CIS 16.10.
We curate the mapping table by hand. Mechanical CWE-to-control mappings miss the intent of each framework, so the extra maintenance buys citations an auditor can defend.
Reading the output
vulkro compliance . --profile soc2
Profile: SOC 2 Trust Services Criteria
Status: 17 controls passed | 4 controls failed | 2 controls partial
CC6.1 Restrict access to information assets FAIL
Citation: API1 - BrokenObjectLevelAuth (115 findings)
Citation: API5 - BrokenFunctionLevelAuth (12 findings)
CC6.6 Implement logical access controls PASS
CC6.7 Restrict transmission to authorised users PASS
CC7.1 Detect security events FAIL
Citation: SecurityMisconfiguration - auditing disabled (47 findings)
...
Each control gets one status:
- PASS: no findings against any of the control's mapped categories.
- FAIL: at least one Critical or High finding against a mapped category.
- PARTIAL: only Medium or Low findings against mapped categories.
In the desktop console
The Compliance tab shows pass / fail per control, with links straight to the findings behind each one. When an auditor asks "show me how you meet PCI 6.5.7," you can answer in one click.