Use case · Security and compliance teams
Audit evidence from the scan you already run.
Vulkro maps each finding to the controls it affects and hands you the evidence, control by control, with the file, setting or grant behind it.
Vulkro gives you evidence for your auditor. It does not certify anything.
01The problem
Evidence is gathered by hand, once a year.
Security findings and audit controls describe the same risks in two languages, and someone translates between them every cycle.
- Not linkedThe scanner reports a missing field check. The auditor asks about access control.
- Out of dateEvidence for the audit window says nothing about the months either side of it.
- Silent gapsA control nothing checked looks the same as one that passed.
02How Vulkro helps
Every control, with the issues behind it.
A control fails when an open issue affects it. One that no check covers says so, instead of passing by default.
acme.vulkro.com · ComplianceExample org
A Vulkro Cloud example. Control ids are SOC 2’s; the issues and their states are illustrative.
03Why it holds up
Precise, and checkable.
- 01Five frameworks for every orgSOC 2, ISO 27001, HIPAA, PCI DSS 4.0 and NIST 800-53, for each Salesforce org in Vulkro Cloud.Computed from each org’s open issues
- 02Application code tooA compliance pack per framework for each repository, with the file and line behind every control, and a bill of materials.Compliance packs and SBOMs are part of Pro
- 03Evidence that holds upPacks as PDF for reading and CSV for the spreadsheet, each file with its SHA-256 checksum.As current as the last scan