> For the complete documentation index, see [llms.txt](https://docs.softwaresecured.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.softwaresecured.com/vulnerabilities/compliance-mapping.md).

# Compliance Mapping

View how each vulnerability maps to specific controls across your compliance frameworks.

<code class="expression">space.vars.product\_name</code> automatically maps each vulnerability to the relevant controls across your compliance frameworks. The mapping is based on each vulnerability's Common Weakness Enumeration (CWE) identifier, and no additional configuration is required from your team.

**Supported frameworks:**

* SOC 2 (Trust Services Criteria)
* HIPAA
* PCI DSS
* ISO 27001

{% hint style="info" %}
Compliance mapping is available on Standard+ packages and above. To inquire about upgrading your <code class="expression">space.vars.product\_name</code> package, contact your account manager or reach out to sales.
{% endhint %}

***

### View compliance mapping on the Vulnerabilities tab

1. Select your project in the project bar and open the <mark style="color:orange;">**Vulnerabilities**</mark> tab.

![The Vulnerabilities tab navigation item](https://3399686764-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2VRHlIPF1fbDuNbp9G2t%2Fuploads%2FrqyxDdSp35OORl6tKmMA%2Fimage.png?alt=media\&token=c1a359fa-cd48-4339-a4db-a56c853b5f7d)

2. View the <mark style="color:orange;">**Compliance**</mark> column in the vulnerabilities table. Each vulnerability displays labels for the frameworks it affects.

![The Vulnerabilities table showing the Compliance column](https://3399686764-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2VRHlIPF1fbDuNbp9G2t%2Fuploads%2FGK9oLuED4o0sxOm3zvt8%2Fimage.png?alt=media\&token=c56444e1-f479-47a6-9d1b-6f1aa73d7706)

3. To filter the table to vulnerabilities that affect a specific framework, click the <mark style="color:orange;">**Compliance**</mark> filter and select the desired framework.

![The Compliance filter on the Vulnerabilities table](https://3399686764-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2VRHlIPF1fbDuNbp9G2t%2Fuploads%2FKnIBZ5jFqanVEILFQcOu%2Fimage.png?alt=media\&token=18ec1656-6ea8-48b9-af24-f553b0ee99f2)

***

### View control-level details for a vulnerability

Each vulnerability maps to specific named controls within each affected framework, including the full control description.

1. On the <mark style="color:orange;">**Vulnerabilities**</mark> tab, click any vulnerability to open its detail view.
2. Scroll to the <mark style="color:orange;">**Compliance**</mark> section in the vulnerability details.

![Detailed compliance framework controls in the vulnerability details](https://3399686764-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2VRHlIPF1fbDuNbp9G2t%2Fuploads%2FisvmclVcNbcUmpDBzg6N%2Fimage.png?alt=media\&token=b2574ba6-c0af-497e-87e5-f80b04c7d859)

The <mark style="color:orange;">**Compliance**</mark> section lists each affected framework, the specific control names, and the full control description.

***

### Include compliance mapping in your report

Compliance information is included in your downloaded PDF report by default. The <mark style="color:orange;">**Show Full Compliance**</mark> option is enabled by default for all reports, which means each control's full description is displayed alongside the control name and framework name.

To adjust this setting, open the <mark style="color:orange;">**Reports & Executive Summaries**</mark> tab, click <mark style="color:orange;">**Customize Report**</mark>, and navigate to **Additional display options**. When <mark style="color:orange;">**Show Full Compliance**</mark> is disabled, the report shows only the control names and framework names without the full descriptions. When the <mark style="color:orange;">**Compliance**</mark> section visibility is turned off, the compliance section will be hidden for the entire report.

For more information, see [Viewing and downloading reports and executive summaries](/reports-and-certificates/viewing-and-downloading-reports-and-executive-summaries.md).

***

{% hint style="info" %}
**Compliance mapping is not a compliance certification.** Mapping a vulnerability to a control shows which controls the vulnerability relates to—it does not indicate that your organization satisfies those controls. Whether a vulnerability has been remediated, whether compensating controls are in place, and whether your overall control environment meets your auditor's requirements are separate determinations.
{% endhint %}