Compliance Mapping

View how each vulnerability maps to specific controls across your compliance frameworks.

Portal automatically maps each vulnerability to the relevant controls across your compliance frameworks. The mapping is based on each vulnerability's Common Weakness Enumeration (CWE) identifier, and no additional configuration is required from your team.

Supported frameworks:

• SOC 2 (Trust Services Criteria)

• HIPAA

• PCI DSS

• ISO 27001

Compliance mapping is available on Standard+ packages and above. To inquire about upgrading your Portal package, contact your account manager or reach out to sales.

---

View compliance mapping on the Vulnerabilities tab

1. Select your project in the project bar and open the Vulnerabilities tab.

The Vulnerabilities tab navigation item

1. View the Compliance column in the vulnerabilities table. Each vulnerability displays labels for the frameworks it affects.

The Vulnerabilities table showing the Compliance column

1. To filter the table to vulnerabilities that affect a specific framework, click the Compliance filter and select the desired framework.

The Compliance filter on the Vulnerabilities table

---

View control-level details for a vulnerability

Each vulnerability maps to specific named controls within each affected framework, including the full control description.

1. On the Vulnerabilities tab, click any vulnerability to open its detail view.

2. Scroll to the Compliance section in the vulnerability details.

Detailed compliance framework controls in the vulnerability details

The Compliance section lists each affected framework, the specific control names, and the full control description.

---

Include compliance mapping in your report

Compliance information is included in your downloaded PDF report by default. The Show Full Compliance option is enabled by default for all reports, which means each control's full description is displayed alongside the control name and framework name.

To adjust this setting, open the Reports & Executive Summaries tab, click Customize Report, and navigate to Additional display options. When Show Full Compliance is disabled, the report shows only the control names and framework names without the full descriptions. When the Compliance section visibility is turned off, the compliance section will be hidden for the entire report.

For more information, see Viewing and downloading reports and executive summaries.

---

Compliance mapping is not a compliance certification. Mapping a vulnerability to a control shows which controls the vulnerability relates to—it does not indicate that your organization satisfies those controls. Whether a vulnerability has been remediated, whether compensating controls are in place, and whether your overall control environment meets your auditor's requirements are separate determinations.