Signal collection
Scanners, cloud APIs and identity systems emit signals into one evidence stream. Each carries a hash, a source and a UTC timestamp.
Compliance frameworks,
natively mapped.
Compliance framework mapping connects controls to relevant evidence and records relationships between standards. Teams can reuse evidence where appropriate, while reviewers decide whether it is sufficient for each requirement. SecurityVault ships ${FRAMEWORKS_SEEDED} frameworks with seeded control catalogues and technical evidence from code, image and cloud checks. Catalogue coverage does not mean every control can be evaluated automatically. ${FRAMEWORKS_PREVIEW} additional frameworks or requirements are listed below as preview mapping targets, a questionnaire template or customer-defined controls. They are not complete built-in catalogues.
Coverage matrix
Which compliance frameworks does SecurityVault map?
Mapping is bidirectional: 37 pair-wise cross-walk edges are seeded across 7 framework pairs from published crosswalks, each linking NIST 800-53 with SOC 2, ISO 27001, PCI DSS v4, FedRAMP, NIS2, DORA or HIPAA. NIS2 and DORA connect to each other through NIST 800-53, and the transitive closure is computed on demand.
| Framework | Version | Status |
|---|---|---|
| SOC 2 | Seeded catalogue | |
| ISO/IEC 27001 | Seeded catalogue | |
| PCI DSS | Seeded catalogue | |
| HIPAA Security Rule | Seeded catalogue | |
| GDPR | Seeded catalogue | |
| CIS Controls | Seeded catalogue | |
| NIST SP 800-53 | Preview: selected mappings | |
| NIS2 | Preview: selected mappings | |
| DORA | Preview: selected mappings | |
| FedRAMP | Preview: selected mappings | |
| HECVAT | Questionnaire template | |
| NIST CSF | Customer-defined; not pre-modelled | |
| CCPA / CPRA | Customer-defined; not pre-modelled | |
| SOX ITGC | Customer-defined; not pre-modelled | |
| Custom | Supported |
Versions above describe the included catalogue, not a claim of current certification or complete regulatory coverage. The PCI DSS catalogue is based on v4.0; check the current PCI SSC requirements and review version differences before an assessment. FedRAMP mappings do not confer FedRAMP certification or an agency authorisation to operate. See the FedRAMP Marketplace guide.
Mapping engine
How can evidence support several frameworks?
Evidence is collected once from the same graph that runs from code to image to cloud, then projected against every framework that requires it.
01
02
Control mapping
Each control declares the signals that satisfy it, and the cross-walk carries them to equivalents. Evidence for SOC 2 CC6.1 reaches ISO 27001 A.5.16 through NIST 800-53 AC-2, and PCI DSS v4 8.3 through IA-2, as a starting point for review. A relationship between controls does not establish that their requirements are identical.
03
Auditor view
At audit time, the read-only auditor portal shows the evidence behind each control, framework by framework, with digitally signed control decisions your auditor can verify.
Custom frameworks
Can you bring your own controls?
Yes. Internal standards, regulator-specific obligations and supplier requirements are defined with the same control model as the shipped frameworks and cross-walked into them.
Custom frameworks, first-class
Custom frameworks use the same control types, evidence frequencies, auditor portal and cross-walk graph as the shipped frameworks. Define evidence requirements and cross-references, then validate that the available signals support your control.
- Reuse evidence from shipped frameworks
- Cross-walk to any shipped framework
- Set control type, owner and evidence frequency per control
- Manage through the API and the GRC console
# illustrative custom control framework_id: internal-2026 control_id: CC-INT-01 title: Customer key isolation control_type: preventive # detective · corrective · compensating evidence_frequency: continuous # daily · weekly · monthly · quarterly evidence_sources: - cloud.kms.key_segregation - tenant.boundary_test cross_references: - SOC2:CC6.1 - ISO27001:A.8.24
FAQ
Compliance framework questions
- What is compliance framework mapping?
- Linking controls to relevant evidence and to related requirements in other frameworks. Evidence can be reused where its scope and quality are appropriate; each control still needs its own assessment.
- What is the difference between a seeded framework and a cross-walk target?
- A seeded framework has a built-in catalogue and evidence types. Technical checks cover relevant controls; organisational and procedural requirements still need human evidence and review. Preview targets such as NIST 800-53, NIS2, DORA and FedRAMP have selected mappings within 37 cross-walk links, not full catalogues or complete automated coverage.
- Is SecurityVault itself certified against these frameworks?
- No. SecurityVault maps your evidence to your controls to help you prepare for your own audits; attestation comes from your auditor. Our own security posture is described on the trust page.
- Can we add our own framework?
- Yes. Custom frameworks use the same control types (preventive, detective, corrective, compensating), evidence frequencies and cross-walk graph as the shipped frameworks, and are managed through the API and the GRC console.
Evidence, not spreadsheets
Hand the auditor
signed evidence.
See how a scan result becomes evidence for a control, and how the auditor portal exposes it read-only with signed access.