Control mappings
Six seeded frameworks, with SOC 2, ISO 27001, PCI DSS and HIPAA cross-walked through NIST 800-53, plus custom frameworks with preventive, detective, corrective and compensating control types and an evidence frequency per control.
Security and compliance,
by industry.
Industry security and compliance is the work of applying one security programme to the regulators, attack patterns and asset types of a sector, so the controls an examiner asks about are backed by evidence from real systems. SecurityVault applies the same graph from code to image to cloud in every sector; what changes is which framework mappings, policies and exposures matter first.
Nine sectors
Where does each sector start?
Which shipped framework mappings apply, which policy templates matter first, and where custom frameworks cover the sector-specific obligations.
Financial services
Banks, insurers, capital markets
PCI DSS v4 ships mapped; DORA and NIS2 are cross-walk targets through NIST 800-53. SOX ITGC, FFIEC and OCC requirements need customer-defined controls and a coverage review; they do not ship as complete catalogues.
- DORA ICT-risk cross-walked to NIST 800-53
- Customer-defined SOX ITGC controls
- PCI DSS v4 mapped for payment flows
- Third-party risk management with a vendor portal
- Attack paths across identities and data stores
SharedGraph & engine
CustomFrameworks supported
Healthcare & life sciences
Hospitals, payers, biotech
A HIPAA Security Rule catalogue is included. HITRUST, GxP and 21 CFR Part 11 require customer-defined controls and review of the evidence each obligation needs.
- HIPAA safeguards mapped to cloud and code evidence
- Data stores and classifications modelled on the graph
- Read-only auditor portal with signed evidence
- Define custom controls for HITRUST and GxP requirements
- Human-only disposition with reason codes
SharedGraph & engine
CustomFrameworks supported
US federal & public sector
Civilian, defence, intelligence
Selected NIST 800-53 and FedRAMP controls appear as cross-walk targets, not complete catalogues or an authorisation. Discuss self-hosting, data flows and contractual requirements before evaluating suitability. SecurityVault holds no FedRAMP authorisation.
- Selected NIST 800-53 mapping targets
- Selected FedRAMP mapping targets
- Fully self-hosted deployment, on request
- Signed images and an admission webhook
- Hash-chained audit log for assessors
SharedGraph & engine
CustomFrameworks supported
Technology & SaaS
Multi-product platforms, AI labs
For platforms running many services across multiple clouds, with engineer-first workflows: pull-request policy, signed builds and ephemeral environments.
- Multi-cloud posture across AWS, Azure and GCP
- Pull-request gates with per-language scanners launched automatically
- SOC 2 and ISO 27001 mappings on one evidence chain
- Supply-chain checks: typosquats, dependency confusion, provenance
- Blast radius from package to ingress
SharedGraph & engine
CustomFrameworks supported
Retail & consumer
Omnichannel, marketplaces, payments
PCI DSS v4 ships mapped; CCPA/CPRA controls must be defined and reviewed for your programme. Continuous re-evaluation keeps control status current between assessments.
- PCI DSS v4 continuous re-evaluation
- GDPR article mapping for customer data
- External attack surface discovery
- API discovery and DAST on storefront APIs
- Exposure ranking on internet-facing workloads
SharedGraph & engine
CustomFrameworks supported
Energy & utilities
Power, oil & gas, water
Use code, image and cloud evidence alongside customer-defined NERC CIP and IEC 62443 controls. Self-hosting is available on request; air-gapped deployment and OT protocol connectors are not currently available.
- Customer-defined NERC CIP and IEC 62443 controls
- Network zones as graph entities
- Fully self-hosted deployment, on request
- Signed images and an admission webhook
- Hash-chained audit log for assessors
SharedGraph & engine
CustomFrameworks supported
Media & entertainment
Studios, streaming, gaming
Connect code, image and cloud evidence to your content-security programme. TPN and MPA requirements need customer-defined controls; they do not ship as complete catalogues.
- Customer-defined TPN and MPA controls
- Data assets and classifications on the graph
- Image-to-workload lineage for render and pipeline workloads
- Secrets detection across git history
- SIEM export to your existing SOC
SharedGraph & engine
CustomFrameworks supported
Industrial & manufacturing
Discrete, process, automotive
Generate SBOMs and review supply-chain findings for supported software. Define and assess IEC 62443 and TISAX controls separately; the platform does not replace an industrial-system assessment.
- SBOM generation, upload and diff
- Typosquat and dependency-confusion checks
- Customer-defined TISAX and IEC 62443 controls
- Build-to-image lineage for the software you ship
- Signed images and an admission webhook
SharedGraph & engine
CustomFrameworks supported
Higher education & research
Universities, research consortia
A HECVAT v3 questionnaire template helps organise responses for human review. FERPA and CUI requirements need customer-defined controls and validation of the applicable handling requirements.
- HECVAT v3 questionnaire support with human review
- Customer-defined FERPA and CUI controls
- Data-store classification for student data
- Single sign-on through OIDC or SAML
- Self-hosted option for research networks, on request
SharedGraph & engine
CustomFrameworks supported
Frameworks
Which frameworks apply to my sector?
Six frameworks ship with seeded control catalogues. Selected additional controls appear as cross-walk targets, and HECVAT has a questionnaire template. NIST CSF, CCPA/CPRA and SOX ITGC require you to define and validate custom controls. These are not complete built-in catalogues. See the full framework list.
SOC 2
Seeded
ISO 27001
Seeded
PCI DSS v4
Seeded
HIPAA
Seeded
GDPR
Seeded
CIS Controls
Seeded
NIST 800-53
Cross-walk
NIS2
Cross-walk
DORA
Cross-walk
FedRAMP
Cross-walk
HECVAT
Questionnaire
NIST CSF
Custom
CCPA / CPRA
Custom
SOX ITGC
Custom
Custom
Your controls
Cross-walk
Transitive
What every sector gets
What does every sector get?
01
02
Policy templates
Rego policy templates and a visual builder that compiles to Rego. Evaluation fails closed, and every decision is recorded in a hash-chained audit log.
03
Auditor portal
Read-only, invitation-based access for auditors with signed evidence. Questionnaire responses are generated from the same evidence.
04
Deployment choice
Hosted, or fully self-hosted on request. The same signed images and trust boundaries apply either way.
05
One security graph
Every sector reads the same graph: which commit, which image, which workload, which identity, which data store. Attack paths and blast radius come from it.
06
Regulatory feed
Regulatory change ingestion with impact assessment against your mapped controls, so a framework revision shows up as work items, not a surprise.
FAQ
Industry questions
- Does SecurityVault offer industry-specific editions?
- No. Every sector uses the same platform and the same graph. What differs is the starting point: which seeded frameworks apply, which obligations become custom frameworks and which policies and exposures to prioritise.
- How are sector regulations without a seeded catalogue handled?
- Your team defines the controls, evidence requirements and relevant cross-references as a custom framework. Coverage must be reviewed; a shared control model does not supply a complete regulatory catalogue. See the framework list.
- Can regulated organisations keep data inside their own boundary?
- Yes. A fully self-hosted deployment is available on request. See self-hosted SecurityVault.
- Does using SecurityVault make us compliant with our regulator?
- No platform can do that on its own. SecurityVault collects continuous evidence and maps it to your controls to help you prepare for examinations and audits; the assessment remains with your auditor or regulator.
Sector demo
Bring your regulator's
hardest question.
A 30-minute session on your sector: which mappings apply today, which controls need a custom framework, and how a scan result becomes evidence for both.