TRUSTIVAN maps the evidence it holds onto the controls of five frameworks: SOC 2 (AICPA Trust Services Criteria), ISO/IEC 27001:2022 Annex A, PCI DSS v4.0, NIST SP 800-218 (SSDF) and the EU Cyber Resilience Act essential requirements. The dashboard’s Compliance page shows one framework at a time. The same data is available at GET /api/v1/compliance/frameworks/{id}.

​
What this is, and what it is not

It is evidence assembly: “ISO 27001 A.8.8 says you must manage technical vulnerabilities — here are the 47 open vulnerability findings, the components they sit in, and the policies that bear on them.” That is most of the work of an audit. It is not an assessment, a certification or an attestation. A control is satisfied by your organisation’s practices, of which security scanning is one input. TRUSTIVAN holds no opinion about whether you have satisfied a control, and no status it reports says you have. Every framework carries that disclaimer, and it appears on the page, in the API response and in every downloaded report.

​
Control statuses

There is no “pass” and no “compliant”. The vocabulary describes the evidence: no_data is deliberately distinct from evidence_present. “We have never looked” and “we looked and found nothing wrong” are different facts, and a product that rendered them the same colour would tell you a control was checked when nothing was.

​
Uncovered controls are counted

Every framework’s summary counts all its controls, including the ones TRUSTIVAN observes nothing for, and controls_not_covered is reported alongside the total. A mapping that listed only the controls a tool covers would report “12 of 12 controls have evidence” for a framework with 31 — a true sentence that produces a false impression. The controls TRUSTIVAN covers nothing for are things like physical security perimeters, personnel screening, and cardholder data handling. They are listed by name on the page, with a note saying why.

​
Where the evidence comes from

Each control names the TRUSTIVAN capabilities that bear on it — vulnerability scanning, component inventory, secret detection, policy enforcement, the audit trail, access control, tenant isolation, and others. On the Compliance page, each capability links to the screen that shows the rows it counted, so a control with “47 open” can be opened as those 47 findings. The audit-chain evidence is folded in fail-closed: if the tamper-evident audit chain cannot be verified, the assessment says so rather than reporting the trail as intact.

​
Exporting

See Export a compliance report.