# Compliance Tracking

URL: https://www.deepinfo.com/platform/tprm/compliance-tracking/

## Answer Vendor Audit Questions With a Filter.

Each issue the Deepinfo Platform raises is classified against frameworks such as PCI DSS 4.0, HIPAA and OWASP Top 10, and a vendor’s issues are classified exactly like your own.

An auditor’s question about a vendor becomes a filter over current scan data, and each issue in the answer carries the evidence that raised it.

[Request demo](https://www.deepinfo.com/request-demo/)

### Each Vendor Is Mapped to Every Framework.

These are the classifications External Attack Surface Management applies to your issues. There is nothing to configure per vendor.

| Framework | What it covers | Classification |
| --- | --- | --- |
| OWASP Top 10 (2021) | The most critical web application security risks | `owasp_tt_2021` |
| PCI DSS 4.0 | Security of payment card data, version 4.0 | `pci_4_0` |
| PCI DSS 3.2 | Security of payment card data, version 3.2 | `pci_3_2` |
| HIPAA | Security of health information in the US | `hipaa` |
| CWE | Common Weakness Enumeration: types of software weakness | A CWE entry |
| CAPEC | Common Attack Pattern Enumeration and Classification | A CAPEC attack pattern |
| WASC | Web Application Security Consortium threat classification | A WASC threat class |

A classified finding is evidence, *not a verdict.*

The platform shows which externally visible issues fall under a framework. Whether a vendor is compliant is still a judgment your team and your auditors make, with the vendor’s own attestations alongside.

### Issues Arrive Classified and Stay Current.

1. **Detected**

   A scan raises an issue on a vendor asset. It arrives already classified.
2. **Filtered**

   Your team narrows vendor issues by framework, severity, state and vendor.
3. **Resolved**

   The vendor fixes it, a rescan confirms, and the issue becomes verified resolved and leaves the open view.
4. **Recorded**

   Accepted risks, ignored issues and false positives stay on record with their history.

### Frameworks That Follow Your Vendors’ Roles.

Which classification matters depends on what a third party does for you.

Payments

#### Vendors in PCI Scope

Processors, gateways and hosting providers that touch cardholder data, filtered to open PCI DSS 4.0 findings.

Healthcare

#### Business Associates

Partners that handle health information on your behalf, filtered to HIPAA-classified issues.

Web

#### Application Vendors

Agencies and software providers whose web applications your customers use, filtered by OWASP Top 10 category.

Engineering

#### Weakness Patterns

CWE and CAPEC name the weakness and attack pattern behind a finding, which is what the vendor’s engineers need to fix it.

### Evidence an Auditor Can Trace.

Each classified issue links to the asset it was found on, the scan data that raised it and each state change since. Accepting a risk changes the issue’s state and keeps the issue on record.

A filtered issue list exports in full, and the vendor’s reports come from the same data. The auditor sees what your team sees.

- Issue Overview and Issue Detail reports
- Vulnerability Overview and Vulnerability Detail reports
- Asset Detail reports
- PDF, on demand or on a schedule

- **Filter**: Framework, severity, state, vendor
- **Export**: All issues that match the filter
- **History**: Every state change, kept

### Where Compliance Connects.

- [Compliance and Audit Readiness](https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/) (Use case): One set of classifications across your surface and your vendors.
- [Vendor Risk Assessments](https://www.deepinfo.com/platform/tprm/comprehensive-risk-assessments/) (TPRM): Vendor findings with severity, evidence and state.
- [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) (Module): All its capabilities on one engine.

### Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.

- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [Associated Domain Finder API](https://www.deepinfo.com/data-api/apis/associated-domain-finder/)
- [Subdomain Finder API](https://www.deepinfo.com/data-api/apis/subdomain-finder/)
- [Domain WHOIS API](https://www.deepinfo.com/data-api/apis/whois-lookup/)

### Questions About Vendor Compliance

**Does Deepinfo certify vendors as compliant?**

No. It classifies the issues it finds on a vendor’s external surface against frameworks such as PCI DSS, HIPAA and OWASP Top 10. Your team and your auditors use that as evidence for the review. It is not an attestation.

**Which vendor issues get classified?**

Every issue the detection engine raises, on every vendor portfolio. Classification does not depend on which vendor it is or how the vendor was added.

**Can findings be mapped to a framework that isn’t listed?**

The platform classifies issues only against the frameworks listed on this page. For any other framework, the CWE and CAPEC entries a finding carries, and its evidence, give your auditors the material to map from.

**Why both PCI DSS 4.0 and 3.2?**

The platform classifies issues against both versions, so a review that still references 3.2 and one on 4.0 read from the same findings.

**Can we group vendors the way our program does?**

The classifications are built in and applied automatically. To group vendors or systems your own way, tag their assets and filter by tag.

### See Your Vendors Through Your Audit Frameworks.

In a demo we add a few of your vendors and filter their findings by the frameworks your audits use.

[Request demo](https://www.deepinfo.com/request-demo/)