Request demo

Compliance Tracking

Answer Vendor Audit Questions With a Filter.

Each issue the Deepinfo Platform raises is classified against frameworks such as PCI DSS 4.0, HIPAA and OWASP Top 10, and a vendor’s issues are classified exactly like your own.

An auditor’s question about a vendor becomes a filter over current scan data, and each issue in the answer carries the evidence that raised it.

Request demo

Query

  1. filter framework = PCI DSS 4.0 (pci_4_0)
  2. filter state = open
  3. filter vendor = payroll.example

  • Weak TLS cipher

    pay.payroll.example · pci_4_0 · pci_3_2 · owasp_tt_2021 · evidence

    open

  • Expiring certificate

    api.payroll.example · pci_4_0 · CWE · evidence

    open

  • Login page

    crm-saas.example · owasp_tt_2021

    open

  • End-of-life software

    hr-legacy.payroll.example · hipaa · CWE

    open

  • Open port

    cdn-provider.example · pci_4_0 · WASC

    verified_resolved

Export · issue list (CSV / JSON) · PDF reports

Each Vendor Is Mapped to Every Framework.

These are the classifications External Attack Surface Management applies to your issues. There is nothing to configure per vendor.

FrameworkWhat it coversClassification
OWASP Top 10 (2021)The most critical web application security risksowasp_tt_2021
PCI DSS 4.0Security of payment card data, version 4.0pci_4_0
PCI DSS 3.2Security of payment card data, version 3.2pci_3_2
HIPAASecurity of health information in the UShipaa
CWECommon Weakness Enumeration: types of software weaknessA CWE entry
CAPECCommon Attack Pattern Enumeration and ClassificationA CAPEC attack pattern
WASCWeb Application Security Consortium threat classificationA WASC threat class

A classified finding is evidence, not a verdict.

The platform shows which externally visible issues fall under a framework. Whether a vendor is compliant is still a judgment your team and your auditors make, with the vendor’s own attestations alongside.

Issues Arrive Classified and Stay Current.

  1. 01

    Detected

    A scan raises an issue on a vendor asset. It arrives already classified.

  2. 02

    Filtered

    Your team narrows vendor issues by framework, severity, state and vendor.

  3. 03

    Resolved

    The vendor fixes it, a rescan confirms, and the issue becomes verified resolved and leaves the open view.

  4. 04

    Recorded

    Accepted risks, ignored issues and false positives stay on record with their history.

Frameworks That Follow Your Vendors’ Roles.

Which classification matters depends on what a third party does for you.

Payments

Vendors in PCI Scope

Processors, gateways and hosting providers that touch cardholder data, filtered to open PCI DSS 4.0 findings.

Healthcare

Business Associates

Partners that handle health information on your behalf, filtered to HIPAA-classified issues.

Web

Application Vendors

Agencies and software providers whose web applications your customers use, filtered by OWASP Top 10 category.

Engineering

Weakness Patterns

CWE and CAPEC name the weakness and attack pattern behind a finding, which is what the vendor’s engineers need to fix it.

Evidence an Auditor Can Trace.

Each classified issue links to the asset it was found on, the scan data that raised it and each state change since. Accepting a risk changes the issue’s state and keeps the issue on record.

A filtered issue list exports in full, and the vendor’s reports come from the same data. The auditor sees what your team sees.

  • Issue Overview and Issue Detail reports
  • Vulnerability Overview and Vulnerability Detail reports
  • Asset Detail reports
  • PDF, on demand or on a schedule
FilterFramework, severity, state, vendor
ExportAll issues that match the filter
HistoryEvery state change, kept

Where Compliance Connects.

Use case Compliance and Audit Readiness One set of classifications across your surface and your vendors. Read TPRM Vendor Risk Assessments Vendor findings with severity, evidence and state. Read Module Third-Party Risk Management All its capabilities on one engine. Read

Query This Data Through the API

Vendors are discovered and scanned from the index that holds your assets. Your tools can look up any vendor’s domains through the API.

Questions About Vendor Compliance

Does Deepinfo certify vendors as compliant?

No. It classifies the issues it finds on a vendor’s external surface against frameworks such as PCI DSS, HIPAA and OWASP Top 10. Your team and your auditors use that as evidence for the review. It is not an attestation.

Which vendor issues get classified?

Every issue the detection engine raises, on every vendor portfolio. Classification does not depend on which vendor it is or how the vendor was added.

Can findings be mapped to a framework that isn’t listed?

The platform classifies issues only against the frameworks listed on this page. For any other framework, the CWE and CAPEC entries a finding carries, and its evidence, give your auditors the material to map from.

Why both PCI DSS 4.0 and 3.2?

The platform classifies issues against both versions, so a review that still references 3.2 and one on 4.0 read from the same findings.

Can we group vendors the way our program does?

The classifications are built in and applied automatically. To group vendors or systems your own way, tag their assets and filter by tag.

See Your Vendors Through Your Audit Frameworks.

In a demo we add a few of your vendors and filter their findings by the frameworks your audits use.

Request demo