# Compliance and Audit Readiness URL: https://www.deepinfo.com/solutions/use-cases/compliance-and-audit-readiness/ ## Keep Audit Evidence Current by Default. Audit prep goes wrong when the evidence is a snapshot from months ago. [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) classifies each issue against compliance frameworks when it is detected, and logs each decision made about it. [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) applies those classifications to your vendors. Open PCI DSS 4.0 findings, yours and your processors’, becomes a filter instead of a project. [Request demo](https://www.deepinfo.com/request-demo/) ### Evidence Ages Between Audits. The controls run all year. The evidence for them is usually gathered in a few weeks before the auditor arrives. Snapshots #### Collected Once, Trusted for a Year Evidence gathered for the last audit describes the surface as it was then. It says nothing about what changed since. Translation #### Findings in One Language, Controls in Another A scanner reports a weak cipher. The auditor asks about a requirement. Someone has to translate between the two, every cycle. Vendors #### Controls Outside Your Walls Processors, hosts and service providers carry part of your scope, and their evidence usually arrives as a questionnaire. ### Compliance Frameworks Are Mapped at Detection. Each issue carries its classifications from the moment it is raised. The list below is complete: the Deepinfo Platform does not claim mappings to other regulations. - **OWASP Top 10 (2021)**: Web application risk categories. `owasp_tt_2021` - **PCI DSS 4.0**: Payment card industry requirements, current version. `pci_4_0` - **PCI DSS 3.2**: The previous version of the standard. `pci_3_2` - **HIPAA**: US safeguards for health information. `hipaa` - **CWE**: Common Weakness Enumeration: the weakness behind a finding - **CAPEC**: Common Attack Pattern Enumeration and Classification: the attack pattern that exploits it - **WASC**: Web Application Security Consortium threat classes ### Every Decision Stays on Record. An auditor asks what happened to a finding, not only whether it is open. Issues move through states from newly detected to verified resolved, and an accepted risk or a false-positive call stays on the issue with its history instead of being deleted. ### Where the Evidence Comes From. No separate compliance module to feed. The evidence is a by-product of the monitoring your team already runs. #### [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) Raises each issue with its evidence, a severity from Critical to Information and its framework classifications. #### [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/) Keeps each issue’s state history, from newly detected to verified resolved, accepted risks and false positives included. #### [Continuous Scanning](https://www.deepinfo.com/platform/easm/continuous-scanning/) Stores each layer of each asset as a dated snapshot, so you can show what an asset looked like on a given day. #### [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/) Applies those classifications to all issues across vendor portfolios, with nothing to configure per vendor. ### From Finding to Audit File. 1. **Detect** Scans raise issues on your assets and your vendors’ assets, already classified. 2. **Filter** Narrow by framework, severity, state, asset tag or vendor. Open PCI DSS 4.0 findings on assets tagged for payments is one filter. 3. **Resolve** Owners fix or decide. A fix is verified by rescan, and a decision stays in the issue’s history. 4. **Export** Export any issue search in full, or produce issue overview, issue detail and executive summary reports as PDF, on demand or on a schedule. ### Read Further on Vendor Evidence. - [A major Türkiye-based bank](https://www.deepinfo.com/customers/financial-services-major-bank/) (Customer story): Framework-mapped evidence across 100+ third-party relationships, exported on demand instead of collected once a year. - [Compliance Tracking](https://www.deepinfo.com/platform/tprm/compliance-tracking/) (TPRM): Vendor findings, filtered by the frameworks your audits use. - [Third-Party Risk Management](https://www.deepinfo.com/solutions/use-cases/third-party-risk-management/) (Use case): The vendor side of this evidence. ### Use This Data in Your Tools Auditors and GRC tools can pull the certificate, technology and vulnerability data behind each finding through the API. - [SSL Lookup API](https://www.deepinfo.com/data-api/apis/ssl-lookup/) - [Technology Lookup API](https://www.deepinfo.com/data-api/apis/technology-lookup/) - [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/) ### Questions About Compliance and Audit Readiness **Which frameworks are mapped?** OWASP Top 10 (2021), PCI DSS 4.0, PCI DSS 3.2, HIPAA, CWE, CAPEC and WASC. Each issue carries the classifications that apply to it. **Does a classification mean we are compliant?** No. A classification says which framework a finding is relevant to, so your team can prioritize and evidence it. It is not an attestation: compliance decisions stay with your compliance function and your auditors. **Can we use the findings for other regulations?** As supporting evidence, yes. Regulations such as GDPR ask for appropriate technical measures, and a current, classified record of external findings helps show them. The platform does not map findings to those regulations’ controls. **Does this replace a GRC tool?** No. The platform produces the external evidence, classified and current. Your governance process decides what that evidence means for each control. **Can we verify a fix right before an audit?** Yes. Start an instant scan on the asset from the platform or with one API call. If the issue is no longer found, it moves to verified resolved without waiting for the next scheduled pass. **Can we show which alerts went out?** Yes. The platform API lists the notification emails that were sent, each with the rule that triggered it, so an auditor can see which alerts went out and why. **Are vendor findings classified too?** Yes. Third-Party Risk Management runs vendors on the engine that scans your assets, so vendor issues carry the same classifications. ### Answer the Auditor With Current Data. Book a demo to filter real findings by the frameworks your audits use. [Request demo](https://www.deepinfo.com/request-demo/)