/compliance-mapping

name: Compliance Mapping
description: This skill should be used when the user asks about "compliance mapping", "PCI-DSS", "HIPAA", "SOC 2", "NIST CSF", "regulatory requirements", "compliance report", or needs to map security findings to compliance framework requirements.
version: 1.0.0

Compliance Framework Mapping

Purpose

Map VulnScout security findings to compliance framework requirements. This enables security teams to understand the regulatory impact of discovered vulnerabilities and prioritize remediation based on compliance obligations.

Supported Frameworks

PCI-DSS v4.0

Payment Card Industry Data Security Standard for organizations handling cardholder data.

| Requirement | Description | VulnScout Finding Types | |-------------|-------------|------------------------| | 6.2.1 | Secure development practices | All code-level findings | | 6.2.2 | Software security training | Recurring pattern findings | | 6.2.3 | Code review before release | Unverified findings in diff | | 6.2.4 | Prevent common vulnerabilities | sql-injection, xss, command-injection, path-traversal | | 6.3.1 | Identify vulnerabilities via scanning | All findings from /scan | | 6.3.2 | Maintain inventory of custom software | Framework detection results | | 6.4.1 | Public-facing web app protection | ssrf, xss, csrf, open-redirect | | 6.4.2 | Automated technical solution for web attacks | WAF findings, missing CSP | | 6.5.1-6.5.6 | Address common coding vulnerabilities | Injection, auth bypass, XSS, access control |

HIPAA Security Rule (45 CFR 164.312)

Health Insurance Portability and Accountability Act technical safeguards.

| Section | Description | VulnScout Finding Types | |---------|-------------|------------------------| | 164.312(a)(1) | Access Control | access-control, idor, business-logic | | 164.312(a)(2)(i) | Unique User Identification | auth-bypass, session fixation | | 164.312(a)(2)(iii) | Automatic Logoff | session management findings | | 164.312(a)(2)(iv) | Encryption at Rest | cryptographic-failures, hardcoded-secret | | 164.312(b) | Audit Controls | logging-failures | | 164.312(c)(1) | Integrity Controls | sql-injection, deserialization, ssti | | 164.312(c)(2) | Authentication of ePHI | auth-bypass, hardcoded-secret | | 164.312(d) | Person/Entity Authentication | auth-bypass, insecure-randomness | | 164.312(e)(1) | Transmission Security | cryptographic-failures, ssrf | | 164.312(e)(2)(i) | Integrity Controls (transmission) | ssti, xss, command-injection | | 164.312(e)(2)(ii) | Encryption in Transit | cryptographic-failures |

SOC 2 Trust Services Criteria

Service Organization Control 2 for SaaS and cloud service providers.

| Criteria | Description | VulnScout Finding Types | |----------|-------------|------------------------| | CC6.1 | Logical and Physical Access | access-control, idor, auth-bypass | | CC6.2 | Credential Management | hardcoded-secret, insecure-randomness | | CC6.3 | Access Roles and Responsibilities | access-control, business-logic | | CC6.6 | System Boundary Protection | ssrf, open-redirect, cors-misconfig | | CC6.7 | Data Flow Restrictions | path-traversal, xxe, deserialization | | CC6.8 | Malicious Software Prevention | command-injection, code-injection, ssti | | CC7.1 | System Monitoring | logging-failures, exception-handling | | CC7.2 | Anomaly Detection | insecure-randomness, race-condition | | CC7.3 | Security Event Evaluation | logging-failures | | CC7.4 | Incident Response | All critical/high findings | | CC8.1 | Change Management | Findings in diff (--since-commit) |

NIST Cybersecurity Framework (CSF) 2.0

| Function | Category | VulnScout Finding Types | |----------|----------|------------------------| | **Identify** | ID.AM - Asset Management | Framework detection, scope results | | **Identify** | ID.RA - Risk Assessment | Threat model, STRIDE analysis | | **Protect** | PR.AC - Access Control | access-control, idor, auth-bypass | | **Protect** | PR.DS - Data Security | sql-injection, path-traversal, cryptographic-failures | | **Protect** | PR.IP - Protective Processes | All remediated findings | | **Protect** | PR.MA - Maintenance | Diff-aware scan results | | **Detect** | DE.AE - Anomalies and Events | logging-failures, exception-handling | | **Detect** | DE.CM - Continuous Monitoring | /scan --since-commit results | | **Respond** | RS.AN - Analysis | Verified findings with evidence | | **Recover** | RC.IM - Improvements | Patch advisor recommendations |

Finding Type to Compliance Mapping

| Finding Type | PCI-DSS | HIPAA | SOC 2 | NIST CSF | |-------------|---------|-------|-------|----------| | sql-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS | | xss | 6.2.4, 6.4.1 | 164.312(e)(2)(i) | CC6.8 | PR.DS | | command-injection | 6.2.4 | 164.312(e)(2)(i) | CC6.8 | PR.DS | | path-traversal | 6.2.4 | 164.312(a)(1) | CC6.7 | PR.DS | | ssrf | 6.4.1 | 164.312(e)(1) | CC6.6 | PR.DS | | deserialization | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS | | ssti | 6.2.4 | 164.312(c)(1) | CC6.8 | PR.DS | | xxe | 6.2.4 | 164.312(c)(1) | CC6.7 | PR.DS | | access-control | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC | | auth-bypass | 6.5.3 | 164.312(d) | CC6.1 | PR.AC | | hardcoded-secret | 6.2.4 | 164.312(a)(2)(iv) | CC6.2 | PR.AC | | cryptographic-failures | 6.2.4 | 164.312(e)(2)(ii) | CC6.2 | PR.DS | | logging-failures | 6.2.4 | 164.312(b) | CC7.1 | DE.AE | | insecure-randomness | 6.2.4 | 164.312(d) | CC7.2 | PR.DS | | idor | 6.5.4 | 164.312(a)(1) | CC6.1 | PR.AC | | ldap-injection | 6.2.4, 6.5.1 | 164.312(c)(1) | CC6.8 | PR.DS |

Report Integration

When generating a compliance-aware report, use the `--compliance` flag:

/vuln-scout:report --compliance pci-dss,hipaa,soc2

This appends a Compliance Impact section to the report:

## Compliance Impact

### PCI-DSS v4.0
| Requirement | Status | Findings |
|-------------|--------|----------|
| 6.2.4 | FAIL | 3 injection findings |
| 6.4.1 | PASS | No public-facing web app finding