Compliance Posture — Shieldome Docs

What compliance posture mapping does

Every finding Shieldome produces is automatically tagged with the specific security controls it affects across four frameworks: SOC 2 Type II, ISO 27001:2022, GDPR Article 32, and PCI-DSS v4. The Compliance tab in scan results shows a control-by-control pass/fail/partial view so you can quickly identify which compliance obligations are at risk.

⚠️

Automated compliance mapping is a starting point and a useful audit-prep tool — it is not a substitute for a qualified auditor or a formal assessment. Controls marked as passing may still fail for organizational or process reasons outside the scanner's visibility.

Supported frameworks

Framework	Version	Controls mapped
SOC 2 Type II	2017 Trust Services Criteria	CC6, CC7, CC8, A1
ISO 27001	2022	A.5, A.8, A.9, A.10, A.12, A.14
GDPR	Article 32	Technical and organisational measures
PCI-DSS	v4.0	Requirements 2, 4, 6, 10, 11

Control status definitions

Status	Meaning
Pass	No findings linked to this control — the scanner found no evidence of failure
Partial	Medium or Low severity findings are linked — risk exists but exploitation requires specific conditions
Fail	Critical or High severity findings are linked — the control is likely not met
Not tested	The control requires data the scanner cannot obtain (e.g., access logs, HR policy documents)

Viewing compliance posture

From any completed scan, click the Compliance tab in the results view. A framework selector at the top lets you switch between SOC 2, ISO 27001, GDPR, and PCI-DSS. Each row shows: control ID, control name, status badge, and the specific findings that caused a Fail or Partial status (click to expand).

Compliance posture API

Retrieve the full posture mapping as structured JSON for integration into GRC tools, dashboards, or audit workflows:

bash

curl -H "X-Shieldome-Key: YOUR_API_KEY" \
     "https://yourdomain.com/api/scan/{id}/compliance-posture"

json — response structure

{
  "scan_id": "a1b2c3d4-...",
  "generated_at": "2026-06-14T10:07:42",
  "frameworks": {
    "soc2": {
      "pass": 18, "partial": 3, "fail": 1, "not_tested": 4,
      "controls": [
        {
          "id":       "CC6.1",
          "name":     "Logical and Physical Access Controls",
          "status":   "fail",
          "findings": ["Broken Access Control — Sensitive path exposed"]
        }
      ]
    },
    "iso27001": { // same structure },
    "gdpr":     { // same structure },
    "pcidss":   { // same structure }
  }
}

Sharing with auditors

Two options for giving auditors access to compliance data without sharing your API key:

Public share link

In any scan result, click Share → Generate public link. The link gives read-only access to the scan result and compliance tab, valid for 30 days. No login required for the recipient.

PDF and CSV export

Compliance data is included in both PDF reports (GET /api/scan/{id}/report) and CSV exports. The PDF includes a dedicated Compliance Summary section with control tables and linked findings. The CSV adds a compliance_flags column with a pipe-separated list of control IDs affected by each finding.

💡

For PCI-DSS Report on Compliance (RoC) preparation, use the scan diff API (GET /api/scan/{scan_a_id}/diff/{scan_b_id}) between two quarterly scans to show auditors the remediation work completed during the assessment period.