Compliance & SOC 2 Mapping
How RiskShelter connects perimeter findings to the audit controls that matter for SOC 2 and ISO 27001.
Continuous external security testing is a hard requirement for most modern compliance frameworks, and auditors increasingly expect evidence that it's actually happening, not just a policy document that says it should be.
SOC 2 Trust Services Criteria
RiskShelter maps perimeter findings to the AICPA TSC controls relevant to external attack surface management:
CC6.1 & CC6.6 (Logical Access & Boundary Protection): validates that administrative interfaces and databases are not publicly reachable.
CC7.1 & CC7.2 (Vulnerability Management & Threat Detection): provides ongoing evidence of vulnerability identification and remediation tracking.
CC6.7 (Data Transmission Security): verifies TLS enforcement, HSTS, and certificate validity across all endpoints.
ISO/IEC 27001:2022
A.8.8 (Management of Technical Vulnerabilities): continuous CVE discovery and assessment against your external assets.
A.8.20 (Network Security): port filtering, service controls, and perimeter boundary verification.
A.8.24 (Use of Cryptography): cipher suite auditing and key length validation across all SSL/TLS endpoints.
Getting evidence for auditors
Every scan produces a timestamped record. The PDF report export includes your full assessment history, asset inventory, and control mappings in a format auditors can act on directly, with no manual spreadsheet compilation needed.