Automatic framework mapping
Every vulnerability is auto-linked to relevant controls across DORA (EU 2022/2554), NIS2 (EU 2022/2555), ISO 27001:2022, SOC 2 Type II, PCI DSS 4.0, HIPAA Security Rule, GDPR, NIST 800-53 Rev 5, and CIS Controls v8.
Audit evidence,
organised
DORA, NIS2 Article 21, ISO 27001 Annex A. Findings mapped to controls. Tamper-evident history. SHA-256 verification. Auditor packs on demand.
Read-only access Tamper-evident audit evidence EU data residency
The problem
Auditors want evidence
Show what you scanned, how you handled findings, and whether fixes were confirmed. Bring remediation records and integrity checks to the same review, without rebuilding the evidence from separate tools each audit cycle.
The fix
Nine frameworks, one map
Findings auto-link to relevant controls across nine frameworks. Track compliance scores and export auditor packs with verification results. Mapping supports evidence preparation, not certification. The same mapped evidence answers a customer security questionnaire instead of a one-off spreadsheet.
Example finding
Weak cipher detected
- DORAEU 2022/2554
Art. 9 - NIS2EU 2022/2555
Art. 21(2)(e)Art. 21(2)(h) - ISO 270012022 Annex A
A.8.8A.8.24 - SOC 2Type II · TSC
CC7.1 - PCI DSSv4.0
6.3 - HIPAASecurity Rule
§164.312(e)(1)§164.308(a)(1) - GDPR2016/679
Art. 32(1)(b)Art. 32(1)(d) - NIST 800-53Rev 5
RA-5SC-8 - CIS Controlsv8
7.17.2
The core controls Vornin maps one high-severity TLS finding to, per framework. Findings from other scan types land on the controls they touch.
Live compliance scores + 90-day trend
Per-framework coverage % updates as findings are opened and closed. Daily snapshots build a 90-day score chart for every selected framework.
Per-finding auditor ZIP
Download a per-finding ZIP with history and mappings in JSON, comments, evidence, attestations, and SHA-256 verification results.
SLA evidence
Show remediation performance against your SLA targets. MTTR and SLA compliance charts help explain resolved work and missed deadlines in your audit review.
Full audit log
Review workspace activity on Team and above. Share auditor-pack exports on Business and Scale.
Bring your own scans
Import Nessus / OpenVAS / CSV / JSON to fold external scans into the same compliance pipeline and the same evidence chain. One system of record.
Mappings as CSV or JSON
Export a control-by-control table with status, open-finding counts, and finding titles. CSV or JSON, on demand from each framework page.
Honest scoring + coverage gaps
Review missing scan coverage alongside controls that need manual attestation. Governance, training, third-party risk, and business continuity require your team's evidence. See the scan types you have not run and the controls they can help assess.
Regulatory coverage
DORA, NIS2, and seven more, pre-mapped
Keep vulnerability evidence organised by the framework your assessor uses. Review relevant control mappings, remediation progress, and supporting records together, so your team can answer evidence requests with context.
- EU regulationNew
DORA: EU 2022/2554
Map vulnerability findings to DORA ICT risk management and resilience-testing controls. Bring remediation evidence to the review alongside your governance, incident-management, and third-party-risk records.
Read the full DORA compliance guide → See Vornin's DORA evidence workflow →
- EU directiveNew
NIS2: EU 2022/2555
Network and Information Security Directive 2. Article 21 risk-management measures spanning asset management, supply-chain security, encryption, and incident handling, mapped to scanner controls and SLA evidence.
Read the full NIS2 compliance guide → See Vornin's NIS2 evidence workflow →
- Certifiable standard
ISO 27001:2022
The Annex A technological controls your vulnerability data can evidence: A.8.8 vulnerability management, network security, cryptography, and secure development, cross-walked to scan types.
- Attestation
SOC 2 Type II
Trust Services Criteria mapped to scanner output. Useful for software vendors approaching first audit, often paired with ISO 27001.
- Industry standard
PCI DSS 4.0
Requirements 6 (secure development) and 11 (testing) cross-mapped to web, network and code findings.
- US regulation
HIPAA Security Rule
HIPAA Security Rule: vulnerability and remediation evidence alongside organisational and physical safeguards.
- EU regulation
GDPR (2016/679)
Support Article 32 security reviews with remediation evidence. Article 33 breach notification needs a separate process.
- US security standard
NIST 800-53 Rev 5
Control families RA, SI, CM cross-walked. Useful for federal-adjacent and US-export buyers.
- US security standard
CIS Controls v8
The controls continuous scanning can evidence include vulnerability management, secure configuration, and network monitoring. Included in Free's framework preview and paid plans.
Tamper-evidence
Give auditors records they can check
Bring finding history and remediation evidence to the same audit review. Every plan records tamper-evident history with SHA-256 verification. Business and Scale add auditor-pack exports with verification results, so your assessor can review the record's integrity alongside the evidence of a fix.
- Chain
Verifiable finding history
Review status changes in a tamper-evident history with SHA-256 verification. Give your auditor a record they can check alongside the evidence of remediation.
- Log
Consistent finding history
Keep finding updates together in one tamper-evident record, ready for your next audit review.
- Note
Remediation history
Review dated status changes alongside comments and supporting evidence, so your assessor can follow how a finding was handled.
- Verify
Verify before exportVerification checks the integrity of recorded history. It does not independently confirm that a vulnerability was fixed. Review the remediation evidence alongside the integrity result.
Run history verification on demand and include the result in the auditor pack. Your assessor can review the integrity check alongside the finding's evidence.
Pack
Audit evidence pack
Export a ZIP with finding history, comments, mappings, and evidence, or a PDF for the whole workspace. Both exports are available on Business and Scale.
Every plan: finding history is hashed into the tamper-evident chain. Per-finding auditor ZIP and tenant-wide auditor PDF unlock on Business and Scale. Built for buyers under NIS2, DORA, and ISO 27001 audit pressure. See where NIS2 and ISO 27001 overlap.
Audit readiness
Keep the audit programme current
Evidence is only useful when it reflects the programme you run today. Vornin keeps readiness checks, policy records, scan cadence, and accepted risks tied to live configuration and finding state.
Eight checks before the auditor asks
An eight-item audit-readiness checklist surfaces incomplete evidence and programme gaps before they become audit findings.
Evidence-pack PDF
On Business and above, export the audit-readiness evidence pack as a PDF.
A policy generated from live configuration
Generate a reviewable vulnerability management policy from workspace settings on Business and Scale.
Quarterly management-review record
Quarterly management-review PDF for sign-off on Business and Scale.
Scan cadence monitored per target
Configured cadence gaps flag PCI DSS 11.3, HIPAA §164.308(a)(8), DORA's weekly scanning rule for assets supporting critical functions, and NIS2 Article 21(2)(f) mappings for review.
Risk acceptance with an expiry
Record the reason, approver, and review date. When the acceptance expires, the finding reopens automatically.
Get started
Vulnerability management with remediation and proof built in
Every finding on a persistent record, from scan to confirmed fix and mapped to your technical controls.
Read-only access Tamper-evident audit evidence EU data residency