Compliance evidence pack
Map Umbra's data to specific SOC 2, ISO 27001, NIS2, and GDPR Article 32 control IDs and hand the artifact to your auditor (no spreadsheet reconciliation).
Last updated Jun 1, 2026
What it is
A generated artifact that maps Umbra’s existing data (assets, scans, findings + their lifecycle, audit log entries, AI validation runs) to specific control IDs from the compliance framework you’re being audited against. Output is a branded print-ready HTML (browser Print → Save as PDF) plus a Markdown export.
What it produces
For each supported framework, a pack containing:
- Cover page with org name, framework + version, period, and the operator who generated it.
- About / Scope / Not included: the pack is honest about what Umbra does and doesn’t cover. An auditor reading this shouldn’t think “everything we do.” They should see exactly which controls Umbra addresses, leaving the rest for the customer’s own ISMS.
- Summary: assets monitored, scans in period, findings opened / closed, MTTR, AI runs, audit-log entries.
- Per-control sections with:
- The verbatim control ID + name from the framework
- The control text
- How Umbra addresses this: copy that survives auditor scrutiny
- Quantitative evidence (metrics scoped to the period)
- Sample findings (3-5 examples) where the control benefits from concrete cases
Frameworks supported
- SOC 2 Trust Services Criteria (AICPA): 6 mapped controls from CC6 (logical access) + CC7 (vulnerability management)
- ISO/IEC 27001:2022 Annex A: 5 mapped controls from A.5 (organisational) + A.8 (technological)
- NIS2 Article 21(2) (EU): 5 mapped paragraphs from the cybersecurity risk management measures list
- GDPR Article 32: Security of processing (EU): 4 mapped paragraphs covering the technical and organisational measures obligations most often cited in DPAs + customer questionnaires
Adding a new framework is a code review, not a config edit.
Mappings live in internal/compliance/frameworks.go.
What to use it for
- Procurement / vendor security review: prospect’s auditor emails a SOC 2 questionnaire; you reply with the evidence pack in 5 minutes.
- SOC 2 / ISO audits: hand the auditor a structured artifact during the vulnerability-management section of the engagement instead of screenshots of dashboards.
- NIS2 readiness assessment for EU operations.
- Cyber-insurance renewal evidence.
Why it matters
The auditor’s most common request is “show me how you do vulnerability management.” Without this pack, the answer is “here are some screenshots of our scanner”. With it, you hand over a structured document that maps to the specific control IDs the auditor is grading against (same data the dashboard shows, just framed for the audit).
Why it’s valuable
- Honest scope. Each framework’s “Not included” section makes clear which controls Umbra doesn’t address, no risk of an auditor catching an overclaim.
- Auditable formula. Every metric on the pack is computed by the same SQL the dashboard uses; no separate “compliance ETL” pipeline that could drift.
- Period-bounded. Pick the audit window (typically the last 12 months); the pack uses that exact window for every metric.
- Same renderer as the executive report. Browser-native Print → Save as PDF: no PDF generator dependency, identical rendering across browsers.
- Markdown export. Same content, plain text, for systems that want to ingest it (GRC tools, audit-tracking spreadsheets).
- org_admin-gated. Attestation-shaped artifacts shouldn’t leave the workspace without admin sign-off.
What’s covered (control mapping summary)
SOC 2
| Control | What Umbra addresses |
|---|---|
| CC7.1 | Detection and monitoring of new vulnerabilities |
| CC7.2 | Anomaly identification and response |
| CC7.3 | Evaluation of security events (lifecycle + MTTR) |
| CC7.4 | Incident response: AI exploit validation + ticketing |
| CC6.1 | Logical and physical access controls (RBAC + audit log) |
| CC6.6 | Restriction of access to information assets |
ISO 27001
| Control | What Umbra addresses |
|---|---|
| A.5.7 | Threat intelligence (CVE + KEV feeds) |
| A.5.27 | Learning from information security incidents |
| A.8.8 | Management of technical vulnerabilities |
| A.8.15 | Logging (audit log) |
| A.8.16 | Monitoring activities |
NIS2
| Article | What Umbra addresses |
|---|---|
| 21(2)(a) | Policies on risk analysis |
| 21(2)(b) | Incident handling |
| 21(2)(e) | Vulnerability handling and disclosure |
| 21(2)(f) | Effectiveness of cybersecurity measures (MTTR + trend) |
| 21(2)(g) | Basic cyber hygiene practices |
GDPR Article 32
| Paragraph | What Umbra addresses |
|---|---|
| 32(1)(b) | Ongoing confidentiality / integrity / availability / resilience |
| 32(1)(d) | Regular testing + evaluating effectiveness of measures |
| 32(2) | Risk assessment: appropriate level of security per asset |
| 32(4) | Access by persons under authority: RBAC + audit log |
How to use it
- Compliance in the left nav.
- Pick a framework (cards show scope + what’s not included so you can confirm fit before generating).
- Pick a period (30 days / Quarter / Year-to-date / Custom).
- Preview below to inspect in the dashboard, then Print / PDF or Markdown to export.