Compliance Attestation Report
Framework-oriented control mapping for audit and governance workflows
achieveradarsh/Data_Ingestion_Tool | 7/18/2026, 3:55:58 PM
70%
Ready With ConditionsRecommendation: Deploy after fixing: Authentication.
0Critical
0High
0Medium
4Low
Framework Mapping
| Framework | Mapped Controls | Status |
|---|---|---|
| OWASP Top 10 | A01 Broken Access Control, A05 Security Misconfiguration, A06 Vulnerable Components | Partial |
| CIS Controls | Secure configuration, vulnerability management, audit logging | Needs Work |
| NIST CSF | Identify, Protect, Detect, Respond, Recover | Mapped |
| SOC 2 | Security, availability, confidentiality evidence | Partial |
| ISO 27001 | Risk treatment, access control, operational security | Partial |
| PCI DSS | Dependency risk, secrets handling, secure transmission | Partial |
| GDPR | Data exposure, access control, retention and privacy signals | Initial |
Control Evidence Summary
#1
Suite 11 - Infrastructure as Code
WARN | low
No Terraform, Kubernetes, Helm, or Docker Compose files were found.
- Engine
- Infrastructure
- Evidence
- {}
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#2
Suite 12 - CI/CD Security
WARN | low
No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.
- Engine
- Infrastructure
- Evidence
- {}
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#3
Suite 10 - Container Security
WARN | low
No Dockerfile was found, so container security checks could not run.
- Engine
- Infrastructure
- Evidence
- { "dockerfiles": [] }
- Recommendation
- Review the finding, validate exploitability, implement the control, and re-run the relevant validation suite.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline
#4
Suite 13 - Network Readiness
WARN | low
No network configuration files or authorized runtime target were provided.
- Engine
- Infrastructure
- Evidence
- { "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.", "weakTls": false, "openPorts": [], "hasDnsConfig": false, "scannedFiles": [], "publicExposure": false, "hasReverseProxy": false, "hasCertificateFiles": false }
- Recommendation
- Enforce authentication middleware, validate tokens server-side, and add object-level authorization tests.
- References
- OWASP ASVS, CWE mapping pending, organization policy baseline