COMPLIANCE AUDITING

ComplianceAuditor

Pentester Sidekick

Automated compliance gap analysis across 11 frameworks in one engagement binary. NIST CSF, ISO 27001, PCI-DSS, GDPR, HIPAA, ISO 22301, ISO 31000, ISO 9001, ISO 45001, COBIT, TOGAF, and PMBOK. Evidence collection, control mapping, remediation priority scoring. Framework-agnostic architecture for extensibility.

v1.0.0 Debian/Kali x86-64 11 Frameworks
Read the Docs → See Frameworks
// supported standards

Eleven Compliance Frameworks

Built-in support for 11 industry-standard frameworks covering security, risk management, quality, business continuity, architecture, and project management. Extensible plugin architecture means you can add more frameworks without modifying the engine.

NIST CSF 2.0
Cybersecurity Framework
US federal cybersecurity guidance. Covers identify, protect, detect, respond, recover + govern. Risk management backbone for critical infrastructure.
6 functions + 23 categories
ISO 27001:2022
Information Security Management
International standard for ISMS. Covers risk management, asset classification, access control, incident response, business continuity, third-party risk.
114 controls across 14 domains
PCI-DSS 4.0
Payment Card Industry Data Security
Payment processor compliance. Covers cardholder data handling, network security, access controls, encryption, regular testing, vulnerability management.
212 controls across 12 requirements
GDPR
General Data Protection Regulation
EU data protection law. Covers lawful basis, consent, subject rights, breach notification, data processing agreements, DPA requirements, privacy by design.
99 control areas across 11 chapters
HIPAA Security Rule
Health Insurance Portability & Accountability
US healthcare data protection. Covers PHI handling, access controls, encryption, audit controls, breach notification, business associates, workforce security.
164 controls across 3 technical rule categories
ISO 22301:2019
Business Continuity Management
BCMS standard for resilience. Covers business continuity strategy, crisis management, disaster recovery, supply chain resilience, testing & exercises.
78 controls across 8 clauses
ISO 31000:2018
Risk Management
Risk management principles & framework. Covers risk identification, assessment, treatment, communication, stakeholder engagement, continuous improvement.
Principles-based + 11 process steps
ISO 9001:2015
Quality Management System
QMS standard for consistent products/services. Covers process management, customer focus, leadership, resource management, performance evaluation, continual improvement.
49 requirements across 7 clauses
ISO 45001:2018
Occupational Health & Safety
OH&S management system. Covers hazard identification, risk assessment, worker engagement, incident reporting, legal compliance, emergency preparedness.
47 requirements across 7 clauses
COBIT 2019
Control Objectives for IT
IT governance & management. Covers governance system, goal cascade, stakeholder needs, process reference model, enablers for IT performance.
40 governance objectives + 62 management practices
TOGAF 10
The Open Group Architecture Framework
Enterprise architecture methodology. Covers ADM (Architecture Development Method), architecture governance, stakeholder management, capability assessment, architecture reuse.
ADM phases + 9 architecture domains
PMI / PMBOK 7
Project Management Body of Knowledge
Project management standard. Covers project performance domains, value delivery, stakeholder management, change control, risk management, resource allocation.
12 domains + 8 performance principles
// capabilities

One Binary, All Frameworks

Automated evidence collection, control mapping, gap analysis, and auditor-ready reporting — across all eleven frameworks from a single engagement tool.

📋 Evidence Collection

Automated network scanning, host config audits, log analysis, policy review. Framework-mapped evidence automatically grouped to relevant controls.

🗺️ Control Mapping

Link findings to controls across all 11 frameworks. See which requirements are met, which need work, which are at risk from this finding.

📊 Gap Analysis

Identify missing controls. Remediation priority scoring by risk, business impact, and implementation effort. Compliance roadmap generation.

📑 Professional Reports

Auditor-ready evidence packs, executive summary, control-by-control remediation guidance, timeline estimates, cost modeling.

🔄 Multi-Framework Delta

Compare controls across frameworks. See which controls satisfy multiple standards. Optimize remediation by tackling control families that satisfy multiple frameworks.

🔌 Extensible Architecture

Framework plugin system. Add new standards without touching core logic. Contribute frameworks back to the community.