Compliance reports

Compliance reports, and what they actually cover

Select the frameworks you care about when you start a scan. OnScanner evaluates the controls a scan from outside your network can actually reach, decides each one by rule rather than by model, and produces an auditor evidence binder that states its own limits before its findings.

Scan my site See credit pricing
+1 credit
per scan, flat
  • Covers every framework you select on that scan
  • Seven frameworks for the same 1 credit as one

Published coverage

What each framework's coverage actually is

This table is the reason to trust the rest of the report. Most tools that put a framework name on a page show you a percentage computed over the checks they happen to run, which is a statement about their own tool rather than about the standard. These percentages are computed over each framework's own enumeration: all 93 ISO Annex A controls, all 33 SOC 2 common criteria, all 18 HIPAA Security Rule standards, all 12 PCI DSS requirements.

They are low, and they are supposed to be. A scan from outside your network cannot read a policy, interview staff, or look at a change record.

  • SOC 218.2%
    33 common criteria (Security)
    Evaluated 6Needs your evidence 27
  • EU Cyber Resilience Act13.6%
    22 Annex I requirements
    Evaluated 3Needs your evidence 19
  • GDPR and ePrivacy12.5%
    40 obligations
    Evaluated 5Needs your evidence 35
  • HIPAA Security Rule11.1%
    18 standards
    Evaluated 2Needs your evidence 16
  • ISO/IEC 27001:20228.6%
    93 Annex A controls
    Evaluated 8Needs your evidence 85
  • PCI DSS v4.0.18.3%
    12 requirements
    Evaluated 1Needs your evidence 11
  • US state privacy (CCPA)0%
    11 business obligations
    Evaluated 0Needs your evidence 11

229 obligations across the seven frameworks. 25 are evaluated from scan data. The other 204 are listed as needing organizational evidence, and every one of them carries a sentence naming what the scan can contribute towards it, because a control listed with nothing beside it is indistinguishable from one nobody thought about.

Read the 0% row twice

US state privacy shows 0% and it is the framework OnScanner checks hardest. That is not a contradiction, it is what an honest denominator does.

The four Global Privacy Control checks in that framework, three of which are decided from scan data, each answer a named fraction of an obligation rather than the whole of one. Civil Code section 1798.135 offers a business two methods of limiting the sale and sharing of personal information, and the opt-out preference signal is one of them, so honoring the signal cannot by itself decide the section above it. Section 1798.120 reaches minors and opt-outs submitted through channels no external scan sees.

So all four appear in the control matrix and in the binder, with their own verdicts and their own evidence, and the denominator stays the statute. The four checks are what you are buying. The 0% is what stops the report claiming the statute.

A tool willing to print 100% there would be the one to distrust.

Deliverables

What you get

Two pages of an OnScanner auditor evidence binder: the cover, showing the target domain, a 4 minute scan, 7 frameworks assessed, 256 controls enumerated and 220 with no technical verdict, and the section 03 control matrix page, with the verdict vocabulary and EU Cyber Resilience Act controls marked policy, partial or pass with their citations and evidence counts.

The auditor evidence binder, as a PDF

Ordered scope, then limits, then the matrix, then the evidence. That order is deliberate: a binder that opens with what passed is exactly the marketing table the coverage ratio exists to replace, so the boundary of the exercise comes before any verdict. Section 02 lists every control the assessment did not technically evaluate and why.

The control matrix

One row per obligation in the framework's own enumeration and reading order, each with a status, a severity, the statutory citation, the evidence behind the verdict and the remediation step. A failing verdict has to rest on evidence the scanner was confident about; a tentative detection can inform a partial result and can never produce a failure.

Attributed evidence, not raw output

Each observation says what was seen and where, with enough detail for an auditor to recognize it and without pasting a response body, a session cookie or a secret the scanner happened to read.

A machine-readable export

The same matrix as versioned JSON over the API, so your own automation can depend on the shape. It also renders as the record body Vanta's custom-resource endpoint accepts, one record per control. You create the custom resource in your own Vanta dashboard and your automation does the sending: OnScanner builds the payload and never pushes to your account.

A compliance workspace in the app

The matrix per framework, filterable by status, with the coverage sentence and the grade's own scope rendered beside each other so neither number can be read without the other.

Decided by rules, not by a model

Every verdict in the matrix comes from a rule over scan evidence. The rule pack carries a version, and it travels with the assessment, so a matrix stored last month says which pack decided it and whether that is still the current one. Re-run the same scan through the same pack and you get the same matrix.

There is an AI layer on top, and it comes with the compliance add-on rather than with AI Findings: selecting compliance analysis is what runs it. It writes a plain-language narrative over the matrix, labeled in the app as AI-written commentary, and the verdicts, counts and grade shown beside it are the rule engine's. The narrative never changes a verdict.

Where your data goes. The scan engines never call an LLM. AI Findings (included) sends the scan's findings to the hosted AI provider to write the summary, the prioritized risks and the attack-chain analysis. Selecting compliance analysis also sends the rule engine's verdict matrix to the hosted AI provider for the plain-language narrative, and the narrative never changes a verdict. With both off, nothing is sent to an AI provider. The provider is contractually prohibited from training on your data. The control matrix itself is computed entirely inside OnScanner.

What this is not

  • It is not a certification, and not an audit opinion. A SOC 2 report is issued by a licensed CPA firm and an ISO 27001 certificate by an accredited body. This is evidence you bring to that process, and it is written to be handed to an assessor rather than to replace one.
  • A PCI DSS quarterly external scan needs an Approved Scanning Vendor. OnScanner is not one, and no report here substitutes for an ASV scan report. What it supports is the post-change rescanning in sub-requirement 11.3.2.1, which the standard allows qualified internal personnel to perform.
  • A grade over six controls is not a grade for the framework. Every score is rendered with its own basis and coverage in the same sentence, for exactly this reason. "SOC 2: B" on its own would be a claim no external scan can make, and no arithmetic fixes it, because the arithmetic is correct.
  • Coverage moves when the rule pack does. A stored assessment keeps the verdict it reached and says which pack reached it, so a re-run under a newer pack can legitimately differ from a report you filed. The version is on the cover of the binder and in the export.

Questions

What does a compliance assessment cost?

1 credit, added to the scan you run it on. The charge is flat: it covers every framework you select on that scan, so selecting all seven costs the same 1 credit as selecting one. An account owner or admin turns compliance reporting on in account settings.

Does OnScanner certify us against SOC 2 or ISO 27001?

No, and nobody can certify you from outside your network. An external scan reaches the technical controls a public endpoint exposes. OnScanner evaluates those, publishes the ratio of each framework it can reach, and lists every remaining control as needing organizational evidence with a sentence saying what the scan can contribute towards it.

Is the assessment generated by AI?

No. Every verdict in the control matrix is decided by rules over scan evidence, and the rule pack is versioned so the same scan re-evaluated by the same pack gives the same matrix. The scan engines never call an LLM. AI Findings (included) sends the scan's findings to the hosted AI provider to write the summary, the prioritized risks and the attack-chain analysis. Selecting compliance analysis also sends the rule engine's verdict matrix to the hosted AI provider for the plain-language narrative, and the narrative never changes a verdict. With both off, nothing is sent to an AI provider.

Why does the US state privacy framework show 0 percent?

Because a coverage ratio counts whole obligations, and the four Global Privacy Control checks OnScanner runs each answer a named fraction of one. Three of the four are decided from scan data and the fourth always lands in the needs-your-evidence bucket, and only the signal check can produce a failure at all. The CCPA offers a business two methods of limiting sale and sharing and the opt-out preference signal is one of them, so passing the signal check cannot decide the section above it. All four are in the matrix and in the binder. The 0 percent is what stops the report claiming the statute.

Running one

An account owner or admin turns compliance reporting on in account settings. Then tick the frameworks you want in the scan options before you start a scan, and the 1 credit are added to that scan's cost. The binder, the workspace and the export are all available as soon as the scan finishes.

Scan my site See credit pricing