Compliance Mapping Methodology
Mapping version 2026.07.25. This document explains how TurboPentest maps discovered cloud resources to compliance controls. It is the authoritative reference cited in every compliance evidence package we generate.
Authored and reviewed by IntegSec senior consultants. TurboPentest is a product of IntegSec, a penetration testing firm. The compliance mapping methodology is reviewed and updated by the same consultants who deliver IntegSec's manual pentest engagements. Current version reviewed Q2 2026.
Principles
- Mappings are resource-type driven - every resource of a given type pulls the same controls.
- Only controls that pentesting can provide evidence for are included. Policy, HR, and physical controls are deliberately excluded.
- PCI-DSS v4.0 Req 11.4.3 (external) vs 11.4.2 (internal) routing - formerly Req 11.3.1 / 11.3.2 under v3.2.1 - is based on exposure tier (public / edge / at-risk → 11.4.3 external, private → 11.4.2 internal).
- Scope overrides are per-user and logged as events.
- A verified domain with a completed external pentest additionally evidences the vulnerability-management controls that a black-box external test supports (SOC 2 CC7.1, ISO 27001 A.8.8, HIPAA 164.308(a)(1)). A domain with no completed pentest maps only to PCI-DSS 11.4.3 external scope and produces no other-framework evidence until it is tested. Web-app and secure-coding controls (SOC 2 CC6.1, PCI 6.5, ISO A.8.26 / A.8.28 / A.8.29) are intentionally excluded from a domain scan and are evidenced only by connected-repo source analysis.
Resource type → controls
| Resource | Exposure | Controls |
|---|---|---|
| alb | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| nlb | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| load-balancer | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| http-load-balancer | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| load_balancer | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| cloudfront-distribution | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| front-door | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| api-gateway | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| api-management | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| appsync-api | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| app | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| app-service | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| cloud-run | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| app-engine | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| elastic-beanstalk | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| vercel-project | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| netlify-site | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| replit-app | public | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.3 |
| spaces_cdn | public | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| rds-instance | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5.3, HIPAA: 164.312(a)(1), HIPAA: 164.312(e)(1), ISO 27001: A.5.15, ISO 27001: A.8.3, ISO 27001: A.8.8, ISO 27001: A.8.24, PCI-DSS: 11.4.2 |
| ec2-instance | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| virtual-machine | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| compute-instance | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| lightsail-instance | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| droplet | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| lambda-function | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.312(e)(1), ISO 27001: A.8.8, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| function-app | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.312(e)(1), ISO 27001: A.8.8, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| cloud-function | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.312(e)(1), ISO 27001: A.8.8, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| ecs-service | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5, HIPAA: 164.312(a)(1), HIPAA: 164.308(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.26, ISO 27001: A.8.28, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| opensearch-domain | private | SOC 2: CC6.1, SOC 2: CC7.1, PCI-DSS: 6.5.3, HIPAA: 164.312(a)(1), HIPAA: 164.312(e)(1), ISO 27001: A.5.15, ISO 27001: A.8.3, ISO 27001: A.8.8, ISO 27001: A.8.24, PCI-DSS: 11.4.2 |
| aks-cluster | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| gke-cluster | private | SOC 2: CC6.1, SOC 2: CC6.6, PCI-DSS: 2.2, HIPAA: 164.312(a)(1), HIPAA: 164.310(a)(1), ISO 27001: A.8.8, ISO 27001: A.8.9, ISO 27001: A.8.29, PCI-DSS: 11.4.2 |
| static-web-app | edge | SOC 2: CC6.6, HIPAA: 164.312(e)(1), ISO 27001: A.8.20, ISO 27001: A.8.24, PCI-DSS: 11.4.3 |
| route53-zone | edge | PCI-DSS: 11.4.3 |
| dns-zone | edge | PCI-DSS: 11.4.3 |
| cloud-dns-zone | edge | PCI-DSS: 11.4.3 |
| domain | edge | PCI-DSS: 11.4.3 |
Changelog
v2026.07.25 - 2026-07: A verified domain with a completed external pentest now evidences SOC 2 CC7.1, ISO 27001 A.8.8, and HIPAA 164.308(a)(1) in addition to PCI-DSS 11.4.3; untested domains remain PCI-scope only. 2026-05: Updated PCI DSS references to v4.0 numbering - Req 11.4 replaces v3.2.1 Req 11.3 sitewide (11.4.3 external / 11.4.2 internal / 11.4.5 segmentation). 2026-04: Added PCI DSS Req 11.4.5 internal-segmentation scope note; compliance mapping PDF download added. Initial published mapping; added ISO 27001, fixed PCI external/internal routing, added at-risk exposure tier routing.
Last reviewed: Q2 2026