Compliance Mapping Methodology

Principles

• Mappings are resource-type driven - every resource of a given type pulls the same controls.
• Only controls that pentesting can provide evidence for are included. Policy, HR, and physical controls are deliberately excluded.
• PCI-DSS v4.0 Req 11.4.3 (external) vs 11.4.2 (internal) routing - formerly Req 11.3.1 / 11.3.2 under v3.2.1 - is based on exposure tier (public / edge / at-risk → 11.4.3 external, private → 11.4.2 internal).
• Scope overrides are per-user and logged as events.
• A verified domain with a completed external pentest additionally evidences the vulnerability-management controls that a black-box external test supports (SOC 2 CC7.1, ISO 27001 A.8.8, HIPAA 164.308(a)(1)). A domain with no completed pentest maps only to PCI-DSS 11.4.3 external scope and produces no other-framework evidence until it is tested. Web-app and secure-coding controls (SOC 2 CC6.1, PCI 6.2.4, ISO A.8.26 / A.8.28 / A.8.29) are intentionally excluded from a domain scan and are evidenced only by connected-repo source analysis.
• Secure-coding controls (PCI DSS 6.2.4, ISO 27001 A.8.28 / A.8.29) attest to practice in source code, so they are credited to an asset only when white-box source-analysis evidence exists - a black-box scan alone does not evidence them.
• Only technical safeguards a test can evidence are mapped. HIPAA physical safeguards (e.g. 164.310 Facility Access Controls) are excluded from every technical mapping.
• PCI DSS v4.0 Req 6.4.1 (public-facing web applications are reviewed for vulnerabilities) is evidenced by our external pentest for public-facing web apps and tested domains. Req 6.4.2 (an automated technical solution / WAF) is not claimed - we detect a WAF but are not one, so WAF detection is reported only as an observation, not as evidence the control is satisfied.

Resource type → controls

Changelog

v2026.08.12 - 2026-08: Corrected PCI DSS secure-development references to v4.0 numbering (Req 6.2.4; the prior 6.5 / 6.5.3 citations were stale v3.2.1 numbers); removed HIPAA 164.310(a)(1) (a physical Facility Access Control) from the VM/network mapping; secure-coding controls now require white-box source-analysis evidence; scope and cadence changes are recorded in append-only audit logs and out-of-scope assets are disclosed in the evidence package. 2026-07: A verified domain with a completed external pentest now evidences SOC 2 CC7.1, ISO 27001 A.8.8, and HIPAA 164.308(a)(1) in addition to PCI-DSS 11.4.3; untested domains remain PCI-scope only. 2026-05: Updated PCI DSS references to v4.0 numbering - Req 11.4 replaces v3.2.1 Req 11.3 sitewide (11.4.3 external / 11.4.2 internal / 11.4.5 segmentation). 2026-04: Added PCI DSS Req 11.4.5 internal-segmentation scope note; compliance mapping PDF download added. Initial published mapping; added ISO 27001, fixed PCI external/internal routing, added at-risk exposure tier routing.

Last reviewed: August 2026