---
title: "Compliance"
description: "Track pentest coverage against SOC 2, PCI-DSS, HIPAA, and ISO 27001, keep evidence fresh with scheduled recurring scans, and export auditor-safe evidence packages."
canonical: https://turbopentest.com/docs/compliance
source: "TurboPentest Docs"
---

# Compliance

TurboPentest maps your pentests to the compliance frameworks auditors ask about, tracks whether your evidence is still fresh, and exports an auditor-ready evidence package on demand.

## Supported frameworks

| Framework | Default max age |
|-----------|-----------------|
| **SOC 2** | 365 days |
| **PCI-DSS** | 365 days |
| **HIPAA** | 365 days |
| **ISO 27001** | 365 days |

Each framework has a default **max-age of 365 days** - the window after which its evidence is considered stale. You can override the cadence per framework.

## Compliance dashboard

The dashboard gives you a per-framework view of where you stand:

- **Scope** - whether an asset or target is `in_scope`, `connected_to`, or `out_of_scope` for the framework
- **Staleness state** - `fresh`, `stale`, or `never_tested`, evaluated against the framework's max-age
- **Last scan date** and total **scan count**
- **Next scheduled scan** - the upcoming recurring pentest that will refresh evidence
- **Control mappings** - findings and coverage mapped to framework controls (for example ISO 27001:2022 Annex A, PCI-DSS, HIPAA §164.312, and SOC 2)
- **Per-framework and per-cadence overrides** - tune the max-age and scope defaults for your environment

An asset is `fresh` when it has been tested within the framework's max-age window, `stale` once that window lapses, and `never_tested` if no in-scope pentest has run yet.

## Evidence package export

Export a complete **evidence package** as a ZIP for your auditor. The package contains:

- `manifest` - contents and metadata for the package
- `assets.csv` - the in-scope assets
- `mapping.json` - control-to-finding mappings
- `override-history` - a record of framework and cadence overrides
- `scan-history` - past pentests and their outcomes
- `scheduled-scans` - the recurring scans that keep evidence current
- `methodology.md` - the testing methodology

CSV output is **auditor-safe** (formatted to avoid CSV injection and other spreadsheet hazards), so the package can be handed off as-is.

## Keeping evidence fresh

Compliance evidence goes stale the moment it ages past a framework's max-age. Two features keep it current:

- **Verified assets** - [cloud-verified and domain-verified assets](/docs/assets/cloud-easm) define your in-scope attack surface so coverage is measured against the real targets.
- **Scheduled recurring pentests** - schedule scans (daily, weekly, biweekly, monthly, or quarterly) so evidence is refreshed automatically before it expires. The dashboard's **next scheduled scan** column shows exactly when each framework's evidence will next be renewed.

Together, verified assets and recurring pentests keep every framework in the `fresh` state without manual effort.