Cookie settings

Choose which cookies this site may set. You can change this at any time from cookie settings in the footer.

Strictly necessary

Remember this choice and protect the site and its forms from attacks and bots. The site cannot run without them.

Always on
Every cookie, listed
NxSCORE

Compliance, proved control by control.

Every requirement in every framework you answer to: checked where it can be, evidenced where it cannot, and kept current between audits instead of rebuilt before them.

CNAPPs cover a slice of each framework.

We analysed the leading CNAPPs, requirement by requirement, against the major frameworks. The story was the same for every one of them, in every cloud: their policies answer only a small part of each framework. The rest needs other checks, or evidence a scanner cannot collect.

Each requirement, counted once, by how it is coveredResults shown: one of the top CNAPPs, October 2026
  • PCI DSS 4.0.1249 requirements
  • ISO 27001:202293 requirements
  • NIST CSF 2.0106 requirements
  • CIS AWS 7.070 requirements

Nothing in PCI DSS or ISO 27001 is fully automated. PCI requirements also reach operating systems, databases, applications and identity; ISO controls are management-system controls that need a documented policy and proof it runs.

The same data-centre campus under a clear sky, the NxSCORE sign lit

Checked where it can be. Evidenced where it cannot.

How every requirement is met.

Each requirement says how it is answered and, where checks are not enough, why. One status tells you where it stands, and a failure found by your CNAPP and by NxSCORE counts once.

  • 1AutomatedChecks answer the requirement on their own, from your cloud’s configuration.
  • 2Automated, plus evidenceChecks cover the cloud; evidence covers the rest, such as the operating system or the process.
  • 3Evidence onlyNo check can see it. A document, a review or a record answers it.
Every requirement shows one status
  • Met
  • Met by compensating control
  • Failing
  • Evidence needed
  • In review
  • Not assessed
PCI DSS 4.0.1Met

Inbound traffic to the cardholder data environment is restricted.

How it is metAutomated, plus evidence
Why checks are not enoughFirewalls outside AWS are in scope too
NxSCORE checks4 ran, 0 failing resources
CNAPP policies2 mapped, 0 failing
Counted onceDuplicates merged by account and resource
EvidenceNetwork diagram and firewall review
Accepted byNxSCORE analyst, valid to end of quarter + 30 days

Upload once. Count everywhere.

One approved document often answers several frameworks. NxSCORE knows which requirements share evidence, so your team uploads it once and every framework that asks for it is answered.

One upload: the approved information security policyCounts for 3 frameworks
  • PCI DSSThe information security policy is established, published and kept current
  • ISO 27001Policies for information security are defined and approved
  • NIST CSFThe organisation’s cybersecurity policy is established and communicated
Before acceptingYour analyst sees every requirement it will meet
Across versionsCounts for the same requirement in other versions too
  1. UploadedYour team writes it up and attaches the documents.Your team (maker)
  2. ReviewedYour analyst accepts it, returns it with a reason, or rejects it.NxSCORE analyst (checker)
  3. CountedIt counts to the end of the quarter, plus 30 days of grace.NxSCORE
  4. RenewedThe daily assessment tells you when it falls due. Lapsed evidence stops counting.Your team and analyst

Fix these first.

Every failing check behind a requirement is ranked by how many requirements it is the only thing holding back. Fix the top of the list and whole sections turn green.

Frameworks in scope: PCI DSS, ISO 27001Example estate
Failing checkRequirements it alone holds backRequirements it contributes to
CloudTrail log file validation off in 3 accountsClears 914
Root account used in the last 90 daysClears 611
Security groups open to the internet on admin portsClears 417

Wherever you are regulated.

From ISO 27001 to the regulator in your market. Each framework keeps its own deadlines, and evidence is shared wherever requirements overlap.

  • Global
    • ISO 27001
    • SOC 2
    • PCI DSS
    • CIS
    • CSA CCM
  • Americas
    • NIST CSF
    • NIST 800-53
    • HIPAA
  • Europe
    • DORA
    • NIS2
    • GDPR
  • Middle East
    • SAMA CSF
    • NCA ECC
  • Asia-Pacific
    • MAS TRM
    • APRA CPS 234
  • India
    • RBI
    • IRDAI
    • SEBI CSCRF
    • CERT-In

Built in for India’s regulators.

The rules that shape a cloud security programme in India, already set up: deadlines become fix-by dates on every finding, and exceptions go to the person allowed to approve them.

  • RBI

    Banks, NBFCs and other regulated entities
    Fix-by
    Time-bound, set by your own policy
    Reporting
    Cyber risk and closure status to committees, at least quarterly
    Cloud
    Secure configuration, monitoring and data in India where it applies

  • IRDAI

    Insurers and insurance intermediaries
    Fix-by
    High-risk gaps in 30 days, then re-validated; medium and low in 60
    Exceptions
    Up to 3 months by the CISO, longer by the risk committee, over a year by the Board
    Logs
    180 days, kept in India

  • SEBI CSCRF

    Brokers, depositories, AMCs and market infrastructure
    Fix-by
    VAPT and audit findings in 3 months; patches by category
    Open past 3 months
    Needs IT committee approval
    Inventory
    Cloud assets updated within 3 working days of a change

See your own gap.

Connect one account with a read-only role. Your NxSCORE analyst maps it to the frameworks you answer to and shows what your CNAPP covers, what it does not, and the evidence still missing.

Get a free cloud assessmentSee the platform