Every framework, proved requirement by requirement.
How each framework is met in your cloud: what a CNAPP policy covers, what only NxSCORE checks, and what needs evidence a person provides. Then India’s regulators, deadline by deadline.
You will recognise this if
- Your CNAPP’s compliance score looks healthy, and the auditor’s list is mostly things it never checks.
- The same evidence is gathered again for every framework and every audit.
- Nobody can say which evidence will be out of date on the day the auditor arrives.
- A new version of a framework arrives, and the mapping starts again.
How much of each framework a CNAPP covers.
The product team reviewed one widely used CNAPP’s AWS policies against every requirement, and kept only those that really evidence it. Each requirement is counted once.
| Framework | Requirements | A CNAPP policy | NxSCORE only | Evidence only |
|---|---|---|---|---|
| PCI DSS 4.0.1 | 249 | 18 | 91 | 140 |
| ISO 27001 2022 | 93 | 26 | 26 | 41 |
| SOC 2 Type 2 | Mapped by criteria series: cloud checks plus evidence for access, operations and change, evidence for the rest | |||
| NIST CSF 2.0 | 106 | 16 | 21 | 69 |
| CIS AWS Foundations 7.0 | 70 | 53 | 17 | 0 |
PCI DSS 4.0.1 in the cloud, requirement by requirement.
A CNAPP checks the settings it has policies for. Your assessor asks about all 249 requirements. NxSCORE shows how each one is met in your cloud, and what still needs a person to prove it.
You will recognise it
- Your CNAPP’s PCI DSS score looks healthy, and the assessor’s request list is mostly things it never checks.
- Requirement 12 policies, key retirement records and code reviews sit in different folders, owned by different teams.
How it is met
Every PCI DSS requirement also covers layers no cloud API can see: operating systems, databases, applications and the identity provider. So none is settled by checks alone.
Versions
NxSCORE keeps 4.0.1, and 4.0 and 3.2.1 for history. Evidence accepted for a requirement counts for the same requirement in the other versions.
- A CNAPP policy counts towards it18
NxSCORE checks it too, and counts a failing resource once.
- Only NxSCORE checks cover it91
A setting can be tested, but no CNAPP policy does.
- Only evidence can show it140
Policies, reviews, records and systems outside the cloud.
- 1.2.6 Insecure services, protocols and ports are mitigatedCNAPP policy and NxSCORE checks
Checks find insecure ports open on AWS; the documented risk and its mitigation, and systems outside AWS, need evidence.
- 6.4.2 Web attacks on public-facing applications are detected and blockedNxSCORE checks only
Checks show the web application firewall is attached and logging; evidence shows its rules are current.
ISO 27001:2022 in the cloud, control by control.
Annex A has 93 controls, and most are about how you run security, not how a setting is configured. NxSCORE shows which ones your cloud already answers, and collects the rest once.
You will recognise it
- Your certification audit is booked, and the cloud part is a folder of screenshots.
- The same access review is gathered for ISO 27001, for PCI DSS and for a customer’s questionnaire.
How it is met
ISO 27001 is a management system. Even a technological control in A.8 needs the documented policy and proof that it runs, so checks count towards a control without settling it.
Versions
NxSCORE keeps 2022, and 2013 with all 114 of its Annex A controls for history. Evidence carries to the same control in the other version.
- A CNAPP policy counts towards it26
NxSCORE checks it too, and counts a failing resource once.
- Only NxSCORE checks cover it26
A setting can be tested, but no CNAPP policy does.
- Only evidence can show it41
Policies, reviews, records and systems outside the cloud.
- A.8.4 Access to source codeCNAPP policy and NxSCORE checks
Checks cover code in the cloud account; most source code lives in external repositories, shown by their access lists and reviews.
- A.5.7 Threat intelligenceNxSCORE checks only
Checks show threat-feed detection is on; evidence shows intelligence is analysed and acted on.
SOC 2 in the cloud, criterion by criterion.
Your auditor tests whether controls worked across the whole period, not on the day. NxSCORE checks the cloud side of the Trust Services Criteria every day, and keeps the evidence for the rest with its dates.
You will recognise it
- A customer asked for your SOC 2 report before they sign, and the audit period has already started.
- Access reviews, change approvals and onboarding records are spread across tools and inboxes.
How it is met
Security, the common criteria, is in every SOC 2 report. Availability, processing integrity, confidentiality and privacy are added when your commitments to customers call for them.
Versions
For a Type 2 report the period matters: NxSCORE keeps every daily result and every accepted item with its date, so the record covers the whole period, not one day.
| CC1 Control environment | Evidence only |
|---|---|
| CC2 Communication and information | Evidence only |
| CC3 Risk assessment | Evidence only |
| CC4 Monitoring activities | Cloud checks plus evidence |
| CC5 Control activities | Evidence only |
| CC6 Logical and physical access | Cloud checks plus evidence |
- CC6.1 Logical access to systems and data is restrictedCloud checks plus evidence
Checks cover IAM, MFA, keys and encryption in the cloud; the access policy and the identity provider need evidence.
- CC7.2 Systems are monitored for anomalies and attacksCloud checks plus evidence
Checks show logging, threat detection and alarms are on; records show alerts were reviewed and acted on.
Every requirement in one record. Proved once, counted everywhere.
NIST CSF 2.0 in the cloud, outcome by outcome.
CSF 2.0 has 106 outcomes across six functions, from Govern to Recover. NxSCORE shows which ones your cloud evidences, and what your programme has to show for the rest.
You will recognise it
- Your board asked for a CSF profile, and the cloud evidence is a CNAPP export.
- The new Govern function has no owner, and nobody is sure what counts as evidence for it.
How it is met
CSF covers the whole organisation, not only the cloud. Cloud checks count towards an outcome for the cloud estate; the rest of the estate, and the programme itself, need evidence.
Versions
NxSCORE keeps 2.0, and 1.1 with all 108 of its subcategories. Evidence carries to the same outcome in the other version.
- A CNAPP policy counts towards it16
NxSCORE checks it too, and counts a failing resource once.
- Only NxSCORE checks cover it21
A setting can be tested, but no CNAPP policy does.
- Only evidence can show it69
Policies, reviews, records and systems outside the cloud.
- ID.AM-02 Software, services and systems inventory maintainedCNAPP policy and NxSCORE checks
Checks show the cloud inventory is recorded; SaaS, on-premise and end-user software need the inventory itself.
- DE.CM-03 Personnel activity and technology use monitoredCNAPP policy and NxSCORE checks
Checks show cloud activity is logged and alarmed; records show someone reviews it.
CIS AWS 7.0, every recommendation checked.
Unlike most frameworks, almost all of the CIS AWS benchmark can be settled by checks. The gap is in the newest recommendations, which a CNAPP mapped to an older version may not have yet.
You will recognise it
- Your CNAPP reports against CIS AWS 6.0, and your auditor asks for 7.0.
- Organizations guardrails and resource policies open to everyone are new in 7.0, and nothing checks them yet.
How it is met
Version 7.0 added ten recommendations, including AWS Organizations guardrails and resource policies that allow anyone. A CNAPP mapping carried over from 6.0 has no policy for those yet; NxSCORE checks them.
Versions
NxSCORE keeps 7.0, 6.0 and 5.0. Compensating controls carry across them, such as SIEM alerting on CloudTrail in place of the 5.x metric filters.
- A CNAPP policy counts towards it53
NxSCORE checks it too, and counts a failing resource once.
- Only NxSCORE checks cover it17
A setting can be tested, but no CNAPP policy does.
- 4.2 CloudTrail log file validation is onCNAPP policy and NxSCORE checks
Settled by checks, in every account and region.
- 2.16 Instances use IAM roles to reach other AWS resourcesCNAPP policy and NxSCORE checks
Settled by checks.
India’s regulators, deadline by deadline.
RBI, IRDAI and SEBI each set their own rules for fixing and reporting. NxSCORE turns them into fix-by dates on every finding, and lays the quarterly pack out against each clause. It never says you comply.
- RBIFix-by dates
- High30 days
- Medium60 days
- Low90 days
RBI sets no number of days. Enter the ones in your board-approved policy; until then NxSCORE starts at 30, 60 and 90.
- IRDAIFix-by dates
- High30 days
- Medium60 days
- Low60 days
One choice in Settings sets these from §2.16. Your own policy can be stricter.
- SEBI CSCRFFix-by dates
- Patches, high7 days
- Patches, moderate14 days
- Patches, low30 days
- VAPT and audit findings90 days
Two choices in Settings: the patch timelines for MIIs and qualified REs, or 3 months for VAPT and cyber audit findings.
Questions about frameworks and evidence.
Does NxSCORE certify us or issue a report on compliance?
No. Reports and certificates come from your assessor, auditor or certification body. NxSCORE keeps the record they work from: each requirement, how it is met, the checks behind it and the evidence, with who accepted it and when it falls due.
Can one piece of evidence count for more than one framework?
Yes. An approved information security policy, for example, counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01 at once. Before accepting it, your analyst sees every requirement it will meet.
Which versions are kept?
Each framework’s current version and up to two before it, such as PCI DSS 4.0.1 with 4.0 and 3.2.1, or ISO 27001:2022 with 2013. Evidence accepted for a requirement counts for the same requirement in the other versions.
See your own gap.
Connect one cloud account and choose your frameworks. After the first assessment, your analyst takes you through each requirement’s status, what one upload would cover, and what will be out of date by the audit.