Compliance reports overview

A compliance report is a named, dated view of one framework over your organisation. You choose the framework, the reporting period and which repositories are in scope. Vulnetix maps the evidence it already holds for that scope and period (scanner runs, findings and their triage, VEX, SBOMs, AI and crypto inventories, KEV and end-of-life exposure, quality-gate and firewall policy, provenance) onto the framework’s controls, and marks each control with a status. You add what telemetry cannot show: uploaded documents, notes, and for the assessor-driven frameworks, an assessor’s finding per control.

Evidence is computed when you open or export the report, not stored. Your uploads, notes, scope, settings and assessor findings are stored with the report.

Frameworks

Framework	framework id	Resolve Platform page	What it maps
EU Artificial Intelligence Act	eu_ai_act	/resolve/eu-ai-act	21 articles, from Article 4 to Article 73
NIST AI Risk Management Framework 1.0	nist_ai_rmf	/resolve/nist-ai-rmf	22 of the 72 core subcategories
ISO/IEC 42001:2023	iso_42001	/resolve/iso-42001	21 of 38 Annex A controls and 6 of 25 clause requirements
OWASP Top 10 (2025)	owasp_top_10	/resolve/owasp-top-10	The 10 categories, by CWE, plus program-assurance controls
PCI DSS v4.0.1	pci_dss	/resolve/pci-dss	250 requirements in 12 families, with assessor findings
ISO/IEC 27001:2022	iso_27001	/resolve/iso-27001	Statement of Applicability: 93 Annex A controls and 25 clause requirements
OWASP DevSecOps Maturity Model	owasp_dsomm	/resolve/owasp-dsomm	193 activities in 5 dimensions, levels 1 to 5
EU Cyber Resilience Act	eu_cra	/resolve/eu-cra	34 of about 65 obligations (Annex I, Annex II, Articles 13 and 14)
Scan Coverage	coverage	/resolve/coverage	26 scanner and assurance categories
Exposure & Remediation Performance	exposure	/resolve/exposure	15 sections of exposure and remediation metrics

Details of each are in AI governance frameworks, Security standards and Coverage and Exposure. SLSA, NIST SSDF and a cryptography policy over your CBOM are measured as compliance targets, not reports. Report frameworks that are not supported yet are listed on Planned frameworks.

Plan

Compliance reports need the Pro plan or higher (compliance-reports feature). On Community, the console shows an upgrade panel and the API answers 200 with "planLocked": true, "requiredPlan": "pro" and an empty reports list. No partial data is returned.

Exports

Export	Route	For
PDF	GET /v1/compliance/reports/{uuid}/export.pdf	Reviewers
OSCAL assessment results, v1.1.2	GET /v1/compliance/reports/{uuid}/export.oscal.json	GRC tools
Evidence bundle	GET /v1/compliance/reports/{uuid}/evidence.zip	Auditors: every uploaded file plus machine-generated SBOM, VEX, CBOM, AI-BOM and per-framework JSON

See Exports and OSCAL export.

Scheduling

A report you create by hand covers the fixed period you give it, and its evidence is recomputed every time it is opened or exported. When a period has ended, the console offers Extend to today. To have a report made for you every week, month, quarter or year, create a compliance target: each run creates an ordinary report for the period before it. To produce exports on a timetable, call the export routes from your own scheduler with an API key.

Platform IaC

Compliance reports themselves have no config-as-code: reports, scope and assessor findings are created in the console or through the HTTP API. What is measured, and how often, is: a ComplianceTarget document declares a report framework, a SLSA level, NIST SSDF practices or a cryptography policy on a cadence, and Terraform and OpenTofu manages it. See Compliance targets.

When Drift protection is on, a change made in the console or through a legacy API to a compliance target that is managed as code (by Terraform or a repository) is refused with HTTP 409 managed_by_platform_iac. Change it where it is declared, or ask an admin to turn Drift protection off.