Cloud security for compliance evidence
If an auditor or a customer wants evidence about your cloud, Secorvia maps what it finds to SOC 2, ISO 27001, CIS and NIST CSF controls. This page explains what that gives you, how to use it, and why it is evidence and not a certification.
Who this fits
The reader here is preparing for an assessment, or answering a customer who asks about one, and needs to show how their cloud is configured. A security lead may be building a case for SOC 2 or ISO 27001. An engineer may be asked for the CIS benchmark result for an AWS, Azure or Google Cloud account. Both need the same thing: a dated, traceable account of what was checked and what failed.
Secorvia checks cloud configuration against its findings and maps each finding to the framework controls it affects. The frameworks shown on the homepage describe what findings are mapped against. They do not say that Secorvia itself holds any certification.
The frameworks it maps to
The compliance guide lists the CIS Foundations benchmarks for AWS, Azure and Google Cloud, NIST CSF, ISO 27001 and SOC 2. Coverage is shown separately for each framework, so a figure for one never blends into another. The guide also says to read the actual framework set in your own deployment, so check the compliance page in your account for the list that applies to you.
A single security condition can map to several frameworks. Each finding shows its compliance impact, so you can start from a failing control and open the findings behind it, or start from a finding and see which controls it touches. Remediating the underlying condition addresses it for each framework it maps to.
How evidence builds up
Compliance and report generation start on the Starter plan. The sequence is short.
- Connect the accounts in scope and wait for their scans to finish. Findings and mappings come from completed scans.
- Generate a compliance snapshot. It evaluates the available findings and mappings at that moment and is stored with its date.
- Read each framework on its own. Open the controls behind a percentage and the findings behind a control, rather than quoting the headline figure.
- Remediate the underlying condition in your cloud account, then scan again to verify. A finding marked resolved is only verified once a scan no longer detects it.
- Use the coverage trend. Pick a framework, an interval and a date range. A trend needs more than one snapshot, so a single one cannot show direction, and you should compare periods with the same framework and interval.
When it is time to hand something over, generate a compliance report from Reports for the assessment period, and include the scope and dates. A scheduled report repeats that daily, weekly or monthly, so the evidence for a period exists before anyone asks for it. The executive dashboard, part of the Growth plan, shows the compliance score next to risk and remediation figures for a chosen period.
Showing who changed what
Auditors ask about process as well as configuration. Each finding carries an assignee, comments and a timeline of supported changes, so a hand-off is visible. Suppressing a finding requires a reason and may carry an expiry, and a team can mark a finding resolved or accept the risk. Members have one of four roles, and changes made through an API key are attributed to the service identity that owns it. Audit log retention depends on the plan: 30 days on Free, 90 days on Starter, a year on Growth and no fixed limit on Enterprise.
What it is not
A compliance snapshot is not a certification and does not replace an audit. A percentage is not complete assurance, and the guide says to review failed controls and missing evidence with the responsible team instead of treating a headline figure as the answer. Suppressing a finding changes your triage queue but the condition still counts toward risk and compliance, which is the right behaviour for evidence and worth knowing before you suppress something to improve a number.
Frameworks such as SOC 2 and ISO 27001 also cover policies, training and process, which a configuration scanner cannot evidence. Secorvia speaks to the cloud controls. It is read-only and reports problems without fixing them, a scan is a snapshot, and Oracle Cloud and Alibaba Cloud accounts cannot be connected. For the connection itself, see the security page, and for the steps in the product, the compliance guide.
Frequently asked questions
Does Secorvia make me SOC 2 or ISO 27001 compliant?
No. It maps findings to controls and shows coverage, which is evidence about your cloud configuration. A compliance snapshot is not a certification and does not replace an audit.
Which frameworks does it cover?
The compliance guide lists the CIS Foundations benchmarks for AWS, Azure and Google Cloud, NIST CSF, ISO 27001 and SOC 2. It also says to read the framework set shown in your own deployment.
Which plan do I need?
Compliance and report generation start on the Starter plan. The executive dashboard, which includes a compliance score for a chosen period, is part of Growth.
Why is my compliance trend empty?
A trend needs more than one snapshot. Generate snapshots over time, and compare periods using the same framework and interval.
Does suppressing a finding raise my score?
No. Suppression changes the triage queue, but the condition still contributes to risk and compliance until a scan shows it is fixed.