Compliance mapping
Which service produces evidence for which obligation.
ISO 27001, NIST CSF, NIS2, GDPR and KVKK do not ask for security to be set up once. They ask for it to be maintained, reviewed and documented. The table below shows which control each Buguardian service produces evidence for.
Annex A controls and management system clauses.
Govern · Identify · Protect · Detect.
EU network security and data protection: Art. 5, 32–34.
Türkiye: Article 12 data security obligations.
Control mapping
Service by service, control by control.
| Component | ISO 27001:2022 | NIST CSF 2.0 | NIS2 · GDPR | KVKK |
|---|---|---|---|---|
| Vulnerability managementVulnerability assessment (VA) | A.8.8 Technical vulnerabilitiesA.8.9 Configuration | ID.RA-01 | NIS2 21(2)(e)GDPR 32(1)(d) regular testing | Art. 12/1 appropriate security level |
| Web application scanningExternal surface scan | A.5.9 Asset inventoryA.8.8 Technical vulnerabilities | ID.AM Assets | NIS2 21(2)GDPR 32(1)(d) regular testing | Art. 12/1 preventing unlawful access |
| Phishing simulationHuman factor | A.6.3 Awareness, education and training | PR.AT-01 | NIS2 21(2)(g)GDPR 39(1)(b) staff awareness | Art. 12/1 administrative measure · awareness training |
| Threat intelligence · DRP24/7 CTI monitoring | A.5.7 Threat intelligence | ID.RA-02 | GDPR 33–34 breach notification | Art. 12/5 breach notification |
| Buguardian ManagementPatching · inventory · endpoints | A.8.1 User endpoint devicesA.8.8 Patching | PR.PS-02 | NIS2 21(2)(e)GDPR 32(1)(b) resilience of systems | Art. 12/1 appropriate security level |
| ThreatAuthenticatorMulti-factor authentication | A.8.5 Secure authenticationA.5.17 Authentication information | PR.AA-03 | NIS2 21(2)(j)GDPR 32(1)(b) confidentiality | Art. 12/1 preventing unauthorised access |
| Watcher posture scoreMeasurement | Cl. 9.1 Monitoring and measurement | ID.IM | NIS2 21(2)(f)GDPR 32(1)(d) evaluation | — |
| Watcher monthly executive reportMeasurement, monitoring, evidence | A.5.36 ComplianceCl. 10 Improvement | GV.OV | NIS2 20GDPR 5(2) accountability | Art. 12/3 audit |
How to read this table. The mapping shows that a service produces evidence supporting the implementation of the relevant control; it does not mean the service satisfies the whole control on its own. Buguardian services do not replace certification or a legal declaration of compliance: ISO 27001 certification is carried out by an accredited body, and KVKK and GDPR compliance by the data controller and the DPO. Buguardian provides the implementation of technical measures and a regular record of it.
How a report becomes evidence
Dated, repeated and comparable.
Scope statement
Each report states which categories were measured and which were visibility gaps. Coverage is clearly stated for auditors and reviewers.
Dated and repeated
Monthly run records back “regularly tested” claims with timestamped evidence.
Comparable score
A score produced the same way is comparable across periods, so improvement is shown in numbers.
Boundaries
What Buguardian helps document — and what it does not do.
Helps document
Assessment scope, measured findings, remediation status, dated results and trend reporting — for security reviews, customer questionnaires, cyber insurance and selected control assessments.
Does not do
Issue certifications, compliance attestations or legal opinions; guarantee compliance; replace legal advice or independent assessment. Certification and regulatory compliance remain the responsibility of the organisation and its appointed advisors or assessors.
Operational safeguards
- Human approval for AI-prepared actions
- Read-only Active Directory and database assessments
- Granular remote-support permissions and second-factor access
- Phased patch deployment and recorded changes
- Credential encryption and customer-local monitoring configuration
Evidence, every month, without the scramble.
See the reports your auditor would receive, and how each one states its scope.