---
title: "Compliance mapping"
description: "Which Buguardian service produces evidence for which control: ISO/IEC 27001:2022, NIST CSF 2.0, NIS2, GDPR and KVKK. Recurring, dated technical evidence for audits and customer questionnaires."
url: https://buguardian.com/en/compliance.html
updated: 2026-11-05
---
Compliance mapping

# Which service produces evidence for which obligation.

ISO 27001, NIST CSF, NIS2, GDPR and KVKK do not ask for security to be set up once. They ask for it to be maintained, reviewed and documented. The table below shows which control each Buguardian service produces evidence for.

ISO/IEC 27001:2022

Annex A controls and management system clauses.

NIST CSF 2.0

Govern · Identify · Protect · Detect.

NIS2 · GDPR 2016/679

EU network security and data protection: Art. 5, 32–34.

KVKK · 6698

Türkiye: Article 12 data security obligations.

Control mapping

## Service by service, control by control.

| Component | ISO 27001:2022 | NIST CSF 2.0 | NIS2 · GDPR | KVKK |
|---|---|---|---|---|
| Vulnerability management — Vulnerability assessment (VA) | A.8.8 Technical vulnerabilities; A.8.9 Configuration | ID.RA-01 | NIS2 21(2)(e); GDPR 32(1)(d) regular testing | Art. 12/1 appropriate security level |
| Web application scanning — External surface scan | A.5.9 Asset inventory; A.8.8 Technical vulnerabilities | ID.AM Assets | NIS2 21(2); GDPR 32(1)(d) regular testing | Art. 12/1 preventing unlawful access |
| Phishing simulation — Human factor | A.6.3 Awareness, education and training | PR.AT-01 | NIS2 21(2)(g); GDPR 39(1)(b) staff awareness | Art. 12/1 administrative measure · awareness training |
| Threat intelligence · DRP — 24/7 CTI monitoring | A.5.7 Threat intelligence | ID.RA-02 | GDPR 33–34 breach notification | Art. 12/5 breach notification |
| Buguardian Management — Patching · inventory · endpoints | A.8.1 User endpoint devices; A.8.8 Patching | PR.PS-02 | NIS2 21(2)(e); GDPR 32(1)(b) resilience of systems | Art. 12/1 appropriate security level |
| ThreatAuthenticator — Multi-factor authentication | A.8.5 Secure authentication; A.5.17 Authentication information | PR.AA-03 | NIS2 21(2)(j); GDPR 32(1)(b) confidentiality | Art. 12/1 preventing unauthorised access |
| Watcher posture score — Measurement | Cl. 9.1 Monitoring and measurement | ID.IM | NIS2 21(2)(f); GDPR 32(1)(d) evaluation | — |
| Watcher monthly executive report — Measurement, monitoring, evidence | A.5.36 Compliance; Cl. 10 Improvement | GV.OV | NIS2 20; GDPR 5(2) accountability | Art. 12/3 audit |

**How to read this table.** The mapping shows that a service produces **evidence supporting the implementation** of the relevant control; it does not mean the service satisfies the whole control on its own. Buguardian services do not replace certification or a legal declaration of compliance: ISO 27001 certification is carried out by an accredited body, and KVKK and GDPR compliance by the data controller and the DPO. Buguardian provides the implementation of technical measures and a regular record of it.

How a report becomes evidence

## Dated, repeated and comparable.

### Scope statement

Each report states which categories were measured and which were visibility gaps. Coverage is clearly stated for auditors and reviewers.

### Dated and repeated

Monthly run records back “regularly tested” claims with timestamped evidence.

### Comparable score

A score produced the same way is comparable across periods, so improvement is shown in numbers.

Boundaries

## What Buguardian helps document — and what it does not do.

### Helps document

Assessment scope, measured findings, remediation status, dated results and trend reporting — for security reviews, customer questionnaires, cyber insurance and selected control assessments.

### Does not do

Issue certifications, compliance attestations or legal opinions; guarantee compliance; replace legal advice or independent assessment. Certification and regulatory compliance remain the responsibility of the organisation and its appointed advisors or assessors.

### Operational safeguards

- Human approval for AI-prepared actions
- Read-only Active Directory and database assessments
- Granular remote-support permissions and second-factor access
- Phased patch deployment and recorded changes
- Credential encryption and customer-local monitoring configuration

## Evidence, every month, *without the scramble.*

See the reports your auditor would receive, and how each one states its scope.

[Book a demo](https://buguardian.com/en/demo.html)
[Active Defense Program](https://buguardian.com/en/active-defense.html)