Security Vulnerability Standards & Compliance Frameworks

CodeScan integrates findings with the major global security standards so every reported vulnerability maps to the frameworks your organisation must comply with. Below is a detailed guide to each standard — what it is, who it applies to, and how CodeScan uses it.

OWASP Top 10

The Open Web Application Security Project (OWASP) Top 10 is the most widely referenced application security standard in the world. Published every 3–4 years by the non-profit OWASP Foundation, it lists the ten most critical security risks to web applications based on real-world data from hundreds of organisations.

Every CodeScan finding is tagged with its OWASP 2021 category (e.g. A03:2021 - Injection), giving you direct evidence for security audits and penetration-test reports that ask for OWASP coverage.

OWASP Top 10 — 2021 Edition

Official reference: owasp.org/Top10

OWASP ASVS

The Application Security Verification Standard (ASVS) is a framework of security requirements for web applications published by OWASP. While the Top 10 lists what to avoid, ASVS defines what a secure application must do — organised into three assurance levels (L1 basic → L3 advanced) and 14 chapters covering authentication, session, access control, cryptography, API security, and more.

ASVS is used as a basis for security testing requirements in procurement contracts and penetration test scopes. CodeScan findings can be mapped to ASVS controls during a security review.

Official reference: owasp.org/www-project-application-security-verification-standard — current version: ASVS 4.0.3

CWE — Common Weakness Enumeration (MITRE)

Maintained by MITRE Corporation under a contract with the US Department of Homeland Security, CWE is the language that all serious vulnerability scanners speak. It describes classes of weaknesses (not specific bugs) so that tools, researchers, and developers use a common vocabulary.

CodeScan tags every finding with a CWE ID and links directly to the MITRE entry. See the CWE Reference section for the full table.

Official reference: cwe.mitre.org · CWE Top 25 Most Dangerous Weaknesses

CVE & NVD — Vulnerability Databases

A Common Vulnerability and Exposure (CVE) entry is a specific, publicly known vulnerability in a specific software version. CVE IDs (format: CVE-YYYY-NNNNNN) are the universal identifier used in security advisories, patch notes, and regulatory filings worldwide.

The National Vulnerability Database (NVD), operated by NIST, enriches each CVE with a CVSS score, affected versions, and remediation guidance. CodeScan's enrichment step queries NVD to attach relevant CVE IDs and scores to your findings.

• cve.org — authoritative CVE list (MITRE)
• nvd.nist.gov — National Vulnerability Database with CVSS scores (NIST)
• NVD Vulnerability Search — search any CVE ID

CVSS — Common Vulnerability Scoring System

The Common Vulnerability Scoring System (CVSS) is a numerical scoring framework that quantifies vulnerability severity. Published by FIRST (Forum of Incident Response and Security Teams), CVSS v3.1 (and the newer v4.0) produces a score between 0.0 and 10.0 by measuring attack vector, complexity, required privileges, user interaction, and impact on confidentiality, integrity, and availability.

Official reference: first.org/cvss · CVSS 3.1 Calculator

EPSS — Exploit Prediction Scoring System

Published by FIRST, the Exploit Prediction Scoring System (EPSS) is a probability score (0–100%) that estimates how likely a given CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures theoretical severity, EPSS is a data-driven, ML-based model trained on real exploitation telemetry.

CodeScan displays the EPSS score alongside the CVSS score after enrichment. Use EPSS to prioritise patching: a medium-CVSS vulnerability with 90% EPSS probability is more urgent than a critical-CVSS finding that has never been publicly exploited.

Official reference: first.org/epss · EPSS API

CISA KEV — Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA), the US federal cybersecurity agency, maintains the Known Exploited Vulnerabilities (KEV) Catalog — a live list of CVEs that have been actively exploited in real attacks against US government agencies and critical infrastructure.

Under Binding Operational Directive 22-01, all US federal civilian agencies must remediate KEV-listed vulnerabilities within defined deadlines. For commercial organisations, KEV status is the strongest possible signal that a vulnerability poses immediate real-world risk — it is not theoretical.

CodeScan flags any finding with KEV status as a 🚨 CISA KEV badge and marks it critical regardless of its CVSS score. These must be treated as emergency patches.

• cisa.gov/known-exploited-vulnerabilities-catalog — the live KEV list
• KEV JSON Feed — machine-readable, updated daily
• BOD 22-01 — Binding Operational Directive

SOC 2 Type II

SOC 2 (System and Organisation Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates a SaaS provider's controls across five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

A Type II report covers a period of typically 6–12 months, demonstrating that controls were operating effectively over time — not just in place at a single point (Type I). Enterprise customers typically require a current SOC 2 Type II report before signing contracts.

How CodeScan helps

• CC7.1 — Vulnerability Management: CodeScan's automated scanning in CI/CD pipelines provides documented evidence that vulnerabilities are identified and remediated as part of a formal process.
• CC6.1 — Logical Access Controls: Code-level findings related to broken access control (CWE-284, CWE-285) map directly to this criterion.
• CC6.6 — Transmission and Boundary Activity: Findings for missing TLS, open redirects, and SSRF map to network security controls.
• Audit evidence: Export scan results as JSON or SARIF to attach to your SOC 2 evidence packages.

Official reference: aicpa-cima.com — SOC Suite · SOC for Service Organisations

PCI DSS v4.0

The Payment Card Industry Data Security Standard (PCI DSS) is a contractual security standard mandated by the major card brands (Visa, Mastercard, Amex, Discover) for any organisation that processes, stores, or transmits cardholder data. Compliance is assessed by a Qualified Security Assessor (QSA) for larger merchants or via a Self-Assessment Questionnaire (SAQ) for smaller ones. Non-compliance can result in fines of $5,000–$100,000/month and eventual loss of card acceptance rights.

PCI DSS v4.0, released in March 2022 (and mandatory from April 2025), adds new requirements around targeted risk analysis, web-skimmer detection, and phishing protection.

Relevant PCI DSS requirements addressed by CodeScan

Official reference: pcisecuritystandards.org/document_library · PCI DSS v4.0 PDF

NIST SP 800-53 & Cybersecurity Framework (CSF)

The National Institute of Standards and Technology (NIST) publishes two widely adopted security frameworks:

• NIST SP 800-53 Rev 5 — A comprehensive catalogue of security and privacy controls for information systems and organisations. Mandatory for US federal agencies under FISMA; widely adopted by regulated industries. The SA (System and Services Acquisition) and SI (System and Information Integrity) control families directly cover secure coding and vulnerability management. Reference: csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
• NIST Cybersecurity Framework 2.0 (CSF) — A risk-based framework organised into six functions: Govern, Identify, Protect, Detect, Respond, Recover. CodeScan maps to the Identify (asset and vulnerability inventory) and Protect (application security controls) functions. Reference: nist.gov/cyberframework
• NIST SP 800-218 (SSDF) — Secure Software Development Framework: a set of fundamental, sound, and secure software development practices. Maps to CodeScan's scan, remediate, and verify workflow. Reference: csrc.nist.gov/publications/detail/sp/800-218/final

ISO/IEC 27001:2022

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS), published jointly by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). The 2022 revision reorganised Annex A controls into four themes — Organisational, People, Physical, and Technological — and added new controls including threat intelligence and secure coding.

CodeScan findings provide evidence for several Annex A controls:

• A.8.8 — Management of Technical Vulnerabilities: Documented vulnerability scanning is a direct control requirement.
• A.8.28 — Secure Coding: New in 2022 — requires organisations to apply secure coding principles and validate code for security issues.
• A.8.29 — Security Testing in Development and Acceptance: SAST results feed into the acceptance testing evidence required by this control.
• A.5.7 — Threat Intelligence: CodeScan's CVE, EPSS, and CISA KEV enrichment provides the threat intelligence context required by this control.

Official reference: iso.org/standard/27001 — ISO store (paid) · ISO 27001 overview

GDPR — General Data Protection Regulation

The General Data Protection Regulation (GDPR), effective May 2018, is EU law governing the processing of personal data of EU residents. Article 25 (Data Protection by Design and by Default) and Article 32 (Security of Processing) require that appropriate technical and organisational measures be implemented — explicitly including encryption, pseudonymisation, and ongoing security testing.

CodeScan helps meet GDPR technical requirements by detecting code-level personal data exposures (CWE-359), insecure storage (CWE-312), cleartext transmission (CWE-319), and missing access controls (CWE-284) before they reach production.

Official reference: gdpr.eu/article-32 · European Commission — Data Security

HIPAA — Health Insurance Portability and Accountability Act

The HIPAA Security Rule (45 CFR Part 164) requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic Protected Health Information (ePHI). The Technical Safeguards section (§ 164.312) specifically requires access controls, audit controls, integrity controls, and transmission security.

CodeScan findings relevant to HIPAA include: hardcoded credentials in applications that access ePHI, missing encryption for data at rest and in transit, broken access controls, and SQL injection that could expose patient records.

Official reference: hhs.gov/hipaa/security · HHS HIPAA Cybersecurity Guidance

SARIF — Static Analysis Results Interchange Format

SARIF 2.1.0 is an OASIS open standard for representing static analysis tool output in a machine-readable JSON format. It is the native format for GitHub Advanced Security, GitLab SAST, and Azure DevOps Security. Uploading a SARIF file to GitHub automatically creates code-scanning alerts linked to specific lines in pull requests.

CodeScan exports SARIF 2.1.0 on the Starter plan and above. See the Exporting Results section for usage.

Official reference: sarifweb.azurewebsites.net · GitHub SARIF documentation

Quick Reference — Standards at a Glance