> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/compliance.md).

# Compliance Frameworks

The dashboard's compliance view groups security findings against framework mappings. Use it to find affected controls and prioritize remediation; it is not a certification, an audit opinion, or proof that every framework requirement has been evaluated.

## Read the status

| Status            | Meaning                                                                                      |
| ----------------- | -------------------------------------------------------------------------------------------- |
| **Not assessed**  | No assessment coverage has been recorded for the framework and there are no mapped findings. |
| **Compliant**     | Coverage is recorded and no current findings map to the framework.                           |
| **Needs review**  | Findings map to the framework, but none are critical or high severity.                       |
| **Not compliant** | At least one critical or high finding maps to the framework.                                 |

Zero findings without scan coverage must not be read as a clean assessment. The status reflects the scanned assets and available mappings, not the whole of your organization's compliance program.

## Frameworks and drill-down

Code mappings include OWASP Top 10 2021, OWASP ASVS 5.0, PCI DSS 4.0.1, NIST CSF 2.0, and Australian ISM. Cloud findings can carry SOC 2, HIPAA, PCI DSS, CIS, and other rule-provided framework/control references. Code and cloud mappings are separate sources; the same framework name can represent different coverage.

Open a supported framework drill-down to review the underlying findings and use their severity, ownership, and evidence to plan fixes. Cloud control rollups depend on the control metadata emitted by the scan; a summary card does not imply every control has a drill-down. See [Cloud Audits](/capabilities/cloud-audits.md), [Code Analysis](/capabilities/code-reviews/code-analysis.md), and [Remediations](/capabilities/remediations.md).

For an attestation or contractual compliance statement about Nullify itself, request the current approved material through your Nullify contact. Dashboard labels describe your finding rollups, not Nullify's certification status.