Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.
Executive Summary
Applicable Controls
452
Controls determined to apply to this repository
Implemented
69
Requires Documentation
189
Requires Operational Evidence
5
Code Improvement Recommended
189
Repository Overview
In ProductionTrue
Technology Stack
4907 files · 962816 lines
Languagesgo, javascript, terraform, typescript
Data & InfrastructureAWS
CI/CD & IaCDocker, GitHub Actions
Business Signals
Stores personal dataTrue
Uses AIFalse
Primary jurisdictionUnited States
Processes paymentsTrue
Regulated financial entityFalse
Offers goods/services to the EUTrue
Monitors individuals in the EUFalse
Offers goods/services to IndiaFalse
What Meridian Understood
This repository is a web-based application written primarily in Golang, JavaScript, and TypeScript, and uses Terraform for infrastructure management. It is deployed on AWS using Docker, with continuous integration and delivery through GitHub Actions.
Architecture: Web application
Compliance Scope
Applicable Regulations
GDPRPrivacy & Data ProtectionStatutory law
Your application stores or processes personal data of individuals in the European Union.
Required: matched on stores_personal_data, offers_goods_services_to_eu.
In force since May 2018; applies extraterritorially to organizations offering goods or services to, or monitoring, individuals in the EU.
PCI DSSPayments & Financial SecurityContractual standard
Your application processes payments or handles cardholder data.
Required: matched on processes_payments.
An industry standard enforced through card-network and acquirer agreements, not a statute; applies to entities that store, process, or transmit cardholder data.
SOC 2 Trust Services CriteriaTrust & AssuranceVoluntary attestation
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
A voluntary attestation framework (AICPA Trust Services Criteria) driven by customer and contractual demand, not law.
Not Applicable Regulations
DPDPA 2023Privacy & Data Protection
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
DPDPA Rules, 2025Privacy & Data Protection
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
EU AI ActAI Governance & Responsible AI
Excluded: 'ai_usage' does not match the condition required for this framework.
RBI FREE-AI FrameworkAI Governance & Responsible AI
Excluded: 'ai_usage' does not match the condition required for this framework.
SEBI AI/ML GuidelinesAI Governance & Responsible AI
Excluded: 'ai_usage' does not match the condition required for this framework.
RBI Digital Payment Security ControlsPayments & Financial Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI IT Governance & Risk ControlsCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC IT FrameworkFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI Cybersecurity FrameworkCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
CERT-In DirectionsCybersecurity & Operational Security
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
NIST AI RMFAI Governance & Responsible AI
Excluded: 'ai_usage' does not match the condition required for this framework.
Needs More Information
Not enough was known to confirm or rule these out — Meridian conservatively evaluates their controls below until you provide the missing details.
HIPAA Security RulePrivacy & Data Protection
Not enough information yet: handles_health_data not answered.
Compliance Readiness
Implemented
Authentication
Cross Border Transfer Controls
Data Classification
Data Lifecycle Management
Code Improvement Recommended
Access Control
Audit Logging
Consent Management
Data Retention
Encryption At Rest
Encryption In Transit
Key Management
Requires Documentation
Asset Inventory
Backup And Recovery
Business Impact Analysis
Configuration Management
Data Deletion
Data Masking
Data Protection Impact Assessment
Data Subject Request Handling
Grievance Redressal
Incident Response Plan
Information Security Policy
Log Retention
Policy Management
Privacy Impact Assessment
Records Of Processing
Requires Operational Evidence
AI Risk Assessment
Access Review
BCP And DR Testing
Bias Detection
Change Management
Data Loss Prevention
Data Quality Management
Governance Framework
Incident Detection
Maker Checker
Model Monitoring
Model Testing
Patch Management
Penetration Testing
Physical Access Control
Privileged Access Management
Regulatory Change Monitoring
Regulatory Reporting
SOC Operations
Security Awareness Training
Third Party Risk Assessment
Vendor Contract Management
Vulnerability Scanning
Enterprise Readiness
Detected
Authentication
Recommended Improvements
Access Control
Audit Logging
Encryption At Rest
Encryption In Transit
Key Management
Data Retention
Operational Requirements
Privileged Access Management
BCP And DR Testing
Penetration Testing
Third Party Risk Assessment
Vendor Contract Management
Security Awareness Training
Documentation Required
Incident Response Plan
Information Security Policy
SOC 2 Scope
The subset of the capabilities above that SOC 2's own controls actually reach.
Detected
Authentication
Recommended Improvements
Access Control
Audit Logging
Encryption At Rest
Encryption In Transit
Key Management
Data Retention
Operational Requirements
Privileged Access Management
BCP And DR Testing
Penetration Testing
Third Party Risk Assessment
Vendor Contract Management
Security Awareness Training
Documentation Required
Incident Response Plan
Top Priorities
- Access Control (CRITICAL) — Can the organization (as a non-EU controller/processor) demonstrate that it has designated a representative in the Union?
Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Authentication (CRITICAL) — Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?
Improves compliance posture for: PCI DSS.
- Encryption At Rest (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption In Transit (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Key Management (CRITICAL) — Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
Full breakdown by effort below.
Recommended Actions
Quick Wins
- Access Control (CRITICAL)Can the organization (as a non-EU controller/processor) demonstrate that it has designated a representative in the Union?Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Authentication (CRITICAL)Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?Improves compliance posture for: PCI DSS.
- Encryption At Rest (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Encryption In Transit (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Log Retention (MEDIUM)Does the organization monitor log-in attempts to systems containing electronic protected health information and report discrepancies?Improves compliance posture for: HIPAA Security Rule.
Medium Effort
- Key Management (CRITICAL)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Consent Management (HIGH)Can the organization demonstrate that it provides information free of charge and has procedures for manifestly unfounded or excessive requests?Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
- Privileged Access Management (HIGH)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
- Audit Logging (HIGH)Can the organization demonstrate that it has properly applied exceptions to breach communication to data subjects?Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Incident Response Plan (HIGH)Has the organization conducted and documented a risk analysis assessing threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information?Improves compliance posture for: HIPAA Security Rule, SOC 2 Trust Services Criteria.
- Backup And Recovery (HIGH)Does the organization maintain retrievable, exact backup copies of electronic protected health information?Improves compliance posture for: HIPAA Security Rule, SOC 2 Trust Services Criteria.
- Data Retention (HIGH)Can the organization demonstrate that audit logs are retained for at least 12 months and the most recent 3 months are immediately available?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Records Of Processing (MEDIUM)Can the organization demonstrate that processing of criminal conviction data is under official control or authorised by law with appropriate safeguards?Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Data Masking (MEDIUM)Can the organization demonstrate that processing of criminal conviction data is under official control or authorised by law with appropriate safeguards?Improves compliance posture for: GDPR, PCI DSS, SOC 2 Trust Services Criteria.
- Model Testing (MEDIUM)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR.
- Maker Checker (MEDIUM)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
- Business Impact Analysis (MEDIUM)Can the organization demonstrate that it has assessed the risks to personal data when determining security measures?Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Asset Inventory (MEDIUM)Has the organization conducted and documented a risk analysis assessing threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information?Improves compliance posture for: HIPAA Security Rule.
- Configuration Management (MEDIUM)Has the organization conducted and documented a risk analysis assessing threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information?Improves compliance posture for: HIPAA Security Rule, PCI DSS.
- Data Lifecycle Management (MEDIUM)Does the organization have documented policies for the final disposition of electronic protected health information and the media it is stored on?Improves compliance posture for: HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Information Security Policy (MEDIUM)Has the organization implemented documented policies and procedures reasonably designed to comply with the HIPAA Security Rule's standards and implementation specifications?Improves compliance posture for: HIPAA Security Rule.
- Data Classification (MEDIUM)Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?Improves compliance posture for: PCI DSS, SOC 2 Trust Services Criteria.
- Policy Management (LOW)Can the organization demonstrate that processing of criminal conviction data is under official control or authorised by law with appropriate safeguards?Improves compliance posture for: GDPR, HIPAA Security Rule, PCI DSS, SOC 2 Trust Services Criteria.
- Security Awareness Training (LOW)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
- Data Quality Management (INFORMATIONAL)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR.
Strategic Initiatives
- AI Risk Assessment (HIGH)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
- Bias Detection (HIGH)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR.
- Data Loss Prevention (HIGH)Can the organization demonstrate that automated decision-making based on special category data is only done with explicit consent or substantial public interest and appropriate safeguards?Improves compliance posture for: GDPR.
- Data Protection Impact Assessment (HIGH)Can the organization demonstrate that it has assessed the risks to personal data when determining security measures?Improves compliance posture for: GDPR, PCI DSS, SOC 2 Trust Services Criteria.
- Privacy Impact Assessment (HIGH)Can the organization demonstrate that it has assessed the risks to personal data when determining security measures?Improves compliance posture for: GDPR, PCI DSS, SOC 2 Trust Services Criteria.
- Model Monitoring (MEDIUM)Can the organization demonstrate that it does not make decisions based solely on automated processing that produce legal or significant effects, without appropriate safeguards?Improves compliance posture for: GDPR.
- Physical Access Control (MEDIUM)Can the organization demonstrate that automated decision-making based on special category data is only done with explicit consent or substantial public interest and appropriate safeguards?Improves compliance posture for: GDPR.
Compliance Roadmap
Now · Quick Wins
- Access Control
- Authentication
- Encryption At Rest
- Encryption In Transit
- Log Retention
Next · Medium Effort
- Key Management
- Consent Management
- Privileged Access Management
- Audit Logging
- Incident Response Plan
- Backup And Recovery
- Data Retention
- Records Of Processing
- Data Masking
- Model Testing
- Maker Checker
- Business Impact Analysis
- Asset Inventory
- Configuration Management
- Data Lifecycle Management
- Information Security Policy
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Later · Strategic Initiatives
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Data Protection Impact Assessment
- Privacy Impact Assessment
- Model Monitoring
- Physical Access Control
Next Steps
Technical Findings (174)
Showing top 50 of 174, ranked by severity then confidence. Export to JSON or SARIF for the complete list.
Critical
PCI_REQ_3_6_1 — Define and Implement Procedures to Protect Cryptographic Keys
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_3_6_1_2 — Store Secret and Private Keys in Secure Forms
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_3_7_1 — Implement Key Management for Strong Key Generation
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_3_7_2 — Implement Key Management for Secure Distribution
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_3_7_3 — Implement Key Management for Secure Storage
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_4_2_1 — Implement Strong Cryptography and Security Protocols for PAN Transmission
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
SOC2_CC6_6 — External Threat Protection
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
SOC2_CC6_8 — Unauthorized and Malicious Software Control
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Critical
PCI_REQ_10_2_1_2 — Audit Logs Capture All Actions by Individuals with Administrative Access
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
sdk/helper/docker/ldap.go:90-90 (authentication)
physical/swift/swift_test.go:48-48 (authentication)
builtin/credential/ldap/backend.go:103-103 (authentication)
command/agentproxyshared/auth/kubernetes/kubernetes_test.go:67-67 (authentication)
physical/swift/swift.go:126-126 (authentication)
vault/generate_root.go:326-326 (authentication)
helper/testhelpers/ldap/ldaphelper.go:91-91 (authentication)
command/agentproxyshared/auth/cert/cert_test.go:41-41 (authentication)
command/agentproxyshared/auth/auth.go:331-331 (authentication)
command/agentproxyshared/auth/token-file/token_file_test.go:62-62 (authentication)
Critical
PCI_REQ_10_2_1_3 — Audit Logs Capture All Access to Audit Logs
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
sdk/helper/docker/ldap.go:90-90 (authentication)
physical/swift/swift_test.go:48-48 (authentication)
builtin/credential/ldap/backend.go:103-103 (authentication)
command/agentproxyshared/auth/kubernetes/kubernetes_test.go:67-67 (authentication)
physical/swift/swift.go:126-126 (authentication)
vault/generate_root.go:326-326 (authentication)
helper/testhelpers/ldap/ldaphelper.go:91-91 (authentication)
command/agentproxyshared/auth/cert/cert_test.go:41-41 (authentication)
command/agentproxyshared/auth/auth.go:331-331 (authentication)
command/agentproxyshared/auth/token-file/token_file_test.go:62-62 (authentication)
Critical
PCI_REQ_10_2_1_5 — Audit Logs Capture All Changes to Identification and Authentication Credentials
Code Improvement Recommended
Satisfied: Authentication
Missing: Access Control, Audit Logging
sdk/helper/docker/ldap.go:90-90 (authentication)
physical/swift/swift_test.go:48-48 (authentication)
builtin/credential/ldap/backend.go:103-103 (authentication)
command/agentproxyshared/auth/kubernetes/kubernetes_test.go:67-67 (authentication)
physical/swift/swift.go:126-126 (authentication)
vault/generate_root.go:326-326 (authentication)
helper/testhelpers/ldap/ldaphelper.go:91-91 (authentication)
command/agentproxyshared/auth/cert/cert_test.go:41-41 (authentication)
command/agentproxyshared/auth/auth.go:331-331 (authentication)
command/agentproxyshared/auth/token-file/token_file_test.go:62-62 (authentication)
Critical
PCI_REQ_3_2_1 — Implement Data Retention and Disposal Policies to Minimize Account Data Storage
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Data Retention, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_minimization_module_fanin)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_minimization_module_fanin)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_minimization_module_fanin)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_minimization_module_fanin)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_minimization_module_fanin)
Critical
PCI_REQ_3_3_1 — Do Not Store Sensitive Authentication Data After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_minimization_module_fanin)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_minimization_module_fanin)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_minimization_module_fanin)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_minimization_module_fanin)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_minimization_module_fanin)
Critical
PCI_REQ_3_3_1_1 — Do Not Store Full Track Data After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_minimization_module_fanin)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_minimization_module_fanin)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_minimization_module_fanin)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_minimization_module_fanin)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_minimization_module_fanin)
Critical
PCI_REQ_3_3_1_2 — Do Not Store Card Verification Code After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_minimization_module_fanin)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_minimization_module_fanin)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_minimization_module_fanin)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_minimization_module_fanin)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_minimization_module_fanin)
Critical
PCI_REQ_3_3_1_3 — Do Not Store PIN or PIN Block After Authorization
Code Improvement Recommended
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_minimization_module_fanin)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_minimization_module_fanin)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_minimization_module_fanin)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_minimization_module_fanin)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_minimization_module_fanin)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_minimization_module_fanin)
Critical
GDPR_ART_28_001 — Processor - Selection and Guarantees
Code Improvement Recommended
Missing: Access Control
Critical
GDPR_ART_58_002 — Supervisory Authority - Corrective Powers
Code Improvement Recommended
Missing: Audit Logging
Critical
GDPR_ART_5_001 — Lawfulness, Fairness and Transparency
Code Improvement Recommended
Missing: Consent Management
Critical
GDPR_ART_6_001 — Lawful Processing - Consent
Code Improvement Recommended
Missing: Consent Management
Critical
GDPR_ART_7_001 — Demonstration of Consent
Code Improvement Recommended
Missing: Consent Management
Critical
GDPR_ART_83_001 — Administrative Fines - General Conditions
Code Improvement Recommended
Missing: Audit Logging
Critical
HIPAA_308_A6_001 — Security Incident Procedures -- Response and Reporting
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1 — Enable and Activate Audit Logs for All System Components
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1_1 — Audit Logs Capture All Individual User Access to Cardholder Data
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_1_6 — Audit Logs Capture Initialization, Starting, Stopping, or Pausing of Audit Logs
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_2_2 — Audit Logs Record Specific Details for Each Auditable Event
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_3_2 — Protect Audit Logs from Modification
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_10_4_1 — Review Security Events and Logs of Critical Systems Daily
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_11_3_1 — Perform Internal Vulnerability Scans Quarterly and Resolve High-Risk/Critical Vulnerabilities
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_11_3_2 — Perform External Vulnerability Scans Quarterly by ASV and Pass
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_11_4_4 — Correct Exploitable Vulnerabilities and Security Weaknesses from Penetration Testing
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_11_5_1 — Deploy Intrusion-Detection/Prevention Techniques at CDE Perimeter and Critical Points
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_12_10_1 — Maintain Incident Response Plan with Required Elements
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_5_2_1 — Deploy Anti-Malware Solution on All System Components Except Those Evaluated Not at Risk
Code Improvement Recommended
Missing: Audit Logging
Critical
PCI_REQ_5_2_2 — Ensure Anti-Malware Detects, Removes, Blocks, or Contains All Known Malware
Code Improvement Recommended
Missing: Audit Logging
Critical
SOC2_CC7_3 — Security Event Evaluation
Code Improvement Recommended
Missing: Audit Logging
Critical
SOC2_CC7_4 — Incident Response Program Execution
Code Improvement Recommended
Missing: Audit Logging
Critical
SOC2_P6_6 — Notification of Breaches and Incidents
Code Improvement Recommended
Missing: Audit Logging, Consent Management
High
PCI_APP_A3_2_5_2 — DESV: Implement Response Procedures for Cleartext PAN Outside CDE
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_APP_A3_2_6 — DESV: Implement Mechanisms to Detect and Prevent Cleartext PAN Leaving CDE
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_APP_A3_2_6_1 — DESV: Implement Response Procedures for Attempts to Remove Cleartext PAN
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_12_10_7 — Establish Incident Response Procedures for Detected Stored PAN Outside Expected Location
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_5_1_1 — Use Keyed Cryptographic Hashes for PAN with Key Management
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_6_1_4 — Store Cryptographic Keys in Fewest Possible Locations
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_7_4 — Implement Key Management for Cryptographic Key Changes at End of Cryptoperiod
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_7_5 — Implement Key Management for Retirement, Replacement, or Destruction of Keys
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_7_6 — Implement Split Knowledge and Dual Control for Manual Cleartext Key Operations
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_3_7_7 — Prevent Unauthorized Substitution of Cryptographic Keys
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
High
PCI_REQ_9_2_1 — Implement Facility Entry Controls to Restrict Physical Access to Systems in CDE
Code Improvement Recommended
Satisfied: Data Classification
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
builtin/logical/database/path_roles.go:1001-1001 (data_classification)
plugins/database/mongodb/util.go:16-16 (data_classification)
sdk/database/dbplugin/database.pb.go:904-904 (data_classification)
sdk/plugin/pb/backend.pb.go:3128-3128 (data_classification)
api/auth/ldap/ldap.go:19-19 (data_classification)
api/auth/userpass/userpass.go:19-19 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:330-330 (data_classification)
builtin/logical/database/rotation_test.go:1213-1213 (data_classification)
sdk/database/dbplugin/database.pb.go:747-747 (data_classification)
sdk/database/dbplugin/v5/database.go:119-119 (data_classification)
builtin/credential/userpass/path_users.go:280-280 (data_classification)
sdk/database/helper/connutil/sql.go:63-63 (data_classification)
plugins/database/influxdb/connection_producer.go:27-27 (data_classification)
plugins/database/mongodb/connection_producer.go:33-33 (data_classification)
sdk/database/dbplugin/database.pb.go:572-572 (data_classification)
tools/pipeline/internal/pkg/hcp/client.go:22-22 (data_classification)
sdk/helper/testcluster/blackbox/session_dynamic.go:20-20 (data_classification)
plugins/database/mysql/connection_producer.go:44-44 (data_classification)
physical/couchdb/couchdb.go:43-43 (data_classification)
plugins/database/cassandra/connection_producer.go:29-29 (data_classification)
physical/couchdb/couchdb_test.go:66-66 (data_classification)
sdk/database/dbplugin/v5/proto/database.pb.go:131-131 (data_classification)
sdk/database/dbplugin/v5/database.go:174-174 (data_classification)
plugins/database/mongodb/util.go:10-10 (data_classification)
Control Mapping Appendix
Raw control-level mapping (control IDs, clause text) is intentionally not inlined here — export to JSON or SARIF for the complete, machine-readable control mapping.