Compliance frameworks
A framework mapping turns what the cluster did into what an auditor asked for. It does not turn either one into a certification.
What an evidence package contains
For a period you choose:
- every admission decision, allows included, with the image, the digest, the reason and the policy that produced it,
- the exceptions that were active, who approved each one and when it expired,
- scan coverage: which digests were evaluated, against which database version, and when,
- gaps, stated as gaps — periods where the webhook was not answering, or the quota was exhausted, appear as what they were.
The allows matter as much as the denials. Evidence that only lists blocks can show that something was blocked; it cannot show that a control was operating.
Mapped frameworks
| Framework | Where it applies |
|---|---|
| Cyber Resilience Act — Regulation (EU) 2024/2847 | EU |
| NIS2 — Directive (EU) 2022/2555 | EU |
| DORA — Regulation (EU) 2022/2554 | EU financial entities |
| GDPR Article 32 | EU |
| NIST SP 800-218 (SSDF) | US |
| NIST SP 800-190 | US |
| NIST SP 800-53 Rev. 5 | US |
| SOC 2 | US, widely used elsewhere |
| ISO/IEC 27001 | international |
Community includes one framework, and it is yours to choose rather than a fixed one. A company doing only ISO 27001 should not be asked to pay for a SOC 2 mapping it will never open.
What this does not claim
A mapping is an argument, not a verdict. It says: this control text asks for evidence of X, and here is what your cluster did about X. Whether your auditor accepts it is between you and your auditor, and no tool can promise otherwise.
Container images are also one slice of any of these frameworks. None of them is satisfied by what happens at admission alone, and a product that implied otherwise would be selling a false finish line.
Where the mappings come from
Each mapping is read from the published text of the framework and cites the clause it maps to, so you can check the reading rather than trust it. Where a clause is genuinely ambiguous about containers, the mapping says so instead of picking the flattering interpretation.