Frameworks
Compliance and audit board
- IEC 62443-3-3, NERC CIP, NIST CSF 2.0, ISO 27001:2022, SOC 2.
- Gaps next to live events.
- Auto-map into the vault.
Compliance
Audit evidence as a by-product of detection.
Framework packs map live events to controls automatically, so the quarterly audit is an export rather than a project.
Framework packs
Five shipping packs, plus an EU CRA bridge on the roadmap.
How mapping works
Event → control → evidence → report.
01
Event
A network or identity event lands in the Kafka pipeline and is normalized.
02
Auto-map
The compliance auto-mapper links the event to framework controls and around seven controls per network event.
03
Evidence
Mapped controls are sealed into the hash-chained vault with signatures and reason codes.
04
Report
Auditor packets, CISO monthly digests, and board PDFs are generated from the same records.
Quantum
PQC in the same audit story
- Regulators ask about crypto agility now.
- Show migration progress, not a slide.
- Hybrid signing is live.
Worked examples
What an auto-mapped control actually looks like.
| Framework | Control | Evidence produced |
|---|---|---|
| IEC 62443-3-3 | SR 6.1 and Audit log accessibility | Hash-chained detection and approval records exportable per zone and conduit. |
| NERC CIP | CIP-007 and System security management | Protocol-level access observations tied to asset and Purdue level. |
| NIST CSF 2.0 | DE.CM and Continuous monitoring | Passive OT capture coverage with per-collector transport health. |
| ISO 27001:2022 | A.8.16 and Monitoring activities | Correlated incidents with analyst decisions and timestamps. |
| SOC 2 | CC7.2 and Anomaly detection | Kill-chain incidents with W15/W60/W24 window provenance. |
| IEC 62443-3-3 | SR 5.1 and Network segmentation | Zone-crossing events flagged against your declared conduit map. |
Export
Evidence Vault for the auditor
- Hash chain verify + ZIP export.
- Read-only role can export without mutating incidents.
- PoV metric: saved a week of manual correlation.
Evidence integrity
Why an auditor can trust the export.
01
Capture
Detection, response action, and approval decisions are written as immutable records.
02
Hash
Each record is hashed and chained to its predecessor and any edit breaks the chain.
03
Sign
Ed25519 signatures seal the chain using Vault-backed key material.
04
Verify
Chain verification runs on demand; lab run verified 66 entries OK.
05
Export
Auditor-ready ZIP packets with policy reason codes, including OT denials.
FAQ
Frequently asked questions.
Generate an auditor packet from your own events.
A dedicated CyberDragon tenant on your own traffic and not a slide deck. See kill-chain cyber defense on your network.