Frameworks
Compliance and audit board
- IEC 62443-3-3, NERC CIP, NIST CSF 2.0, ISO 27001:2022, SOC 2.
- Gaps next to live events.
- Auto-map into the vault.
Compliance
Audit evidence as a by-product of detection.
Framework packs map live events to controls automatically, so the quarterly audit is an export rather than a project.
Framework packs
Five shipping packs, plus an EU CRA bridge on the roadmap.
How mapping works
Event → control → evidence → report.
01
Event
A network or identity event lands in the Kafka pipeline and is normalized.
02
Auto-map
The compliance auto-mapper links the event to framework controls — around seven controls per network event.
03
Evidence
Mapped controls are sealed into the hash-chained vault with signatures and reason codes.
04
Report
Auditor packets, CISO monthly digests, and board PDFs are generated from the same records.
Quantum
PQC in the same audit story
- Regulators ask about crypto agility now.
- Show migration progress, not a slide.
- Hybrid signing is live.
Worked examples
What an auto-mapped control actually looks like.
| Framework | Control | Evidence produced |
|---|---|---|
| IEC 62443-3-3 | SR 6.1 — Audit log accessibility | Hash-chained detection and approval records exportable per zone and conduit. |
| NERC CIP | CIP-007 — System security management | Protocol-level access observations tied to asset and Purdue level. |
| NIST CSF 2.0 | DE.CM — Continuous monitoring | Passive OT capture coverage with per-collector transport health. |
| ISO 27001:2022 | A.8.16 — Monitoring activities | Correlated incidents with analyst decisions and timestamps. |
| SOC 2 | CC7.2 — Anomaly detection | Kill-chain incidents with W15/W60/W24 window provenance. |
| IEC 62443-3-3 | SR 5.1 — Network segmentation | Zone-crossing events flagged against your declared conduit map. |
Export
Evidence Vault for the auditor
- Hash chain verify + ZIP export.
- Read-only role can export without mutating incidents.
- PoV metric: saved a week of manual correlation.
Evidence integrity
Why an auditor can trust the export.
01
Capture
Detection, response action, and approval decisions are written as immutable records.
02
Hash
Each record is hashed and chained to its predecessor — any edit breaks the chain.
03
Sign
Ed25519 signatures seal the chain using Vault-backed key material.
04
Verify
Chain verification runs on demand; lab run verified 66 entries OK.
05
Export
Auditor-ready ZIP packets with policy reason codes, including OT denials.
FAQ
Frequently asked questions.
Does mapping replace my auditor?
No. It replaces the manual log correlation your team does before the auditor arrives. The output is a signed evidence packet your auditor can verify.
Which frameworks ship today?
IEC 62443-3-3, NERC CIP, NIST CSF 2.0, ISO 27001:2022, and SOC 2. EU CRA bridge mapping is on the roadmap.
Can we add internal controls?
Yes. Framework packs are extensible, and partner or internal control sets can be mapped alongside the shipping packs.
Generate an auditor packet from your own events.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.