Skip to content
toevan
Sign inBook an audit pilot
Open menuClose menu
Book an audit pilot

Frameworks and control maps

Every control, mapped honestly.

Book an audit pilotSee a sample report
  • 503 controls in 7 catalog editions
  • Live, v1.4.0, planned and yours, never blurred
  1. Code evidence today55 controls across 7 frameworks get partial evidence on every pull request.
  2. Process evidence in v1.4.09 more from merges, approvals, required checks and rule changes.
  3. Your organisation’s share, namedThe 367 controls software can’t evidence are listed in full, not left out.

Every framework, at a glance

One segment per software control, coloured by how Toevan gives evidence for it. The policy, people and physical controls no code tool can evidence are noted under each framework and listed in full on its page.

FrameworkControl mapLiveComing in v1.4.0PlannedControls code can evidenceSupporting
SOC 2Trust Services Criteria (2017)717151
+45 policy, people and physical controls (61 in all). No code tool evidences them; every report lists them.
ISO/IEC 270012022, Annex A11510262
+65 policy, people and physical controls (93 in all). No code tool evidences them; every report lists them.
PCI DSSv4.010115261
+36 policy, people and physical controls (63 in all). No code tool evidences them; every report lists them.
FedRAMP ModerateRev 5, NIST SP 800-53B14221374
+136 policy, people and physical controls (177 in all). No code tool evidences them; every report lists them.
HIPAA45 CFR Part 16480084
+30 policy, people and physical controls (42 in all). No code tool evidences them; every report lists them.
GDPRRegulation (EU) 2016/67930032
+35 policy, people and physical controls (40 in all). No code tool evidences them; every report lists them.
DORARegulation (EU) 2022/255420461
+20 policy, people and physical controls (27 in all). No code tool evidences them; every report lists them.

Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.

From the Toevan control map, computed 24 Oct 2026 from the product’s framework catalog and the requirement coverage of every shipped blueprint.

What each status means

Live
Code evidence today, sealed on every pull request. Always partial: the control also asks for things outside code.
Coming in v1.4.0
Process evidence: merged pull requests, approvals, required checks, branch protection, rulesets and bypasses, sealed per change.
Supporting
Toevan records related evidence, today or in v1.4.0, but the duty is organisational, so it never counts as covered.
Planned
Can be evidenced from code or GitHub. The rule or mapping is not built yet.
Your organisation
Policy, people, physical security, contracts, regulatory procedure, operations or external audit. Your organisation evidences these.

Control maps

  • SOC 2

    Trust Services Criteria (2017)

    Code evidence for access, boundary and confidential-data criteria today; change approvals with process evidence in v1.4.0.

    Code evidence today 7

    • CC6.1
    • CC6.3
    • CC6.6
    • CC6.7
    • CC7.2
    • C1.1
    • C1.2

    Process evidence, v1.4.0 1

    • CC8.1

    61 controls

  • ISO/IEC 27001

    2022, Annex A

    Code evidence for eleven Annex A controls today; change, code-access and settings evidence in v1.4.0.

    Code evidence today 11

    • A.5.15
    • A.5.17
    • A.8.2
    • A.8.3
    • A.8.5
    • A.8.8
    • A.8.12
    • A.8.20
    • A.8.22
    • A.8.24
    • A.8.28

    Process evidence, v1.4.0 5

    • A.8.4
    • A.8.9
    • A.8.25
    • A.8.29
    • A.8.32

    93 controls

  • PCI DSS

    v4.0

    Code evidence for stored and transit card data, secrets, access and secure code today; change approval in v1.4.0.

    Code evidence today 10

    • Req.1.3
    • Req.3.3
    • Req.3.5
    • Req.3.6
    • Req.4.2
    • Req.6.2
    • Req.6.3
    • Req.7.2
    • Req.7.3
    • Req.8.6

    Process evidence, v1.4.0 1

    • Req.6.5

    63 controls

  • FedRAMP Moderate

    Rev 5, NIST SP 800-53B

    Code evidence for fourteen controls today, from access enforcement to protection at rest; configuration change control in v1.4.0.

    Code evidence today 14

    • AC-2
    • AC-3
    • AC-4
    • AC-6
    • AU-2
    • AU-12
    • CM-2
    • CM-6
    • IA-5
    • SA-11
    • SC-7
    • SC-8
    • SC-28
    • SI-2

    Process evidence, v1.4.0 2

    • CM-3
    • SA-10

    177 controls

  • HIPAA

    45 CFR Part 164

    Code evidence for the technical safeguards and the Privacy Rule’s use and disclosure requirements, where they live in code.

    Code evidence today 8

    • 164.308(a)(4)
    • 164.312(a)(1)
    • 164.312(b)
    • 164.312(c)(1)
    • 164.312(d)
    • 164.312(e)(1)
    • 164.502
    • 164.514

    Process evidence, v1.4.0 0

    None mapped

    42 controls

  • GDPR

    Regulation (EU) 2016/679

    Code evidence for the processing principles, data protection by design and security of processing.

    Code evidence today 3

    • Art.5
    • Art.25
    • Art.32

    Process evidence, v1.4.0 0

    None mapped

    40 controls

  • DORA

    Regulation (EU) 2022/2554

    Code evidence for protection and prevention and for detection, strengthened by change-management evidence in v1.4.0.

    Code evidence today 2

    • Art.9
    • Art.10

    Process evidence, v1.4.0 0

    None mapped

    27 controls

  • Another framework?

    NIS2, an internal control set or a sector standard: the evidence is the same, only the mapping changes.

    Ask for a mapping

Your organisation’s process

What software can’t evidence stays with you and your other tools. Every report lists it, so a clean result is never read as more than it is.

  • organisational policy122
  • an operational process113
  • physical security48
  • contracts and vendors25
  • people and HR23
  • regulatory procedure23
  • an external assessment13

367 controls across the catalog

On the roadmap

Planned. Not in the product yet.

  • DORA RTS on ICT risk managementPlannedDelegated Regulation (EU) 2024/1774Art. 17 ICT change management with process evidence; Art. 16 development and maintenance with code evidence.
  • NIST SSDFPlannedSP 800-218 v1.1Secure development practices, from blueprints, reviews and dependency checks.
  • SLSAPlannedv1 specification (OpenSSF)Source track from protected branches and two-party review; build provenance planned.
  • OWASP Top 10Planned2021Rules mapped to the categories that can be checked in code.
  • EU Cyber Resilience ActPlannedRegulation (EU) 2024/2847Components, SBOM export and vulnerability handling.

Test the mapping on a real audit.

Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.

Book an audit pilotSee a sample report