"Is this tool compliant?" is the wrong question — no scan report makes an application compliant on its own. The right question is what a given framework requires of your application security testing, and whether a tool's reports give you usable evidence for it. This hub breaks that down framework by framework, sourced from each framework's own text or official guidance, then shows exactly which of Vooki Pro's compliance reports map to it.
A compliance report is evidence of testing, not a certificate of compliance. Vooki Pro's own report documentation says this explicitly — it shows what was scanned, what was found, and how each finding maps to the framework's controls.
Not every framework treats vulnerability scanning the same way. PCI DSS names it directly, with quarterly internal scans and quarterly external scans by an ASV. NIST SP 800-53 RA-5 names it at an organization-defined frequency, and when new vulnerabilities potentially affecting the system are identified. HIPAA, GDPR, and ISO 27001 set risk-based requirements without prescribing a method, and SOC 2's criteria address detecting vulnerabilities, assessed by a CPA firm. In each case a scanner is one method that can support part of a requirement — not the requirement itself.
Vooki Pro generates reports for seven compliance and security-reference mappings directly from scan results — no manual remapping of findings to controls.
Requirement 11.3 names vulnerability scanning directly: internal (11.3.1) and external (11.3.2) scans at least once every three months, plus scans after significant changes. For applicable PCI DSS requirements, quarterly external vulnerability scans must be performed by a PCI SSC Approved Scanning Vendor (ASV). Vooki Pro's vulnerability reports do not replace a required ASV scan.
The Security Rule requires a risk analysis of threats to ePHI. It doesn't name scanning, but HHS guidance treats it as a recognized way to meet that requirement.
Article 32(1) requires security appropriate to the risk; among the measures it lists, as appropriate, is a process for regularly testing, assessing and evaluating their effectiveness (32(1)(d)) — no fixed scan cadence.
Annex A.8.8 "Management of technical vulnerabilities" — one of 93 controls in the 2022 revision's Technological theme. Vooki Pro's ISO report is a legacy ISO/IEC 27001:2013 mapping (Annex A controls such as A.12.6.1); a 2022-edition control mapping is not currently available.
RA-5 "Vulnerability Monitoring and Scanning" names scanning explicitly, with scan cadence and remediation timeframes left as organization-defined parameters.
A CPA firm examines your controls against the AICPA's Trust Services Criteria. Vooki Pro maps findings to seven selected 2017 criteria (CC6.1, CC6.2, CC6.6, CC6.7, CC6.8, CC7.1 and CC7.2) — evidence for that examination, not a SOC 2 report or attestation.
Not a compliance law, but the baseline most assessors expect. Vooki Pro currently maps to the 2021 edition; OWASP published an updated 2025 list in November 2025.
| Framework | Names vulnerability scanning? | Vooki Pro report |
|---|---|---|
| PCI DSS v4 | Yes — Requirement 11.3, quarterly internal scans + quarterly external scans by an ASV | HTML / PDF, mapped to PCI DSS v4.0 |
| NIST SP 800-53 | Yes — RA-5, at an organization-defined frequency and when new relevant vulnerabilities are identified | HTML / PDF, mapped to NIST SP 800-53 Rev. 5 |
| ISO/IEC 27001 | Named control (A.8.8 in the 2022 edition), method not prescribed | HTML / PDF, legacy mapping to ISO/IEC 27001:2013 Annex A; 2022 mapping not currently available |
| HIPAA | Not by name — risk analysis required | HTML / PDF, mapped to HIPAA safeguards |
| GDPR | Not by name — regular testing duty (Art. 32) | HTML / PDF, Vooki Pro's own reference mapping (mainly Art. 32); not an official GDPR control mapping |
| SOC 2 (2017 TSC) | Not by name — CC7.1 addresses detecting vulnerabilities; a CPA firm examines the controls | HTML / PDF, selected control mapping (CC6.1, CC6.2, CC6.6, CC6.7, CC6.8, CC7.1 and CC7.2); not a SOC 2 report or attestation |
| OWASP Top 10 | Not a law — de facto testing baseline | HTML / PDF, mapped to OWASP Top 10 2021 |
A compliance report is evidence of testing, not a certificate of compliance — your assessor decides what it means for your programme.
More detail is in the report generator documentation · or contact us
OWASP Top 10:2025 (official)
PCI Security Standards Council — document library (PCI DSS v4.0.1)
HHS — HIPAA Security Rule risk analysis guidance
EUR-Lex — Regulation (EU) 2016/679 (GDPR), official text
ISO/IEC 27001:2022 (official standard page)
NIST SP 800-53 Rev. 5 (official catalog)
HHS OCR — January 2026 Cybersecurity Newsletter (vulnerability scans)
PCI SSC — resource guide: vulnerability scans and ASVs
PCI SSC — Approved Scanning Vendors
AICPA & CIMA — SOC suite of services (incl. SOC 2)
Alert Logic — SOC 2 CC7.1 summary
Vooki Pro documentation: Reports & Compliance · Scan Results & Findings · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.