Does the mapping replace an audit or a certification?

No. The mapping is a pointer. It helps you prioritize and document your ISMS. It is not a formal certification statement. The assessment in the audit stays with your auditors.

Which ISO 27001 controls does SnapScan cover?

SnapScan maps findings to controls from ISO/IEC 27001:2022 Annex A. Examples are A.8.8 (technical vulnerabilities), A.8.26 (application security), A.8.24 (cryptography) and A.5.15 (access control). Which controls apply depends on your findings.

What is an MCP server?

MCP stands for Model Context Protocol. It is an interface that AI assistants and other systems use to query data. The SnapScan MCP server can only read findings, not change them. Each connection needs its own key.

Does this work for cloud findings too?

Yes. Findings from cloud accounts also get the BSI module OPS.2.2 (cloud usage) and the ISO control A.5.23 (information security for cloud services).

Back to SnapScan

SnapScan · Compliance mapping

Vulnerabilities in the language of your ISMS

Your scan says "CVSS 9.8". Your audit asks about "A.8.8". SnapScan bridges the gap. Each finding shows which BSI IT-Grundschutz modules and which ISO 27001 controls it touches.

Request a demo

From finding to control

SnapScan first sorts each finding into a category. The category points to the matching modules ofBSI IT-Grundschutz and controls fromISO/IEC 27001:2022 Annex A. A few examples:

SQL injection: APP.3.1 web applications and CON.8 software development, plus A.8.26 and A.8.28.
Outdated software: OPS.1.1.3 patch and change management, plus A.8.8.
Weak TLS settings: CON.1 crypto concept, plus A.8.24.
Weak or default passwords: ORP.4 identity and access management, plus A.5.17 and A.8.5.
Broken access control: APP.3.1 and ORP.4, plus A.8.3 and A.5.15.
Active Directory weaknesses: APP.2.2 Active Directory Domain Services and ORP.4.
Misconfiguration: NET.1.1 network architecture and design, plus A.8.9 and A.8.20.

Without a mapping, someone has to sort every finding by hand. That takes time, and gaps creep into your records. With SnapScan, the mapping sits right on the finding. Your ISMS team can review it and take it over.

Which controls are affected?

SnapScan rolls all findings up into one overview. For each module and control, you see how many findings touch it. You also see the highest severity. The worst ones come first. Purely informational findings do not count as a gap.

So you can see fast where your ISMS needs work. The results help you prioritize and serve as evidence in your documentation.

Important: The mapping is indicative, not a formal certification statement. It does not replace an audit or an expert assessment.

Get results to where the work happens

Reports

The white-label report has a summary for management and an overall risk rating. It adds CVE and CWE references and remediation advice. You get the report as HTML and as Markdown.

SARIF export

SARIF is a standard format for security findings. SnapScan exports version 2.1.0. Your developers see the findings right in GitHub Code Scanning or Azure DevOps.

An MCP server for AI assistants

The MCP server is an interface for AI assistants, ticketing systems and SOAR. It can only read findings and scans. Each finding carries KEV, EPSS and a flag that shows whether proof exists. You create keys in the console, with a role, an expiry date and revocation. Read more in our article on theMCP findings export. This way, findings also flow as evidence into theISO 27001 software SecTepe.Core. OurISMS consultinghelps you build your ISMS.

FAQ on compliance mapping

Does the mapping replace an audit or a certification?: No. The mapping is a pointer. It helps you prioritize and document your ISMS. It is not a formal certification statement. The assessment in the audit stays with your auditors.
Which ISO 27001 controls does SnapScan cover?: SnapScan maps findings to controls from ISO/IEC 27001:2022 Annex A. Examples are A.8.8 (technical vulnerabilities), A.8.26 (application security), A.8.24 (cryptography) and A.5.15 (access control). Which controls apply depends on your findings.
What is an MCP server?: MCP stands for Model Context Protocol. It is an interface that AI assistants and other systems use to query data. The SnapScan MCP server can only read findings, not change them. Each connection needs its own key.
Does this work for cloud findings too?: Yes. Findings from cloud accounts also get the BSI module OPS.2.2 (cloud usage) and the ISO control A.5.23 (information security for cloud services).

See the mapping on your findings

We will show you in a demo how scan results turn into ISMS evidence.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.