What our compliance numbers actually mean
If a report tells you that you are at 68%, you should know exactly what
that is 68% of before you show it to anyone. This page explains it.
Read this part first
A percentage in a Cypliance report is the share of the 24 technical
controls we test that passed. It is not a percentage of ISO 27001, and it is
not a percentage of SOC 2. Those standards contain far more than any scanner can see
— most of it is policy, process and evidence about how your organisation is run.
Cypliance is not an auditor and does not certify anything.
The 24 controls we check
Each one is mapped to the clause it satisfies in every framework it belongs to, so a
failure tells you which control you are missing rather than just that something is
wrong.
| Area | Controls |
|---|
| Access control | 5 |
| Governance | 4 |
| Application hardening | 3 |
| Network security | 3 |
| Cloud configuration | 3 |
| Encryption in transit | 2 |
| Operations | 2 |
| Encryption at rest | 1 |
| Privacy | 1 |
| Total | 24 |
16 we verify ourselves
Tested directly against your systems during a scan. These are pass or
fail on evidence, not a questionnaire.
- HTTPS available with a valid, trusted certificateEncryption in transit · ISO A.8.24 · SOC 2 CC6.7
- Strong transport security enforced (TLS 1.2+, HSTS)Encryption in transit · ISO A.8.24 · SOC 2 CC6.7
- Sensitive data encrypted at restEncryption at rest · ISO A.8.24 · SOC 2 CC6.1
- Browser security headers configuredApplication hardening · ISO A.8.9 · SOC 2 CC6.1
- Technical/version information not leakedApplication hardening · ISO A.8.9 · SOC 2 CC6.1
- Input attack surface controlled (injection/XSS/CSRF)Application hardening · ISO A.8.28 · SOC 2 CC8.1
- Session cookies protected (Secure/HttpOnly/SameSite)Access control · ISO A.8.5 · SOC 2 CC6.1
- Admin/sensitive paths not publicly exposedAccess control · ISO A.8.4 · SOC 2 CC6.1
- Remote-access services not exposed to the internetAccess control · ISO A.8.20 · SOC 2 CC6.6
- Multi-factor authentication enforced for admin accessAccess control · ISO A.8.5 · SOC 2 CC6.1
- Databases not exposed to untrusted networksNetwork security · ISO A.8.20 · SOC 2 CC6.6
- Insecure/legacy services disabled (FTP/Telnet/SMBv1)Network security · ISO A.8.20 · SOC 2 CC6.6
- Open security groups / firewall rules restrictedNetwork security · ISO A.8.20 · SOC 2 CC6.6
- Object storage is private (no public buckets)Cloud configuration · ISO A.5.23 · SOC 2 CC6.1
- Cloud audit logging enabledCloud configuration · ISO A.8.15 · SOC 2 CC7.2
- Least-privilege IAM (no wildcard admin)Cloud configuration · ISO A.8.2 · SOC 2 CC6.3
8 only you can answer
No scanner can see these. We list them so nothing is quietly counted as
passing, and so you know what an auditor will ask for.
- Information security policy documented and approvedGovernance
- Risk assessment process in placeGovernance
- Incident response plan documented and testedOperations
- Backups performed and restoration testedOperations
- Access reviews and joiner/mover/leaver processAccess control
- Third-party / sub-processor risk managed (DPAs/BAAs)Governance
- Security awareness training deliveredGovernance
- Data subject rights / data retention handled (GDPR)Privacy
Where 68% would come from
A worked example, using the same arithmetic the engine uses:
Controls tested24
Passed16
Failed8
Readiness16 ÷ 24 = 67%
Failures are weighted by severity when we rank what to fix first, but
the headline figure is a plain count — a weighted number that nobody can reproduce by
hand is worse than a simple one.
ISO 27001
Our controls map to 17 of the 93 Annex A
controls in ISO/IEC 27001:2022 — about 18% of the standard.
That is the honest figure and it is small on purpose. Annex A covers
people, physical security, supplier relationships, incident management and continuity.
A scanner cannot observe any of that. What it can do is give you evidence for the
technical clauses, which is real work an auditor would otherwise ask you to gather by
hand.
A.5.1 A.5.12 A.5.18 A.5.19 A.5.23 A.5.24 A.5.34 A.6.3 A.8.13 A.8.15 A.8.2 A.8.20 A.8.24 A.8.28 A.8.4 A.8.5 A.8.9
SOC 2
SOC 2 has 5 Trust Services Criteria. Everything we test sits under
Security (the Common Criteria); we say nothing about availability,
processing integrity, confidentiality or privacy as SOC 2 defines them.
A SOC 2 report is an opinion issued by a licensed CPA firm after an
observation period. We are not that and cannot be. What we produce is technical
evidence you can hand to the firm doing your audit.
A1.2 CC1.1 CC1.4 CC3.2 CC6.1 CC6.2 CC6.3 CC6.6 CC6.7 CC7.2 CC7.4 CC8.1 CC9.2
OWASP Top 10
The OWASP Top 10 is a list of the most common classes of web weakness. It is not a
standard you can be certified against, and no scanner "covers" all ten — several
categories are about design and process rather than anything testable from outside.
Every finding we report carries its OWASP category so you can group
them the way your developers already think, and so a report lines up with whatever
your customers are asking about.
What we will not claim
- That we certify anythingCertification comes from an accredited body after an audit. We are a testing tool.
- That a high score means you are secureIt means the tests we ran found nothing. Systems change; a report describes one moment.
- That passing our checks passes an auditAn auditor will ask for policies, records and evidence of process that no scan produces.
- That the number covers the whole standardIt covers 24 technical controls. The rest of the standard is still yours to meet.
Why we are this specific
Plenty of tools report "ISO 27001: 68%" with no denominator. A customer takes that to
an auditor, discovers it meant something else entirely, and the tool has cost them
time and credibility. We would rather show a smaller number that survives being
questioned.
Questions about any of this: support@cypliance.com.