Certification Control Catalogs (Pro)

DefectDojo Pro ships three certification catalogs: ISO/IEC 27001:2022 Annex A, the SOC 2 Trust Services Criteria, and the NIS2 technical and methodological requirements. You assess an Asset against each one with the same assessment screens used for CRA and DORA. The Shared Evidence view then shows how one set of operational facts, such as an SLA configuration or a testing history, answers controls in all three frameworks at once.

This is an evidence-gathering aid, not a certification. DefectDojo is not a certification body and does not determine compliance. Each catalog states this in its own metadata. An assessment here is preparation, and the evidence it collects is for your auditor to review. The auditor decides.

Enable the feature#

The cross-framework view ships behind the Certification Control Catalogs feature flag, which is in beta and off by default. An administrator turns it on from Settings > Feature Flags. See Feature Flags.

The flag does not depend on any other flag. Running the assessments that feed the view does, though:

In practice, turn on all three. The three catalogs are loaded on every install whether or not the flag is on, so they appear as start buttons as soon as the assessment screens are enabled.

The three catalogs#

Each catalog covers the controls that bear on vulnerability management, secure development and supply chain security. None of them is the whole standard. Control titles and statements are original paraphrase. The control identifiers match the published standards, but the standards' own text is not reproduced.

The NIS2 identifiers are Annex points, not Articles. The Articles of Regulation 2024/2690 set incident thresholds for each entity type and are not part of this catalog.

Run an assessment#

Assessments for these catalogs work exactly like CRA and DORA assessments. The CRA and DORA Evidence Packs page describes every screen in detail. In short:

1. Open the Asset, select the Compliance tab, then select Compliance Profile.
2. In the Regulatory Assessments section, select Start ISO/IEC 27001:2022 Annex A, Start SOC 2 Trust Services Criteria or Start NIS2 Technical and Methodological Requirements. These buttons use a period from January 1 of the current year to today. To choose your own period, open the EU Evidence tab, select Start Assessment, and pick the catalog in the Start Regulatory Assessment dialog.
3. Select Recompute Evidence to compute the automated evidence.
4. Open each control’s Evidence view to read the computed facts, write a narrative, attach supporting files, or override the state with a reason. Select Save Review to keep changes.
5. Select Generate Evidence Pack when the review is done.

Starting an assessment, recomputing, saving a review and generating a pack need edit permission on the Asset. Run one assessment per catalog. The Shared Evidence view combines them.

How evidence is derived#

Every control is either automated, manual, or hybrid. Automated controls are computed from records DefectDojo already holds when you select Recompute Evidence. The evidence date is the period end, or today if the period is still open.

Several controls share one check, because the frameworks ask the same question in different words:

For the SLA check, the computed facts also count risk acceptances with no named accepter and with no compensating control recorded. ISO A.8.8, SOC 2 CC7.4 and NIS2 6.6 all ask for both. These counts are for the assessor and do not change the state.

The remaining controls are manual: ISO A.5.20, A.5.30, A.8.19, A.8.25, A.8.26, A.8.28, A.8.31 and A.8.32, SOC 2 CC7.3, CC7.5 and CC8.1, and NIS2 Article 21(2)(e). Their evidence is a document, a process or a decision record, so they stay unknown after a recompute. Each carries a note naming what to attach, for example supplier agreements for A.5.20 or change tickets for CC8.1. Attach the files under Supporting Files and record the state yourself.

The cross-framework view#

Open the Asset’s Compliance tab, then select the Shared Evidence tab. It sits next to Coverage.

The sentence above the table counts the checks, the controls they answer, and the frameworks involved. A control that appears under two checks is counted in both. Each row is one fact the Asset holds:

Each row has three columns:

• Evidence: the fact and what it shows.
• Status: the row’s rolled-up status, which is the weakest status among the controls that have been assessed. Controls not yet assessed are left out of the roll-up but stay visible in the row.
• Controls Answered: one tag per control, labeled with the control and its catalog, colored by that control’s own status. Hover a tag to see the control title and status.

The rows also include matching controls from the CRA, DORA, PCI DSS and FDA catalogs, so an Asset assessed against several programs sees one matrix. When more than one framework appears, use the All Frameworks menu to narrow the table to one catalog.

The view never recomputes anything. Each status is read from the stored result of the newest assessment that covers that control for this Asset. A control whose catalog has never been assessed shows as Not Assessed, never as passing. Recompute the assessments first if you want the view to reflect current data.

Export#

The cross-framework view has no export of its own. Generate an evidence pack from any of the assessments instead. The pack’s Excel workbook carries a Shared Evidence sheet with the columns Evidence, What it shows, Status, Frameworks and Controls answered, and lists each control with its own status. The matrix is frozen when the pack is generated, so later changes do not alter it. The pack also includes the OSCAL assessment results for the assessed catalog. See Generate an evidence pack.

For automation, assessments, control results and pack files are on the public API: /api/v2/regulatory_assessments/, /api/v2/obligation_results/ and /api/v2/evidence_pack_artifacts/. The cross-framework matrix itself is not on the public API. Read it from the workbook.

Troubleshooting#