The framework controls your Terraform actually exercises
Every audytx scan maps its AWS Terraform security findings to the SOC 2, PCI-DSS, HIPAA, and CIS AWS controls they touch — so you know where to focus compliance evidence before infrastructure merges. It's a signal to work from, never a certification — here's what that means in practice.
What the compliance mapping means
Every finding can carry framework references — the framework plus the specific control it helps with. One scan rolls them into a per-framework summary in the PR comment and the MCP response.
Coverage is a signal, not a verdict
Coverage means our checks exercise signals that help with a control. It is not a certification, not an audit result, and not evidence that you are compliant.
Four frameworks, IaC-scoped
Each mapping is the subset of controls a Terraform configuration can actually speak to. Purely organizational controls — provisioning workflows, incident-response runbooks, physical access — stay out, because static analysis can't see them.
SOC 2
AICPA Trust Services Criteria. Logical-access, authorization, transmission, change-management, and availability criteria a configuration can speak to. Governance and process criteria stay out.
PCI-DSS v4
Network-segmentation, encryption, access-restriction, and audit-trail requirements you can express in infrastructure code. The broader standard's process requirements don't map from HCL, so we don't claim them.
HIPAA Security Rule
The technical safeguards a configuration can influence under 45 CFR §164: access control, encryption, audit controls, transmission security. Administrative safeguards are out of scope.
CIS AWS Foundations Benchmark v5.0
The IAM, storage, logging, and networking requirements you can declare in Terraform. Account-state and runtime-only requirements don't appear in code, so they're not mapped.
Findings also carry AWS FSBP (AWS Foundational Security Best Practices) references. audytx keeps no canonical control list for FSBP, so those references are surfaced as-is rather than intersected against a fixed subset.
Three surfaces, one mapping
The same per-framework summary rides along wherever findings appear — for the human reviewing the pull request and the agent that wrote the code.
The PR comment
Carries a collapsed Compliance signal section summarizing which frameworks and controls the scan's findings touch.
The MCP response
The scan_terraform response carries a compliance_coverage block — so a coding agent
sees the mapping next to the findings it summarizes.
Each finding
Renders its own Compliance refs line, naming the framework and control that finding helps with.
What counts toward coverage
A check that ran and reached a verdict counts — even one the context graph reasoned away. A finding you opted out of doesn't.
Findings you suppress in your .audytx-baseline.yaml don't
count, and the mapping respects that. Use it to decide where to gather compliance evidence first;
the evidence itself still comes from your systems and processes, and audytx's own certification status is on the
Trust page.
Start free during the open beta
Install on GitHub, open a pull request, and read the framework-mapped verdict in the comment. Free for every team — and the free tier stays free.
Common questions
Does audytx make my Terraform SOC 2 ready?
No. audytx maps findings to the SOC 2, PCI-DSS v4, HIPAA, and CIS AWS controls your Terraform exercises so you know where to gather evidence first. It is not a certification, an audit result, or proof of compliance.
What compliance frameworks does audytx support?
audytx maps AWS Terraform findings to SOC 2 (AICPA Trust Services Criteria), PCI-DSS v4, the HIPAA Security Rule, and the CIS AWS Foundations Benchmark v5.0, and also surfaces AWS FSBP references. Each mapping is an IaC-scoped subset — the controls a Terraform configuration can actually speak to, never the organizational controls static analysis can't see.
Can a Terraform scanner prove HIPAA compliance?
No. A Terraform scanner can map findings to the HIPAA Security Rule technical safeguards your configuration influences — access control, encryption, audit controls, transmission security — but administrative safeguards and the evidence itself come from your systems and processes, not from static analysis.