The framework controls your infrastructure actually exercises
Every audytx scan maps its AWS Terraform and CloudFormation security findings to the SOC 2, PCI-DSS, and HIPAA controls they touch, and carries AWS FSBP, Well-Architected and NIST references — so you know where to focus compliance evidence before infrastructure merges. It's a signal to work from, never a certification — here's what that means in practice.
What the compliance mapping means
Every finding can carry framework references — the framework plus the specific control it helps with. One scan rolls them into a per-framework summary in the PR comment and the MCP response.
Coverage is a signal, not a verdict
Coverage means our checks exercise signals that help with a control. It is not a certification, not an audit result, and not evidence that you are compliant.
Which frameworks
Each mapping is the subset of controls a Terraform or CloudFormation configuration can actually speak to. Purely organizational controls — provisioning workflows, incident-response runbooks, physical access — stay out, because static analysis can't see them.
SOC 2
AICPA Trust Services Criteria. Logical-access, authorization, transmission, change-management, and availability criteria a configuration can speak to. Governance and process criteria stay out.
PCI-DSS v4
Network-segmentation, encryption, access-restriction, and audit-trail requirements you can express in infrastructure code. The broader standard's process requirements don't map from HCL, so we don't claim them.
HIPAA Security Rule
The technical safeguards a configuration can influence under 45 CFR §164: access control, encryption, audit controls, transmission security. Administrative safeguards are out of scope.
Findings also carry AWS FSBP (AWS Foundational Security Best Practices), AWS Well-Architected and NIST 800-53 Rev. 5 references. audytx keeps no canonical control list for these, so those references are surfaced as-is rather than intersected against a fixed subset.
Three surfaces, one mapping
The same per-framework summary rides along wherever findings appear — for the human reviewing the pull request and the agent that wrote the code.
The PR comment
Carries a collapsed Compliance signal section summarizing which frameworks and controls the scan's findings touch.
The MCP response
The scan_terraform and scan_cloudformation responses carry a compliance_coverage block — so a coding agent
sees the mapping next to the findings it summarizes.
Each finding
Renders its own Compliance refs line, naming the framework and control that finding helps with.
What counts toward coverage
A check that ran and reached a verdict counts — even one the context graph reasoned away.
Use the mapping to decide where to gather compliance evidence first; the evidence itself still comes from your systems and processes, and audytx's own certification status is on the Trust page.
Start free
Install on GitHub, open a pull request, and read the framework-mapped verdict in the comment. The Free plan includes 100 scans a month, and the free tier stays free.
Common questions
Does audytx make my Terraform SOC 2 ready?
No. audytx maps findings to the SOC 2, PCI-DSS v4, and HIPAA controls your infrastructure exercises so you know where to gather evidence first. It is not a certification, an audit result, or proof of compliance.
What compliance frameworks does audytx support?
audytx maps AWS Terraform and CloudFormation findings to SOC 2 (AICPA Trust Services Criteria), PCI-DSS v4, and the HIPAA Security Rule, and also surfaces AWS FSBP, AWS Well-Architected and NIST 800-53 Rev. 5 references. Each SOC 2, PCI-DSS and HIPAA mapping is an IaC-scoped subset — the controls an infrastructure-as-code configuration can actually speak to, never the organizational controls static analysis can't see.
Can a Terraform scanner prove HIPAA compliance?
No. A Terraform scanner can map findings to the HIPAA Security Rule technical safeguards your configuration influences — access control, encryption, audit controls, transmission security — but administrative safeguards and the evidence itself come from your systems and processes, not from static analysis.