Compliance Reports¶

SentriKat generates reports that provide evidence of your vulnerability management and communicate your security posture to stakeholders. Whether you meet a regulation is for you and your auditor to assess.

Available Reports¶

NIS2 Article 21 Compliance Report¶

Maps your vulnerability management activities to the requirements of the EU Network and Information Security Directive (NIS2), specifically Article 21 on cybersecurity risk-management measures.

The report covers:

Generate:

1. Go to Settings → Compliance
2. On the NIS2 Compliance Report card, click JSON, CSV or PDF
3. The file downloads

The PDF contains:

• Executive summary
• Detailed mapping of each Article 21 requirement
• Evidence of vulnerability management activities
• Remediation timelines and status
• Recommendations for gaps

Exploited-vulnerability compliance report¶

Tracks compliance with the US directive on exploited vulnerabilities, which requires federal agencies (and is recommended for all organizations) to remediate exploited vulnerabilities by the due date published for each.

The report shows:

• Total exploited vulnerabilities affecting your inventory
• Remediation status (on-time, overdue, in-progress)
• Due date compliance rate
• Breakdown by severity and product
• Trend over time

Generate:

1. Go to Settings → Compliance
2. On the Exploited Vulnerabilities Compliance Report card, click JSON or CSV
3. The file downloads

Executive Summary PDF¶

A high-level PDF report designed for management and board-level stakeholders:

• Risk Score: Overall vulnerability risk score (0-100)
• KPIs: Key performance indicators (mean time to remediate, open critical count, compliance rate)
• Trends: 30/60/90-day vulnerability trends
• Top Risks: Highest-priority unresolved vulnerabilities
• Agent Coverage: Percentage of assets with active agents

Generate:

1. Go to Settings → Compliance
2. On the Executive Summary card, click PDF or JSON
3. The file downloads

Data Export¶

CSV Export¶

Export vulnerability data as CSV for use in spreadsheets or external tools:

1. On the dashboard, or in Products
2. Apply any filters (severity, status, organization)
3. Click Export > CSV

Exported fields include: CVE ID, severity, CVSS score, exploit probability, product, vendor, status, confidence tier, due date, organization.

Excel Export¶

Same as CSV but in .xlsx format with formatted columns:

1. On the dashboard, or in Products
2. Apply filters
3. Click Export > Excel

Scheduled Reports¶

Automate report delivery on a schedule:

1. Go to Inventory > Scheduled Reports
2. Click Create Schedule
3. Configure:
4. Report Type: NIS2 Article 21, exploited-vulnerability compliance, or Executive Summary
5. Frequency: Weekly, monthly, or quarterly
6. Day/Time: When to generate
7. Recipients: Email addresses for delivery
8. Format: PDF (compliance reports) or CSV/Excel (data exports)
9. Save

Scheduled reports are generated automatically and emailed to the configured recipients.

There is no report archive¶

A report is not stored anywhere. It is built in memory the moment you ask for it, and then downloaded or emailed. There is no history to browse and nothing to re-download later: if you need a copy, keep the one you were given.

That is less of a limitation than it sounds, because a report is a view of data that is kept. Regenerate it and you get the same period back, with whatever has been learned since.

The data underneath has its own retention settings, separate from reports. On-premises, the data lives in your own database for as long as you keep it.

API Access¶

Generate reports programmatically:

# NIS2 Article 21 report as PDF
curl -b cookies.txt \
  "https://sentrikat.example.com/api/reports/compliance/nis2?format=pdf" \
  -o nis2_report.pdf

# Executive Summary
curl -b cookies.txt \
  "https://sentrikat.example.com/api/reports/executive-summary" \
  -o executive_summary.pdf

# Export the inventory (one row per endpoint and product)
curl "https://sentrikat.example.com/api/products/export.csv" \
  -b cookies.txt \
  -o inventory.csv

# Export the vulnerability matches
curl "https://sentrikat.example.com/api/reports/export/csv" \
  -b cookies.txt \
  -o matches.csv

Framework gap-analysis reports¶

The Compliance Pack adds signed reports for DORA, PCI-DSS, ISO 27001 and SOC 2. The sections below describe PCI-DSS, ISO 27001 and SOC 2 in detail. Each report is exported as JSON or PDF with PASS / PARTIAL / FAIL per control plus an HMAC-SHA256 integrity block at the end of each export. The reports provide evidence for the requirements they list. Whether you conform to a framework is assessed by your auditor, not by SentriKat.

PCI-DSS v4.0¶

Focus areas covered:

• Req 6.3: Identify security vulnerabilities in-house and from third parties; rank by risk. SentriKat's severity ranking plus vendor advisory sync provide evidence for this requirement.
• Req 6.3.1: Rank vulnerabilities by risk. SentriKat ranks by a composite of confirmed exploitation, probability and CVSS, and the risk exception workflow (Risk Exceptions) records the "documented decisions" expectation.
• Req 11.3: External and internal vulnerability scans at least quarterly and after any significant change. Scan history from your deployed agents is evidence for the cadence; you document the quarterly cadence itself.
• Req 11.3.1: High-risk and critical vulnerabilities are expected to be remediated within 30 days. The Remediation module with a custom 30-day SLA policy for Critical and High records your remediation times; see Remediation.

ISO/IEC 27001:2022¶

Focus areas covered:

• Annex A.8.8, Management of technical vulnerabilities. SentriKat's vulnerability lifecycle (detection, assignment, remediation, closure) provides evidence for this control.
• Annex A.8.16, Monitoring activities. Agent scan history, agent heartbeats and the Trending Dashboard produce monitoring evidence.
• Annex A.5.24, Information security incident management planning and preparation. Audit trails on every finding, assignment and closure produce supporting evidence.

The ISO 27001:2022 report lists each applicable Annex A control with its status based on your current SentriKat configuration (for example "A.8.8 PASS, last scan 2026-04-15 09:00 UTC, all findings have assignments, average MTTF within SLA").

SOC 2 (Trust Services Criteria)¶

Focus areas covered:

• CC6.6, Logical access / vulnerability management: evidence of vulnerability scanning with documented remediation
• CC7.1, Detect and respond to system events: monitoring evidence
• CC7.2, Analyze events for anomalous or unauthorized activity: audit log export
• CC7.4, Incident response: audit trail of every finding and remediation action, exportable as JSON or PDF

The SOC 2 report is structured for auditors: one section per applicable CC criterion, with PASS/PARTIAL/FAIL and links to the underlying findings or audit entries.

HMAC-SHA256 integrity block¶

Every signed report (PCI-DSS, ISO 27001, SOC 2, NIS2, DORA, BOD 22-01) ends with an integrity block:

{
  "integrity": {
    "algorithm": "HMAC-SHA256",
    "key_id": "sentrikat-report-v1",
    "signature": "a1b2c3d4e5f6...",
    "generated_at": "2026-04-15T09:00:00Z"
  }
}

The signature covers the canonical serialization of the entire report body minus the integrity block itself, so auditors can tamper-check by:

1. Computing HMAC-SHA256(report_body_without_integrity, integrity_key) themselves.
2. Comparing the result to the integrity.signature field.

The integrity key is per-organization, rotatable from Admin → Integrity Keys. Rotation invalidates old reports but keeps them readable (they still have their old signature embedded).

Generating a report¶

From the UI:

1. Settings → Compliance.
2. On the card of the report you want, click a format button:
   • JSON, PDF or DOCX on the PCI-DSS, ISO 27001, SOC 2 and DORA cards
   • JSON, CSV or PDF on the NIS2 card
   • JSON or CSV on the Exploited Vulnerabilities Compliance Report card (BOD 22-01)
   • PDF or JSON on the Executive Summary card
3. The file downloads.

The cards have no scope or date picker.

Via the API:

curl -sf \
  -b cookies.txt \
  "https://sentrikat.example.com/api/reports/compliance/pci-dss" \
  -o pci-dss-2026-04.json

Next Steps¶

• Dashboard for real-time vulnerability overview
• Vulnerabilities for detailed vulnerability management
• SBOM Export for CycloneDX / SPDX / STIX export
• Remediation for assignments and SLA policies
• Risk Exceptions for accept-the-risk workflow
• SIEM Integration for forwarding events to your SIEM