ISO/IEC 27001:2022
Annex A control mapping
Findings mapped to named Annex A controls, so a gap in your ISMS evidence pack points at the control it belongs under rather than at a severity label.
RedForge / Compliance
Evidence for ISO 27001, SOC 2 and DPDP.
Every finding is tagged against the frameworks your auditor already works through, so the report you get is usable as evidence rather than needing to be translated into it first.
Read this before anything else on the page. We are not a certification body. A RedForge assessment is not an accredited audit, an audit opinion, or a compliance statement. If you need an ISO 27001 certificate or a SOC 2 report for a customer or an investor, you need an accredited auditor — what we provide is the evidence that auditor will ask you for.
Frameworks
What each finding is tagged against.
Mapping happens at the finding level, not the report level. A single access control failure lands under an Annex A control, a Trust Services criterion, a DPDP section and a CWE at the same time, because that is how the people reading it will each need to see it.
SOC 2
Trust Services Criteria
Mapped to the Common Criteria families your auditor works through, covering the security principle that most Type II reports lean on.
DPDP Act 2023
Obligations by section
Each finding tied to the section it bears on and the penalty attached, so exposure reads in rupees rather than severity labels. See the DPDP page.
OWASP Top 10 & ASVS
Web and API verification
Web and API findings classified against the OWASP Top 10 and the Application Security Verification Standard, plus the OWASP Top 10 for LLM Applications where an assistant is in scope.
OWASP MASVS
Mobile verification standard
Android and iOS findings mapped to MASVS and the OWASP Mobile Top 10, and bound to the exact build by SHA-256. See the mobile page.
CWE
Weakness classification
Every finding carries its CWE identifier, which is what lets your tracker, your SARIF feed and your auditor talk about the same issue in the same terms.
Frameworks not listed here are not covered. We do not perform PCI-DSS or GDPR assessments, and we would rather say so on this page than in a kickoff call.
What you receive
Four artefacts an auditor will actually accept.
Control mapping report
Findings grouped by framework and named control, so you can drop the relevant rows straight into an ISMS evidence pack or a SOC 2 readiness worksheet without re-tagging anything by hand.
Security questionnaire pack
The questions buyers actually ask, from the SIG, CAIQ and SOC 2 Common Criteria families, answered from your evidence. The ones this kind of testing cannot answer are marked as such, rather than left blank for someone to fill in optimistically.
Letter of attestation
One page, signed, forwardable. Scope, method, testing window, findings by severity, retest status — and the coverage disclosure in the same size type, so nobody can read it as a clean bill of health it does not claim to be.
SARIF for your Security tab
Findings land in GitHub code scanning with their CWE identifiers, stay until they are fixed, and close themselves when they stop reproducing — which is the difference between an audit trail and a PDF nobody reopens.
The honest limits
Where the line is.
Does this make us ISO 27001 certified?+
No. ISO 27001 certification is issued by an accredited certification body after a formal audit of your information security management system, most of which is organisational rather than technical.
A penetration test is one input to that process. We give you the technical evidence mapped to the Annex A controls it bears on, which shortens the work — it does not replace the auditor.
Can we show your report to our SOC 2 auditor?+
Yes, and you may share it with auditors, insurers, investors and regulators without restriction — that is written into our terms. Many SOC 2 engagements expect an independent penetration test as evidence for the security principle, and this is built to be that evidence.
Are you CERT-In empanelled?+
No. If your requirement specifically names a CERT-In empanelled auditor, we will tell you that rather than take the work. Being wrong about this once is the whole business.
Do you cover PCI-DSS or GDPR?+
No. Our mapping covers ISO/IEC 27001:2022, SOC 2, DPDP 2023, the OWASP standards and CWE. PCI-DSS and GDPR are not in scope, and we would rather you knew that from this page than discover it after signing.
What happens to controls the test could not reach?+
They are listed as unreached, with the reason. The coverage table travels with the control mapping for exactly this purpose: a control with no finding against it might be satisfied, or might simply never have been examined, and those are not the same thing.
An auditor who cannot tell the difference will assume the worse one, and they will be right to.
Working towards an audit or a questionnaire?
Tell us which framework and which deadline. We will tell you what an assessment can evidence, and what it cannot — before you buy it.