TotulDigital
EN
EnglishRomânăPortuguêsEspañol
Client Portal Get Started
HELP ARTICLE • Updated 8 October 2026

Compliance and evidence

The Compliance screen scores your organisation against twelve frameworks, control by control, from what the monitoring actually sees. It never marks a control as passed on faith.

The twelve frameworksTwo kinds of evidenceWhat each status meansClosing a gap
PART 01

The twelve frameworks

FrameworkHow it is mapped
NIS2 Directive and CIR (EU) 2024/2690By hand, to the Directive's Article 21 measures and the Implementing Regulation's annex.
DORA (EU) 2022/2554By hand, to ICT risk management, incident and testing requirements.
NIST Cybersecurity Framework 2.0By hand, to the six functions and their categories.
ISO/IEC 27001:2022By hand, to Annex A controls.
CIS Controls v8By hand, to the safeguards.
UK NCSC Cyber Assessment FrameworkBy hand, to the objectives and principles.
UAE Information Assurance StandardsBy hand, to the management and technical controls.
GDPR Article 32From tags on every detection rule and hardening check.
PCI DSSFrom tags on every detection rule and hardening check.
NIST SP 800-53From tags on every detection rule and hardening check.
SOC 2From tags on every detection rule and hardening check.
HIPAA Security RuleFrom tags on every detection rule and hardening check.
PART 02

Two kinds of evidence

01

Activity

Events, the hardening score, open vulnerabilities, how many machines report, administrators' two-factor sign-in.

02

Configuration

Every hardening check carries references to EU data protection, CIS v8, PCI DSS, NIST, SOC 2 and HIPAA, so a failing check is a named gap under each.

A control takes the worst of its evidence: one failing check makes it a gap, however much else passes.

PART 03

What each status means

StatusMeaning
EvidencedThe monitoring shows the control working, over the selected period.
GapThe monitoring shows something wrong, and names it: the failing checks, the hosts, the vulnerabilities.
No dataNothing the monitoring can see decides it: backups, suppliers, training, policies. Record it to evidence it.
OrganisationalEvidenced by your own records rather than by monitoring.
—The period is before monitoring began.
"No data" is not a passMeasures such as backups, supplier security and staff training cannot be read from logs. The screen will not count them until they are evidenced.
PART 04

Closing a gap

  1. Open the control: it lists the failing checks under it, by host.
  2. Each check says what is wrong and how to fix it; the fix is on the server, not in the portal.
  3. After the fix, the next scan (every few hours) or the next events change the evidence. The score history shows the trend.

The evidence pack (JSON) exports the framework's controls with their evidence for your auditor.

KEEP READING

Related

NIS2 explainedWhat the Directive asks for, measure by measure. ReportsThe report for management and the auditor.
SUPPORT

Still stuck?

Write to us with what you tried and what you saw. A person answers, in writing, on business days.