The actual PDF you receive follows this format with your company’s measured findings across every framework you sell into. Per-framework coverage matrix, cross-framework gap table, and a remediation list ranked by how many audits each fix advances. Below is the full structure with sample data from a specimen healthtech SaaS pursuing SOC 2, HIPAA, and ISO 27001.
Scope: 1 production environment (AWS us-east-1, Microsoft 365) · Scan date: March 18, 2026 · Frameworks in scope: SOC 2, HIPAA, ISO 27001, NIST CSF 2.0 (PCI: limited — card data outsourced to Stripe)
Northwind is in good shape for SOC 2 but has five cross-cutting gaps that hold back every framework at once. The headline finding: the same eight remediations close 23 distinct control gaps across all four frameworks. Page 2 lists the gaps; Page 3 sequences the fixes by how many audits each one advances.
Live read-only configuration metadata was pulled from the connected environments (AWS via SecurityAudit + ReadOnlyAccess IAM role; Microsoft 365 via Service Principal with Reader + Security Reader) on the scan date above. Each finding is mapped to the relevant control in every in-scope framework and cites the telemetry signal that produced it. No PHI, no customer data, no card data was accessed.
Specimen findings shown. “Frameworks” counts how many in-scope audits this single gap touches — the higher the number, the more leverage in fixing it.
| Control gap | Maps to | Frwks | Severity |
|---|---|---|---|
| MFA not enforced on 9 privileged accounts. Admin access to AWS + M365 without MFA on 9 of 24 privileged users. signal: iam-list-users, aad-privileged-roles |
SOC 2 CC6.1 ISO A.8.5 HIPAA 164.312(d) CSF PR.AA |
4 | High |
| No centralized log monitoring / alerting. CloudTrail + M365 audit logs retained but not aggregated to a SIEM; no alerting on privileged activity. signal: cloudtrail-describe-trails, no-siem-sink |
SOC 2 CC7.2 ISO A.8.15 HIPAA 164.312(b) CSF DE.CM |
4 | High |
| Incident-response plan never exercised. IR plan documented Aug 2025; no tabletop or drill on record in the last 12 months. signal: intake-q7 (process control) |
SOC 2 CC7.4 ISO A.5.24 HIPAA 164.308(a)(6) CSF RS |
4 | High |
| No formal vendor / subprocessor risk review. 14 subprocessors with no documented security review or register. signal: intake-q9 (process control) |
SOC 2 CC9.2 ISO A.5.19 HIPAA 164.308(b) CSF GV.SC |
4 | Medium |
| Backup recovery never tested. Automated RDS + S3 backups configured; no documented restore test. signal: rds-describe-db-snapshots, intake-q11 |
SOC 2 A1.3 ISO A.8.13 HIPAA 164.308(a)(7) CSF RC |
4 | Medium |
3 S3 buckets allow non-TLS access. Bucket policies don’t deny aws:SecureTransport=false.signal: s3-get-bucket-policy |
SOC 2 CC6.7 ISO A.8.24 HIPAA 164.312(e) CSF PR.DS-02 |
4 | Medium |
| Access reviews not performed. No evidence of periodic least-privilege review; 6 dormant accounts >90 days. signal: iam-credential-report |
SOC 2 CC6.2 ISO A.5.18 HIPAA 164.308(a)(4) CSF PR.AA |
4 | Medium |
| No documented change-management approvals. Production deploys lack recorded review/approval separation. signal: intake-q14 (process control) |
SOC 2 CC8.1 ISO A.8.32 CSF PR.PS |
3 | Medium |
The full report lists all 23 control gaps with their per-framework mappings, severity, and the telemetry signal behind each. Findings are cross-referenced to every in-scope framework.
Eight fixes close 23 gaps across all four frameworks. The first three alone — MFA, centralized log monitoring, and an IR tabletop — each advance SOC 2, HIPAA, ISO 27001, and NIST CSF simultaneously. You fix once; the gap closes in four audits.
Projected coverage after the 30-day plan: SOC 2 ~94% · HIPAA ~91% · ISO 27001 ~90% · NIST CSF ~92% — audit-ready, with evidence assembled.
Plan delivered as a working document. Your team executes; on a subscription, Aegis AI re-scans and refreshes the coverage matrix every cycle.
$1,995 one-time. Connect a cloud (read-only, revocable in one click), answer ten short questions, and your cross-framework PDF arrives within hours. Async, self-service throughout. Credits 100% to month one of any tier within 30 days.
Run my Snapshot — $1,995 →