"Is this tool compliant?" is the wrong question — no scanner is certified compliant with anything. The right question is what a given framework requires of your application security testing, and whether a tool's reports give you usable evidence for it. This hub breaks that down framework by framework, sourced from each framework's own text or official guidance, then shows exactly which of Vooki Pro's compliance reports map to it.
"Start 7-Day Trial" submits a request — Vooki Pro's team reviews it and sends the trial license and installation instructions; it is not an instant self-serve activation.
A compliance report is evidence of testing, not a certificate of compliance. Vooki Pro's own report documentation says this explicitly — it shows what was scanned, what was found, and how each finding maps to the framework's controls.
Not every framework mandates vulnerability scanning the same way. PCI DSS and NIST SP 800-53 name it directly with a defined cadence; HIPAA, GDPR, and ISO 27001 require risk-based testing without prescribing a method; SOX doesn't address it in the statute at all.
Vooki Pro generates framework-mapped reports for 7 frameworks directly from scan results — no manual remapping of findings to controls.
Requirement 11.3 names vulnerability scanning directly: quarterly internal and external scans, off-cycle scans after significant changes.
The Security Rule requires a risk analysis of threats to ePHI. It doesn't name scanning, but HHS guidance treats it as a recognized way to meet that requirement.
Article 32(1)(d) requires a process for regularly testing and evaluating the effectiveness of your security measures — risk-based, not a fixed checklist.
Annex A.8.8 "Management of technical vulnerabilities" — one of 93 controls in the 2022 revision's Technological theme.
RA-5 "Vulnerability Monitoring and Scanning" names scanning explicitly, with scan cadence and remediation timeframes left as organization-defined parameters.
Section 404 doesn't mention vulnerability scanning — auditors typically assess it as an IT general control supporting financial-reporting-system integrity.
Not a compliance law, but the baseline most assessors expect. Vooki Pro currently maps to the 2021 edition; OWASP published an updated 2025 list in November 2025.
| Framework | Names vulnerability scanning? | Vooki Pro report |
|---|---|---|
| PCI DSS v4 | Yes — Requirement 11.3, quarterly internal + external | HTML / PDF, mapped to PCI DSS v4 |
| NIST SP 800-53 | Yes — RA-5, org-defined schedule | HTML / PDF, mapped to NIST 800-53 |
| ISO/IEC 27001 | Named control (A.8.8), method not prescribed | HTML / PDF, mapped to ISO 27001 |
| HIPAA | Not by name — risk analysis required | HTML / PDF, mapped to HIPAA safeguards |
| GDPR | Not by name — regular testing duty (Art. 32) | HTML / PDF, mapped to GDPR Art. 32 |
| SOX | No — assessed as an IT general control by auditors | HTML / PDF, mapped to SOX-relevant controls |
| OWASP Top 10 | Not a law — de facto testing baseline | HTML / PDF, mapped to OWASP Top 10 2021 |
A compliance report is evidence of testing, not a certificate of compliance — your assessor decides what it means for your programme.
More detail is in the report generator documentation · or contact us
OWASP Top 10:2025 (official)
PCI Security Standards Council — document library (PCI DSS v4.0.1)
HHS — HIPAA Security Rule risk analysis guidance
GDPR Article 32 (full text mirror)
ISO/IEC 27001:2022 (official standard page)
NIST SP 800-53 Rev. 5 (official catalog)
Vooki Pro: live features.html, docs/reports.html, docs/cli.html, docs/findings.html (verified 2026-10-23).
No credit card required — submit a request and the team will send your trial license and installation instructions.