How do SuperClue compliance features work?

• Verify your domain (see scanning docs).
• Pick a framework, for example CERT-In or SEBI CSCRF.
• Select all modules or a subset. Each module is charged at 0.25 to 0.35 credits by default, depending on the framework.
• Read the results per module and add internal evidence where the scan asks for it.

The 14 frameworks hold 171 modules in total. The full lists for the two largest are on the CERT-In checks and SEBI CSCRF checks pages.

Only what is visible from outside: TLS, security headers, cookies, DNS records, exposed files, error pages and public pages such as security.txt. Each module ends as completed, not applicable or requires access. Board policies, log retention, backups and training always need internal evidence.

Comparison takes the latest completed scan of each framework for one target and shows a score per framework. It lists frameworks with gaps or no scan yet. A framework where no module could be assessed is shown as not assessed rather than 0%. A comparison costs 5 credits, and a PDF export costs 3 credits.

Yes. Define your controls and map each one to scanner modules. When you assess the framework, a control passes only if every mapped module has run and left no open finding. Controls with nothing mapped, or whose modules never ran, are marked not assessed and left out of the score.

SuperClue also maps scan findings to ISO 27001 (114 controls), NIST SP 800-53 (170) and GDPR (99).

You log an incident with its category, affected systems, containment actions and the time it was detected. SuperClue sets the 6-hour CERT-In deadline from that time. The report itself goes to CERT-In by email or the CERT-In portal, outside SuperClue. A platform administrator then records the channel used and the reference number CERT-In issued, and SuperClue notes whether the report was within the deadline.

SuperClue does not file anything with CERT-In. SOC logs are kept for 180 days by default, the CERT-In minimum. See SOC docs.