What can a SuperClue compliance scan tell you?

Which compliance frameworks can SuperClue scan for?

There are 14 framework scans: CERT-In (18 modules), SEBI CSCRF (22), RBI Cyber Security (12), IRDAI (10), DPDP Act (11), telecom security under DoT rules (10), PCI DSS v4.0.1 (14), ISO 27001:2022 (12), HIPAA (12), SOC 2 Type II (13), NIST CSF 2.0 (13), NIS2 (12), EU Cyber Resilience Act (7) and EU DORA (5). Each has its own module list and price.

Compare the 14 frameworks

Does a SuperClue scan certify that we are compliant?

No. SuperClue is not an auditor or a regulator and does not certify anyone. A framework scan maps what is visible from your public website, such as TLS, security headers, DNS records, disclosure pages and exposed files, to the framework controls. It helps you assess your position before an audit.

What about controls that cannot be seen from outside?

Those modules end as requires access instead of pass or fail. The result lists the external signals found and the internal evidence an assessor will ask for, such as a policy or a process record. You collect that evidence yourself.

How much does a framework scan cost?

Framework scans cost 0.25 to 0.35 credits per module, depending on the framework. A full SEBI CSCRF scan, for example, has 22 modules at 0.30 credits, which is 6.6 credits. A framework comparison costs 5 credits and a PDF export 3 credits.

Does SuperClue file CERT-In incident reports for us?

No. You submit the report to CERT-In yourself. SuperClue records how you submitted it (email, portal or another channel), so you keep a record. Nothing is filed with CERT-In automatically.

How long are security logs kept?

SOC logs are kept for 180 days by default, which matches the CERT-In minimum. Raw telemetry used for threat hunting is kept for 7 days.

Can findings be mapped to other standards?

Yes. Findings can be mapped to ISO 27001 (114 controls), NIST SP 800-53 (170 controls) and GDPR (99 entries). You can also define custom frameworks with your own controls.