Introduction

Achieving security compliance requires demonstrating that your application has been assessed for vulnerabilities and meets defined security standards. Astra Pentest fulfills the Vulnerability Assessment and Penetration Testing (VAPT) requirements for major compliance frameworks, bringing you significantly closer to certification. This guide outlines how Astra supports each framework and what additional steps remain outside Astra's scope.

Supported Compliance Frameworks

Astra Pentest directly addresses VAPT requirements for the following frameworks:

• PCI-DSS

• GDPR

• HIPAA

• SOC 2

• ISO 27001

How Astra Helps Per Framework

PCI-DSS

Protects cardholder data and ensures secure payment transactions.

What Astra covers:

• Continuous comprehensive scanning for vulnerable security regions

• Checking for injection flaws including SQL, LDAP, and CRLF injection

• Checking for Cross-Site Scripting (XSS) vulnerabilities

• Checking for broken authentication and session management issues

• Checking for insecure communications and man-in-the-middle attack vectors

• Testing login-based attacks to find privilege escalation vulnerabilities

What you need to handle outside Astra:

• Installing and maintaining a firewall

• Protecting stored cardholder data

• Encrypting cardholder data transmission

• Tracking and monitoring network access

• Maintaining a comprehensive cybersecurity policy

GDPR

Governs how personal data of EU residents is collected, processed, and stored.

What Astra covers:

• Frequent pentesting and scanning to identify compliance gaps

• Exposing SQL injection vulnerabilities before they can be exploited

• Finding insecure data communication issues such as use of HTTP

• Detecting source code leakage

What you need to handle outside Astra:

• Having legal justification for data processing activities

• Maintaining a clear privacy policy

• Creating an internal security policy for team members

• Establishing a data breach notification process

• Designating a GDPR compliance officer

HIPAA

Protects the privacy and security of protected health information (PHI) in the US.

What Astra covers:

• Continuous scans and regular pentests to identify loopholes in healthcare data security

• Scanning for vulnerabilities that allow unauthorized access to sensitive data

• Scanning for vulnerabilities that could leak electronic protected health information (ePHI)

• Rescanning after patching to confirm no additional risks remain

What you need to handle outside Astra:

• Designating a HIPAA Privacy Officer

• Identifying and managing risks to PHI privacy

• Developing policies for using and disclosing PHI

• Reviewing and maintaining Business Associate Agreements

SOC 2

An auditing standard focused on security, availability, processing integrity, confidentiality, and privacy.

What Astra covers:

• Upholding Security, Privacy, and Confidentiality within SOC 2 Trust Services Criteria

• Generating a SOC 2 compliance-specific report upon remediation

• Detecting source code leakage

• Identifying privilege escalation attack vectors

• Exposing server-side template injection vulnerabilities

What you need to handle outside Astra:

• Determining your SOC 2 audit scope and objectives

• Selecting your Trust Services Criteria

• Performing a Gap Assessment with a recognized compliance provider such as Vanta, Sprinto, or Drata

ISO 27001

An international standard for Information Security Management Systems (ISMS).

What Astra covers:

• Regular pentests and scans of websites, APIs, and networks

• Testing against industry frameworks including OWASP Top 10 and SANS Top 25

• Helping maintain the three ISMS cornerstones — Confidentiality, Integrity, and Availability

What you need to handle outside Astra:

• Writing a top-level Information Security Policy

• Defining a risk assessment methodology

• Performing risk assessment and risk treatment

Troubleshooting

Not sure which compliance framework applies to your organization

• PCI-DSS applies if you handle credit card payments

• GDPR applies if you process personal data of EU residents

• HIPAA applies if you handle US healthcare data

• SOC 2 and ISO 27001 apply broadly to service organizations seeking to demonstrate security best practices

• Contact your account manager if you need guidance on which framework to prioritize

Compliance report not available in dashboard

• Navigate to Reports and select your completed pentest. Compliance-specific reports are generated after remediation is complete and a re-scan has been performed.

• If the report is still unavailable, raise a support ticket from your dashboard.

Vulnerabilities still showing on compliance page after fixing

• Ensure fixed vulnerabilities are marked as Ready for Review and a re-scan has been requested and completed.

• See How to Request a Rescan After Fixing Vulnerabilities for details.

Next Steps

• Overview of Compliance Page

• How to extend the validity of Astra's Pentest Certificate

• Validity of Vulnerability Assessment, Vetted, and Pentest Reports

• What are the different types of reports