Standards

Last updated: Oct 26, 2026

Supported

Fluid Attacks supports these security standards in its security testing and compliance operations:

The compliance database maps the requirements of each standard to AppSec findings. Thus, you can see the mapped requirements in the Compliance section of the Fluid Attacks platform. There, you can monitor the security posture of your organization against each framework.

Others

Fluid Attacks has certifications for these standards or applies them in its services and processes. The compliance database also maps some of them to AppSec findings.

CPE v2.3 (Common Platform Enumeration): Fluid Attacks uses it as the identifier format for dependencies in platform vulnerability findings.
CREST Penetration Testing: Fluid Attacks has a CREST Penetration Testing accreditation.
CVE: Fluid Attacks uses it as the primary identifier for known vulnerabilities in platform findings.
CVSS v4.0: Fluid Attacks uses it to score the severity of vulnerabilities in platform findings, with support up to version 4.0.
CycloneDX 1.6: The Fluid Attacks platform gives SBOM exports in this format, in JSON and XML.
EPSS v4: Fluid Attacks integrates the daily exploit prediction scores from FIRST to help you prioritize vulnerabilities.
FIPS 140-2: A security standard for cryptographic modules. It applies to the hardware security modules that AWS KMS uses for encryption key management.
GDPR, Regulation (EU) 2016/679: Fluid Attacks has a GDPR alignment document and applies privacy controls in its compliance policies. Fluid Attacks also supports the GDPR - OJ L 119, 4.5.2016 requirements as a correlation framework for AppSec findings.
ISO/IEC 27001:2022: Fluid Attacks has an ISO/IEC 27001:2022 certificate and applies the controls of this standard in its compliance policies. Fluid Attacks also supports the ISO/IEC 27001:2022 Annex A requirements as a correlation framework for AppSec findings.
ISO/IEC 27017:2015: Fluid Attacks has an ISO/IEC 27017:2015 certificate and applies the controls of this standard in its compliance policies.
ISO/IEC 27018:2019: Fluid Attacks has an ISO/IEC 27018:2019 certificate and applies the privacy controls of this standard in its compliance policies.
ISO/IEC 27701:2019: Fluid Attacks has an ISO/IEC 27701:2019 certificate and applies the privacy controls of this standard in its compliance policies.
KEV: Fluid Attacks integrates this CISA catalog of actively exploited vulnerabilities to prioritize high-risk findings.
OAuth 2.0: Fluid Attacks uses it as the authorization framework for platform authentication.
OpenID Connect Core 1.0: Fluid Attacks uses it as the identity layer for platform client authentication. It adds a user identity check to OAuth 2.0.
OSV Schema v1.5.0: Fluid Attacks gets OSV advisories daily as a source for vulnerability signature updates in SCA scans.
OWASP MASTG v2 (Mobile App Security Testing Guide): Fluid Attacks applies this testing methodology in mobile application security testing (MAST) scans to examine findings against the OWASP MASVS v2.0 requirements.
PCI DSS v4.0.1: Fluid Attacks has a PCI DSS v4.0.1 Attestation of Compliance. Fluid Attacks also supports the PCI DSS v4.0 requirements as a correlation framework for AppSec findings.
SAML 2.0: Fluid Attacks uses it as the single sign-on (SSO) protocol for staff authentication in its internal tools.
SARIF v2.1.0: The CLI gives it in scanner outputs and GitHub Actions integrations. You can also upload the findings of third-party tools to the Fluid Attacks platform in this format.
SLSA v0.1: Fluid Attacks meets SLSA Level 2 for supply chain integrity. SLSA compliance documents the source, build and provenance requirements.
SOC 2®: Fluid Attacks has a SOC 2® Type II report and applies the controls of this standard in its compliance policies. Fluid Attacks also supports the SOC 2® Trust Services Criteria requirements as a correlation framework for AppSec findings.
SOC 3: Fluid Attacks has a SOC 3 report.
SPDX 2.3: The Fluid Attacks platform gives SBOM exports in this format, in JSON and XML.

Unsupported

At this time, Fluid Attacks has not mapped security requirements to these standards:

Correlation

At this time, the compliance database does not map the requirements of these standards to AppSec findings.

Others

Fluid Attacks cannot use these standards as a correlation framework for AppSec findings.

AI Software Competency: Fluid Attacks can possibly use it in generative AI security assessment practices.
Amazon EC2 Spot Ready Product: Fluid Attacks can possibly use it in cloud infrastructure security assessments.
Amazon EKS Ready Product: Fluid Attacks can possibly use it in Kubernetes container security assessments.
Amazon Linux Ready Product: Fluid Attacks can possibly use it in Amazon Linux security assessments.
Amazon RDS Ready Product: Fluid Attacks can possibly use it in database security assessments.
AWS Built-in Competency: Fluid Attacks can possibly use it in AWS partner solution security practices.
AWS Graviton Ready Product: Fluid Attacks can possibly use it in AWS Graviton infrastructure assessments.
AWS Lambda Ready Product: Fluid Attacks can possibly use it in serverless application security assessments.
AWS Outposts Ready Product: Fluid Attacks can possibly use it in hybrid cloud security assessments.
AWS PrivateLink Ready Product: Fluid Attacks can possibly use it in private connectivity security assessments.
AWS Security Incident Response Ready: Fluid Attacks can possibly use it in AWS incident response practices.
Cloud Operations Software Competency: Fluid Attacks can possibly use it in cloud operations security assessments.
Containers ISV Competency: Fluid Attacks can possibly use it in container security assessments.
CREST Incident Response: Fluid Attacks can possibly use it in incident response and cyber crisis management practices.
CREST STAR-FS Threat Led Penetration Testing: Fluid Attacks can possibly use it in DORA threat-led penetration testing for financial services.
CREST Threat Led Penetration Testing: Fluid Attacks can possibly use it in threat-led penetration testing methodologies.
DevOps ISV Competency: Fluid Attacks can possibly use it in DevOps security assessments.
Education ISV Competency: Fluid Attacks can possibly use it in security training and educational practices.
Financial Services Technology Competency: Fluid Attacks can possibly use it in financial services security assessments.
Government ISV Competency: Fluid Attacks can possibly use it in government sector security assessments.
Healthcare ISV Competency: Fluid Attacks can possibly use it in healthcare security assessments.
Machine Learning ISV Competency Migration: Fluid Attacks can possibly use it in AI and machine learning security assessments.
Migration and Modernization ISV Competency: Fluid Attacks can possibly use it in application migration security assessments.
Networking ISV Competency: Fluid Attacks can possibly use it in network security assessments.
Security ISV Competency: Fluid Attacks can possibly use it in AWS cloud security assessments.
Small and Medium Business Software Competency: Fluid Attacks can possibly use it in SMB environment security assessments.
21 CFR: Fluid Attacks can possibly use it in its security assessments for pharmaceutical and medical device clients.
ARJEL: Fluid Attacks can possibly use it in its security assessments for gaming and gambling platforms in France.
AUTOSAR: Fluid Attacks can possibly use it in its security testing services for automotive software systems.
BASEL II: Fluid Attacks can possibly use it in its security services for banking and financial institution clients.
Catalog of Problematic Data Actions and Problems (PDAP): Fluid Attacks can possibly use it in its privacy risk assessment methodologies.
CISA Minimum Requirements for VEX Apr 2023: Fluid Attacks can possibly use it in its vulnerability disclosure and reporting practices.
Cloud Security Alliance (CSA): Fluid Attacks can possibly use it in its cloud security governance assessments.
COBIT 2019: Fluid Attacks can possibly use it in its governance recommendations for client organizations.
Cobro Digital (CoDi): Fluid Attacks can possibly use it in its security assessments for digital payment systems in Mexico.
CSA CAIQ: Fluid Attacks can possibly use it in its cloud security controls assessments.
CSA STAR Level 1: Fluid Attacks can possibly use it in its cloud security controls and governance assessments.
CSA STAR Level 2: Fluid Attacks can possibly use it in its third-party cloud security controls auditing and certification practices.
CSAF v2.0: Fluid Attacks can possibly use it in its vulnerability advisory communication practices.
Data Privacy Framework (DPF): Fluid Attacks can possibly use it in its data privacy and international data transfer compliance practices.
DCID 6/3: Fluid Attacks can possibly use it in its security services for intelligence community clients with classified information.
DO-330 / DO-178C: Fluid Attacks can possibly use it in its security assessments for aviation and certification-critical systems.
DoD Instruction 8500.1 (Change 1, Oct 2019): Fluid Attacks can possibly use it in its security services for DoD and federal contractor clients.
DoD Instruction 8550.1 (Sep 2012): Fluid Attacks can possibly use it in its information assurance services for DoD environments.
Enduring Security Framework (ESF): Fluid Attacks can possibly use it in its supply chain security assessments for critical infrastructure clients.
European Regulation 2019/881 (Cybersecurity Act): Fluid Attacks can possibly use it in its product security certification practices for EU requirements.
European Regulation 2024/1689 (AI Act): Fluid Attacks can possibly use it in its AI system governance assessments for EU clients.
FIN: Fluid Attacks can possibly use it in its secure development and design-focused assessment practices.
GAMP 5 2nd Edition (2022): Fluid Attacks can possibly use it in its security validation practices for pharmaceutical clients.
Hyundai Coding Standards: Fluid Attacks can possibly use it in its automotive software security assessments for vehicle manufacturers.
IDFA: Fluid Attacks can possibly use it in its mobile application privacy assessment practices.
in-toto specification v1.0: Fluid Attacks can possibly use it in its supply chain integrity verification practices.
Infosec Registered Assessors Program (IRAP): Fluid Attacks can possibly use it in its security assessments for Australian government and public sector clients.
ISO/IEC 9001:2015: Fluid Attacks can possibly use it in its quality management system and operational excellence practices.
ISO/IEC 13485:2016: Fluid Attacks can possibly use it in its quality management practices for medical device clients.
ISO/IEC 22301:2019: Fluid Attacks can possibly use it in its business continuity and disaster recovery recommendations.
ISO/IEC 23894:2023: Fluid Attacks can possibly use it in its AI system risk management practices.
ISO/IEC 29147:2018: Fluid Attacks can possibly use it in its vulnerability disclosure and responsible security practices.
ISO/IEC 31000:2018: Fluid Attacks can possibly use it in its enterprise risk management recommendations.
ISO/IEC 37001:2025: Fluid Attacks can possibly use it in its anti-corruption compliance recommendations.
ISO/IEC 42001:2023: Fluid Attacks can possibly use it in its AI system implementation and governance practices.
ITIL 4: Fluid Attacks can possibly use it in its IT service management and operational governance practices.
KYC: Fluid Attacks can possibly use it in its anti-money laundering compliance for financial services clients.
Microsoft SSPA (DPR v10): Fluid Attacks can possibly use it in its supplier security assessment and procurement governance practices.
Motion Picture Association of America Content Protection Best Practices: Fluid Attacks can possibly use it in its content protection and media security assessments.
NIST AI 600-1 (GenAI Profile) Jul 2024: Fluid Attacks can possibly use it in its generative AI security assessment practices.
NIST AI RMF 1.0: Fluid Attacks can possibly use it in its AI system risk management framework practices.
NIST IR 8397: Fluid Attacks can possibly use it in its emerging cybersecurity practices and client guidance.
NIST SP 800-30 Rev. 1: Fluid Attacks can possibly use it in its risk assessment methodologies.
NIST SP 800-34 Rev. 1: Fluid Attacks can possibly use it in its contingency planning and disaster recovery recommendations.
NIST SP 800-37 Rev. 2: Fluid Attacks can possibly use it in its risk management framework implementation for clients.
NIST SP 800-40 Rev. 4: Fluid Attacks can possibly use it in its patch management and system update recommendations.
NIST SP 800-61 Rev. 3: Fluid Attacks can possibly use it in its incident response recommendations and practices.
NIST SP 800-108 Rev. 1: Fluid Attacks can possibly use it in its cryptographic key management and infrastructure security practices.
NIST SP 800-144: Fluid Attacks can possibly use it in its cloud computing security guidance and assessments.
NIST SP 800-207 (Zero Trust Architecture) Aug 2020: Fluid Attacks can possibly use it in its zero trust architecture implementation and recommendations for clients.
OCP SAFE: Fluid Attacks can possibly use it in its large-scale infrastructure security assessments.
OpenSSF Scorecard: Fluid Attacks can possibly use it in its security posture assessment of open-source dependencies.
OpenVEX Specification v0.2.0: Fluid Attacks can possibly use it in its vulnerability disclosure and communication practices.
OWASP AI Exchange: Fluid Attacks can possibly use it in its AI system security assessments and risk mitigation practices.
OWASP Benchmark v1.2: Fluid Attacks can possibly use it in its security testing tool validation and benchmarking practices.
OWASP CRS v4: Fluid Attacks can possibly use it in its Web Application Firewall recommendations for clients.
PCI Approved Scanning Vendor (ASV): Fluid Attacks can possibly use it in its PCI DSS compliance scanning and assessment services for client organizations.
PII: Fluid Attacks can possibly use it in its personally identifiable information protection practices.
RFC 9116 (security.txt — A File Format to Aid in Security Vulnerability Disclosure) Apr 2022: Fluid Attacks can possibly use it in its vulnerability disclosure policy communication practices.
Safe Harbor: Fluid Attacks can possibly use it in its international data transfer and privacy compliance practices.
Secure Supply Chain Consumption Framework (S2C2F) v1.1: Fluid Attacks can possibly use it in its open source dependency evaluation and supply chain security practices.
SOC 1 Type II: Fluid Attacks can possibly use it in its service organization control and audit compliance practices.
SOC 2 Type I: Fluid Attacks can possibly use it in its point-in-time service organization control and audit practices.
SOX: Fluid Attacks can possibly use it in its security services for publicly-traded financial companies.
SSVC (Stakeholder-Specific Vulnerability Categorization) v2025.9.5 (Jan 2025): Fluid Attacks can possibly use it in its vulnerability prioritization and response framework for clients.
SWID Tags (ISO/IEC 19770-2) 2015: Fluid Attacks can possibly use it in its software asset inventory and lifecycle management practices.
TCPA: Fluid Attacks can possibly use it in its communication security and privacy compliance for regulated clients.
Transparency & Consent Framework (TCF) v2.3 (2025): Fluid Attacks can possibly use it in its consent management and data transparency practices for digital advertising clients.
UNECE WP.29 R155 (Vehicle Cybersecurity): Fluid Attacks can possibly use it in its automotive cybersecurity assessments for vehicle manufacturers.
WCAG 2.2: Fluid Attacks can possibly use it in its web application accessibility assessment practices.

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' pentesting team, complete this contact form.

Standards

Supported

Correlation

Others

Unsupported

Correlation

Others

On this page