Compliance
NHI identity evidence across frameworks
Our scanning maps nonhuman identity findings to the control language your assessors already use. The evidence is produced from the same discovery and remediation work we run against your environments, not from credentials we hold ourselves.
Our own security posture
Review Avistar’s security policies, trust documentation, and compliance posture in one place.
Frameworks we map NHI identity findings to
The frameworks below are the ones Avistar scans for and produces evidence against. Each mapping is scoped to machine identity lifecycle, least privilege, and continuous monitoring, not a claim that Avistar is certified to that standard.
| Framework | Relevant controls | NHI identity evidence produced |
|---|---|---|
| ISO 27001 | A.5.16, A.5.18, A.8.2, A.8.9 | Identity inventory with owners, privilege review records, credential lifecycle log |
| SOC 2 | CC6.1, CC6.2, CC6.3, CC7.2 | Continuous monitoring of logical access for nonhuman identities and remediation history |
| NIST 800-53 | AC-2, AC-6, IA-5, CA-7 | Account management, least privilege, authenticator management, continuous assessment |
| FedRAMP | AC-2, IA-5, CA-7 | Inventory and monitoring artifacts for service and workload identities |
| HIPAA Security Rule | §164.308(a)(4), §164.312(a)(1), §164.312(d) | Access authorization, unique identification, and authentication management for system accounts |
Bring machine identities into your control narrative
Walk through how NHI identity findings map to the frameworks in your current scope.