Security Compliance Without the Scramble
Your auditors want evidence. Your scanners produce noise. DefectDojo closes the gap.
DefectDojo is the open-source unified vulnerability management platform that turns raw AppSec findings into documented, audit-ready proof of your security program. Aggregate every scanner, enforce remediation SLAs, and generate compliance reports on demand instead of rebuilding spreadsheets every audit cycle.
Compliance Is a Data Problem. Treat It Like One.
Every security compliance framework asks the same core questions: what vulnerabilities exist, how fast do you fix them, and can you prove it?
Most AppSec teams can't answer those questions without a fire drill. Findings live in a dozen disconnected scanners. Remediation timelines live in tickets. Exceptions live in email threads. When the audit arrives, someone spends weeks stitching it all together by hand.
DefectDojo ends that cycle. It aggregates findings from your entire security stack into a single system of action, then deduplicates, enriches, and tracks every finding through its full lifecycle. Every import, status change, risk acceptance, and remediation is recorded. Your compliance evidence builds itself as your team does the work, so audit readiness becomes a byproduct of good security instead of a separate project.
Security teams use DefectDojo to report on security posture and compliance across frameworks including SOC 2, PCI-DSS, and the EU Cyber Resilience Act.
Which vulnerability management tools help with FedRAMP or CMMC POA&M reporting?
Scanners such as Tenable, Qualys and Rapid7 produce the vulnerability data a POA&M is built from, but the POA&M itself is often assembled by hand in spreadsheets. DefectDojo Pro keeps a FedRAMP-style POA&M for each system that syncs from findings from every scanner, and exports monthly continuous monitoring (ConMon) snapshots as the FedRAMP POA&M Excel workbook and as OSCAL. It also scores CMMC Level 2 self-assessments against NIST SP 800-171 Rev 2.
| Requirement | How DefectDojo Pro handles it |
|---|---|
| POA&M items from scan findings | Synced automatically from findings. Item numbers stay stable, the same CVE across many hosts rolls up into one item, configuration findings can consolidate under CM-6, and closed items never reopen |
| Monthly ConMon deliverable | Immutable monthly snapshots exported as the FedRAMP POA&M Excel workbook (template v3.0) and an OSCAL 1.0.4 POA&M checked against the NIST schema, with new, resolved and late counts month over month |
| Remediation deadlines | FedRAMP Rev 5 and FedRAMP VDR deadline presets. A finding on the CISA KEV list is never scheduled past its KEV due date |
| STIG checklists | DISA STIG .ckl and .cklb import, mapped from CCIs to NIST SP 800-53 controls |
| CMMC Level 2 | Self-assessment scoring against NIST SP 800-171 Rev 2 with DoD weights, SPRS score, conditional status and the 180-day closeout clock |
| Control coverage | A heatmap mapping findings to NIST SP 800-53 Rev 5 controls |
| Cryptography | FIPS 140-3 images for self-hosted deployments |
The federal compliance features are in beta. Scores and coverage are advisory: they support your assessor and your system security plan and don't replace them, and DefectDojo does not submit to FedRAMP, SPRS or eMASS. See the federal compliance documentation.
Two rule changes matter this year. FedRAMP's 2026 consolidated rules replace POA&Ms with a list of accepted weaknesses, and its Vulnerability Detection and Response timelines become mandatory on December 7, 2026. On July 13, 2026 the Department of War suspended CMMC Phase 2 third-party assessments, so Level 2 self-assessments against NIST SP 800-171 Rev 2 remain the working requirement.
Everything You Need to Prove Your Security Posture
Unified System of Action
Parse findings from 500+ security tools into one platform. When every SAST, DAST, SCA, container, and infrastructure finding lands in one place, your compliance reporting covers your actual attack surface, not just the tools someone remembered to export.
- QualysNetwork402
- Burp SuiteDAST96
- CheckmarxSAST188
- SnykSCA351
- WizCloud173
- vendor-report.csvUniversal Parser47
- CI pipelinePOST import-scan27
- Created
- 312
- Closed
- 18
- Reactivated
- 4
- Untouched
- 950
SLA Enforcement and Tracking
Define remediation SLAs per Product, based on severity or risk. DefectDojo counts down every finding against its deadline, flags breaches automatically, and tracks whether findings were mitigated within SLA. Your remediation policy stops being a document and starts being enforced.
- CriticalRCE in logging library3 days2 days
- HighSSRF in image proxy13 days12 days
- CriticalUnsafe deserializationBreached1 day0 days-1 days
- MediumVerbose error pagesMitigated Within SLA
Custom Compliance Reports
Build branded, audience-ready reports with the Report Builder. Scope reports to a Product Type, Product, Engagement, or Test, include executive summaries with SLA performance, and save templates so the next audit takes minutes, not weeks.
- Cover PageStock
- Table of ContentsStock
- Executive SummaryText Block
- Average Time to RemediationChart
- Findings Outside of SLATabular
- Risk AcceptancesTabular
Audit Logging and Object History
Every Product, Engagement, Test, Finding, and Risk Acceptance carries its own recorded history. DefectDojo Pro adds a dedicated audit log API for instance-wide activity, giving auditors the traceability they ask for without manual reconstruction.
- Mon 09:10:22ci-pipelineCreatetitle:
Noneto SSRF in image proxy - Mon 09:31:05sec-oncallUpdateseverity:
Mediumto High - Mon 09:31:40sec-oncallUpdateverified:
Falseto True - Wed 15:03:41JIRAUpdateactive:
Trueto Falseis_mitigated:Falseto True
GET /api/v2/audit_log/
AssetEngagementTestFindingRisk Acceptance
Documented Risk Acceptance
Not every finding gets fixed immediately, and auditors know it. DefectDojo formalizes risk acceptance with expiration dates and automatic follow-up, so exceptions are governed decisions with a paper trail instead of forgotten liabilities.
- Decision
- AcceptThe risk is acknowledged, but remains
- Owner
- platform-team
- Accepted By
- ciso
- Security Recommendation
- Mitigate
- Proof
- compensating-controls.pdf
- Expiration Date
- in 90 daysin 7 daysExpired
- Reactivate Findings on Expiration
- Restart SLA on Expiration
- Request Security Exceptionplatform-team
- Acceptedby ciso, proof attached
- Expiration reminderowner notified, 7 days out
- Expiredfollow-up ran automatically
Metrics That Stand Up to Scrutiny
Executive Insights and Remediation dashboards in DefectDojo Pro show SLA performance, remediation velocity, and security posture trends at a glance. Walk into any review, board meeting, or audit with numbers you can defend.
Why DefectDojo for Compliance
Built by practitioners who sat through the audits.
Born from the OWASP Community
DefectDojo wasn't designed by a compliance vendor guessing at AppSec workflows. It was built by security practitioners who lived the audit scramble and automated their way out of it. That heritage shows in every workflow.
Open Source You Can Verify
Available under an OSI license, DefectDojo's Community Edition gives your team full visibility into the platform holding your security data. For regulated environments, DefectDojo Pro deploys in the cloud, on-premises, or fully air-gapped.
One Platform, Every Framework
Whether you're pursuing SOC 2, maintaining PCI-DSS, or preparing for the EU Cyber Resilience Act, the underlying evidence is the same: findings, timelines, and remediation proof. DefectDojo maintains that evidence continuously, so a new framework means a new report, not a new program.
Compliance That Scales
From a single practitioner running Community Edition to enterprises tracking millions of findings across hundreds of teams, DefectDojo's asset hierarchy keeps compliance reporting organized at any scale.
Automation Over Heroics
Deduplication, SLA countdowns, breach notifications, and Jira sync run automatically. Your team spends its time remediating real risk while the compliance evidence accumulates in the background.
From Scanner Output to Audit Evidence in Five Steps
Aggregate Every Finding
Import results from 500+ security tools via parsers, API, or CI/CD integration. DefectDojo normalizes everything into a consistent finding format, then deduplicates so your reports reflect unique risk instead of repeated noise.
Organize Around Your Business
Map findings to your real structure using DefectDojo's asset hierarchy: Organization, Asset, Engagement, Test, and Finding. Auditors think in terms of systems and business units. Your reporting will too.
Enforce Your Remediation Policy
Assign SLA configurations to each Product, tuned by severity or risk. DefectDojo tracks every finding against its deadline, notifies owners before and after breaches, and records whether each finding was mitigated within SLA.
Govern the Exceptions
Route accepted risks through formal Risk Acceptance workflows with expiration dates. When an acceptance expires, DefectDojo follows up automatically, including comments pushed to linked Jira issues until the item is resolved.
Report On Demand
Generate custom reports scoped to any level of your hierarchy. Include executive summaries, SLA performance, severity definitions, and your own branding. Save the template, and the next request from your auditor, customer, or board is a few clicks away.
- 01Aggregate Every Finding500+ toolsnormalized
- 02Organize Around Your BusinessOrganization›Asset›Engagement›Testone hierarchy
- 03Enforce Your Remediation Policy7d30d90d120dbreaches flagged
- 04Govern the ExceptionsRisk AcceptedExpiresauto follow-up
- 05Report On DemandSOC 2PCI DSSPDFminutes, not weeks
Frequently asked questions
Which compliance frameworks does DefectDojo support?
DefectDojo supports security compliance reporting across frameworks including SOC 2, PCI-DSS, FedRAMP, CMMC, and the EU Cyber Resilience Act. Because DefectDojo maintains a continuous record of findings, remediation timelines, and risk decisions, that same evidence base supports internal policies and customer security questionnaires as well.
Does DefectDojo replace my GRC platform?
No, and it isn't trying to. GRC platforms manage policies and controls. DefectDojo owns the technical vulnerability evidence those controls depend on: what was found, when, how severe it was, and how fast it was fixed. Many teams feed DefectDojo data into their GRC workflows via the REST API.
How does DefectDojo help with audit preparation?
Every object in DefectDojo, from Products to individual Findings, carries a recorded history of changes. Combined with SLA tracking, risk acceptance records, and the Report Builder, your audit evidence exists the moment an auditor asks for it. DefectDojo Pro adds a dedicated audit log API for instance-wide traceability.
Can DefectDojo enforce our remediation SLAs?
Yes. SLA configurations define how many days your team has to remediate findings at each severity or risk level, per Product. DefectDojo counts down automatically, flags breaches, sends notifications, and tracks mitigated-within-SLA performance on Pro dashboards.
Can I run DefectDojo in a regulated or air-gapped environment?
Yes. DefectDojo Pro deploys in the cloud, on-premises, or in fully air-gapped environments, with SSO via SAML 2.0 and OIDC, and granular role-based access control for enterprise environments.
Is there a free version?
Yes. Community Edition is free, self-hosted, and available under an OSI license, including parser support, deduplication, SLA configuration, and reporting. DefectDojo Pro adds advanced automation, SLA enforcement dashboards, full audit logging, and SLA-backed support.
How is DefectDojo different from a compliance reporting tool?
Compliance reporting tools generate documents. DefectDojo runs your actual AppSec program: aggregation, triage, prioritization, and remediation tracking. The compliance evidence is a natural output of that work, which means it's always current and always defensible.
Does DefectDojo generate FedRAMP POA&Ms?
Yes, in DefectDojo Pro (beta). It keeps a POA&M per system synced from your scanner findings and exports monthly ConMon snapshots as the FedRAMP POA&M Excel workbook (template v3.0) and as OSCAL.
Does DefectDojo help with CMMC?
Yes. DefectDojo Pro scores CMMC Level 2 self-assessments against NIST SP 800-171 Rev 2 with DoD weights, shows the SPRS score and tracks the 180-day closeout clock. The scoring is advisory and does not replace an assessment.
Does DefectDojo support FedRAMP Vulnerability Detection and Response deadlines?
Yes. DefectDojo Pro ships FedRAMP Rev 5 and VDR remediation deadline presets, and never schedules a CISA KEV finding past its KEV due date.