Compliance & Security¶
Repod is designed to meet the requirements of regulated environments. This section provides the documentation and evidence materials you need for audits.
Available resources¶
NIS2 / SecNumCloud compliance¶
Detailed mapping of Repod features against NIS2 Directive (EU 2022/2555) article 21 requirements and ANSSI SecNumCloud guidelines. Includes a checklist you can attach to audit dossiers, and a downloadable audit-package PDF export.
Security dossier (CISO)¶
Full technical security briefing: authentication mechanisms, RBAC matrix, pipeline architecture, infrastructure hardening, HTTP headers, known limitations, and GDPR considerations.
Configuration compliance & drift¶
Beyond the package-level CVE pipeline, Repod scans the machines in your fleet inventory against CIS and DISA STIG benchmarks, and continuously checks a fleet's actual configuration (installed packages, running services, file permissions) against a desired-state baseline you define — flagging drift as soon as a machine deviates, the same way Ansible or Puppet would, but read-only and detection-first: nothing is ever changed on a scanned machine automatically.
Fleet-wide CVE exposure¶
An executive dashboard aggregates CVE exposure across your entire fleet — top vulnerabilities by exploitation probability (EPSS), most-exposed machines, and a daily exposure trend — for reporting to management without digging through per-machine detail.
Application package posture (Maven / PyPI / npm)¶
A separate, dedicated indicator tracks published build artifacts —
Critical/High CVE counts, by format, and how many are awaiting CISO
review — distinct from the machine-fleet compliance metrics above, since a
Maven/PyPI/npm artifact isn't "installed" on a Repod-managed machine the
way a .deb/.rpm is.
At a glance¶
| Regulation | Coverage | Evidence available |
|---|---|---|
| NIS2 art. 21 — Supply chain security | ✅ | CVE pipeline, SBOM, audit trail |
| NIS2 art. 21 — Access control | ✅ | RBAC matrix, LDAP, API tokens, per-distribution/per-machine restrictions |
| NIS2 art. 21 — Logging & monitoring | ✅ | 19+ event audit trail, JSONL export |
| NIS2 art. 21 — Configuration management | ✅ | CIS/STIG scanning, configuration drift detection |
| ANSSI SecNumCloud — Software inventory | ✅ | CycloneDX 1.5 + SPDX 2.3 SBOM |
| GDPR — Data minimisation | ✅ | Only email + IP logged |
| GDPR — Retention policy | ✅ | Configurable audit log retention |
| GDPR art. 15/17 — Data subject rights | ✅ | Self-service export & erasure |
| ISO 27001 A.12.6 — Vulnerability mgmt | ✅ | Grype + CISO review queue |
| ISO 27001 A.8/A.12 — Configuration mgmt | ✅ | CIS/STIG profiles, drift baselines |
For auditors
The audit log export (GET /artifacts/audit/logs) produces machine-readable JSONL that can be ingested directly into a SIEM. Each event includes timestamp, user, role, source IP, and action details.
CIS/STIG content is never hand-authored
Compliance benchmark content is only ever imported from the published official benchmarks — never written from memory or approximated — so what you see in a scan report traces back to a real, citable source.