audit-labs/audit-labs.dev
The website for Audit Labs.
clone: git clone https://gitbay.org/audit-labs/audit-labs.dev.git
main: audit-report/index.html · raw
1<!DOCTYPE html>
2<html lang="en">
3<head>
4 <meta charset="UTF-8">
5 <meta name="viewport" content="width=device-width, initial-scale=1.0">
6 <title>audit-report | Audit Labs</title>
7 <meta name="description" content="Turn audit-tools evidence packages into control-mapped, auditor-ready reports (Markdown, HTML, JSON) with SOC 2, ISO 27001 and NIST mappings, plus diff and trend modes.">
8 <link rel="preconnect" href="https://fonts.googleapis.com">
9 <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;700&family=DM+Serif+Display:ital@0;1&family=DM+Sans:wght@400;500;600&display=swap" rel="stylesheet">
10 <link rel="stylesheet" href="../assets/site.css">
11</head>
12<body>
13
14<nav>
15 <div class="nav-inner">
16 <a href="/" class="logo">AUDIT<span>LABS</span></a>
17 <ul class="nav-links">
18 <li><a href="https://github.com/audit-labs/audit-report" class="btn-github">View on GitHub →</a></li>
19 </ul>
20 </div>
21</nav>
22
23<header class="hero split">
24 <div class="hero-inner">
25 <div>
26 <div class="crumb"><a href="/">Audit Labs</a> / audit-report</div>
27 <h1>Turn raw evidence into<br><em>an audit-ready report.</em></h1>
28 <p class="hero-desc">
29 A command-line tool that reads an audit-tools evidence package, applies declarative
30 rulesets, and maps every finding to SOC 2, ISO 27001, and NIST controls —
31 rendered as Markdown, self-contained HTML, or JSON. Diff and trend modes track drift over time.
32 </p>
33 <div class="hero-actions">
34 <a href="https://github.com/audit-labs/audit-report" class="btn-primary">View on GitHub</a>
35 <a href="#install" class="btn-secondary">Install & quickstart</a>
36 </div>
37 </div>
38 <div class="terminal">
39 <div class="terminal-bar"><div class="dot dot-red"></div><div class="dot dot-yellow"></div><div class="dot dot-green"></div></div>
40 <div class="terminal-body">
41 <span class="t-comment"># Report on an evidence package</span><br>
42 <span class="t-prompt">$</span> <span class="t-cmd">audit-report ./aws_audit_prod_2026-08 --format md,html --out report/</span><br>
43 <span class="t-out"> wrote report/report.md</span><br>
44 <span class="t-out"> wrote report/report.html</span><br>
45 <span class="t-path"> aws/prod: 3 failing, 4 passing, 1 n/a</span><br>
46 <span class="t-dim">──────────────────────────────</span><br>
47 <span class="t-comment"># Gate CI on high-severity findings</span><br>
48 <span class="t-prompt">$</span> <span class="t-cmd">audit-report ./aws_audit_prod_2026-08 --fail-on high</span><br>
49 <span class="t-bad"> ✗ high-severity control unsupported (exit 1)</span>
50 </div>
51 </div>
52 </div>
53</header>
54
55<section>
56 <div class="section-inner">
57 <div class="eyebrow">Three modes</div>
58 <h2>Report, diff, and trend.</h2>
59 <p class="lede">One ruleset, three lenses — a point-in-time report, the drift between two runs, or a control’s history across many.</p>
60 <div class="guarantees">
61 <div class="card">
62 <div class="num">01 · REPORT</div>
63 <h3>Point in time</h3>
64 <p>Evaluate a package against a ruleset and render a control-coverage matrix plus per-finding evidence — each with a plain-language rationale and remediation. <span class="mono">--format md,html,json</span>.</p>
65 </div>
66 <div class="card">
67 <div class="num">02 · DIFF</div>
68 <h3>What changed</h3>
69 <p>Compare a package to an earlier one with <span class="mono">--baseline</span>. Every control is classified <em>regressed</em>, <em>fixed</em>, <em>drifted</em>, or <em>unchanged</em>, showing the exact evidence rows that moved. Gate CI on regressions only.</p>
70 </div>
71 <div class="card">
72 <div class="num">03 · TREND</div>
73 <h3>Over time</h3>
74 <p>Point <span class="mono">--trend</span> at a folder of dated packages for a heatmap of every control across every run, plus a failing-count trendline — compliance drift at a glance.</p>
75 </div>
76 </div>
77 </div>
78</section>
79
80<section class="cmds">
81 <div class="section-inner">
82 <div class="eyebrow">What you get</div>
83 <h2>Built for the auditor on the other side.</h2>
84 <p class="lede">A report presents <em>evidence</em>, not a verdict — a failing row means a setting doesn’t support a control; the judgment stays with you and your auditor.</p>
85 <div class="cmd-list">
86 <div class="cmd-row"><div class="cmd-name">Control coverage</div><div class="cmd-desc">Every cited control, its framework, a worst-wins status, and which rules checked it — the matrix an auditor scans first.</div></div>
87 <div class="cmd-row"><div class="cmd-name">Findings</div><div class="cmd-desc">Failures first, then by severity — each with the result, <span class="mono">why it matters</span>, remediation, and the exact evidence rows that failed.</div></div>
88 <div class="cmd-row"><div class="cmd-name">Rulesets</div><div class="cmd-desc">Declarative YAML mapping signals to controls. Bundled for <span class="mono">AWS</span>, <span class="mono">GitHub</span>, and <span class="mono">GitLab</span> — or write your own.</div></div>
89 <div class="cmd-row"><div class="cmd-name">CI gating</div><div class="cmd-desc"><span class="mono">--fail-on low|medium|high</span> exits non-zero when a finding — or, in diff mode, a regression — crosses the line.</div></div>
90 </div>
91 </div>
92</section>
93
94<section class="frameworks">
95 <div class="frameworks-inner">
96 <span class="frameworks-label">Maps signals to controls for</span>
97 <div class="frameworks-list">
98 <span class="framework-tag">SOC 2</span>
99 <span class="framework-tag">ISO 27001</span>
100 <span class="framework-tag">NIST 800-53</span>
101 <span class="framework-tag" style="color:var(--gray-4);">·</span>
102 <span class="framework-tag">AWS</span>
103 <span class="framework-tag">GitHub</span>
104 <span class="framework-tag">GitLab</span>
105 </div>
106 </div>
107</section>
108
109<section class="install" id="install">
110 <div class="section-inner">
111 <div class="eyebrow">Get started</div>
112 <h2>Install & quickstart.</h2>
113 <div class="install-grid">
114 <div>
115 <pre><span class="c"># Install from PyPI</span>
116pip install <span class="p">audit-report</span>
117
118<span class="c"># Report on an audit-tools package</span>
119audit-report ./output/aws_audit_prod_2026-08 \
120 --format md,html,json --out report/</pre>
121 <div class="badges">
122 <span class="badge">Python 3.10+</span>
123 <span class="badge">GPL-3.0</span>
124 <span class="badge">PyYAML only</span>
125 <span class="badge">SOC 2 · ISO 27001 · NIST</span>
126 </div>
127 </div>
128 <div>
129 <p class="lede">The exit-code contract, at a glance:</p>
130 <div class="exit">
131 <div class="e"><span class="code g">0</span><span>Ran clean — no <span class="mono">--fail-on</span> threshold was crossed.</span></div>
132 <div class="e"><span class="code r">1</span><span>A finding — or a regression, in diff mode — met the severity threshold.</span></div>
133 <div class="e"><span class="code a">2</span><span>Usage error, e.g. a missing package or unknown format.</span></div>
134 </div>
135 <p class="lede" style="margin-top:1.4rem; font-size:.9rem;">
136 Pairs with <a href="/evidence-seal/" style="color:var(--amber); text-decoration:none;">evidence-seal</a>
137 — seal a package for integrity, then report on it for compliance.
138 </p>
139 </div>
140 </div>
141 </div>
142</section>
143
144<footer>
145 <div class="footer-inner">
146 <div class="footer-left">
147 <a href="/" class="footer-logo">AUDIT<span>LABS</span></a>
148 <p>© 2026 Audit Labs — a two-person team building for the community.</p>
149 </div>
150 <div class="footer-links">
151 <a href="/">Home</a>
152 <a href="https://github.com/audit-labs">GitHub</a>
153 </div>
154 </div>
155</footer>
156
157</body>
158</html>