Audit-ready evidence, honestly scoped
mipo gives GRC teams a defensible, dated record of network exposure and configuration change. It supports evidence collection for SOC 2 and ISO 27001 — your auditors determine whether each control is satisfied.
How mipo produces evidence
Continuous port-state evidence
Scheduled scans + historical diffs produce a dated record of exposure changes over time.
Read the docs →Proof of execution
Every job ends with a receipt signed by the scanner that ran it — verifiable evidence even for a scan that found no change.
Read the docs →Change attribution
The audit log ties scan and config changes to an actor and timestamp.
Read the docs →Access-control evidence
RBAC scopes, OIDC, MFA, step-up re-authentication, and session records demonstrate logical access control.
Read the docs →Tamper-evidence
A SHA-256 hash chain over the audit log flags in-place tampering of historical rows; the integrity page verifies it on demand.
Read the docs →Database-enforced append-only evidence
Six chain-of-custody tables accept inserts only: no application role holds UPDATE or DELETE, and a trigger blocks mutation even from a privileged connection.
Read the docs →Retention
Audit events are kept 365 days by default (set AUDIT_RETENTION_DAYS in .mipo.env to change it), authentication events 180 days, data-access views 90 days, and raw scan results 90 days with the two most recent completed baselines per scope always kept. Export for longer archival.
Read the docs →Capabilities mapped to control frameworks
| Control area | mipo features | Frameworks |
|---|---|---|
| Logical access control | RBAC scopes, OIDC/SSO, MFA (TOTP), step-up re-authentication, owner bootstrap, session management | CC6.1, CC6.2 / A.9.2, A.9.4 |
| Audit logging | Append-only audit trail, actor + timestamp, data access views, hash-chain integrity check | CC7.2, CC7.3 / A.12.4 |
| Scan-execution evidence | Scanner-signed execution receipts per job, append-only results and DNS observations | CC7.1, CC7.2 / A.12.4 |
| Change management | Config version tracking, scan scope history | CC8.1 / A.12.1.2 |
| Availability monitoring | Built-in alarm rules, scanner heartbeats, health endpoints | CC7.1 / A.17.1 |
| Asset management | Subnet inventory, port catalog, scanner registry | CC6.6 / A.8.1 |
| Encryption | TLS everywhere, scanner mTLS, backup encryption, credential encryption at rest | CC6.7 / A.10.1 |
| Incident response | Alarm lifecycle (open→acknowledged→resolved), notification channels | CC7.4 / A.16.1 |
mipo supports evidence collection. It does not certify compliance — your auditors determine whether controls are satisfied.
See the evidence reference
The compliance-evidence guide details each workflow and its limits.