# DonjonSec Claims Register

> Generated by `scripts/gen-claims.py` at 2026-06-10T09:21:00Z.
> **Do not hand-edit.** Run `python scripts/gen-claims.py --write` to regenerate.
> Drift between this register and the live site is a CI failure (`drift-check.py`).

## Provable claims (generated from the product)

| Claim | Value | Marketing string | Source / derivation | Provable |
|-------|-------|------------------|---------------------|----------|
| CVE signatures | 324,593 | `324,593` (rounded `324K+`) | data/vuln_db/vuln_intel.db -> SELECT COUNT(*) FROM nvd_cves | yes |
| Scanners | 18 | `18 scanners` | lib/orchestrator.py::_SCANNER_REGISTRY | yes |
| Compliance frameworks | 30 | `30 compliance frameworks` | config/frameworks/*.yaml (file count) | yes |
| AI backends | 18 | `18 AI backends` | lib/ai_engine.py::AIEngine.get_supported_backends() | yes |
| Total controls | 1,787 | `1,787 controls` | sum of per-framework control leaves in config/frameworks/*.yaml | yes |

## Per-framework control counts (auditor-checkable)

| Framework | id | Version | Controls |
|-----------|----|---------|----------|
| APRA CPS 234 Information Security | `apra_cps234` | 2019 | 14 |
| CCPA/CPRA | `ccpa` | 2023 | 20 |
| CIS Critical Security Controls v8.1 | `cis-controls-v8` | 8.1 | 153 |
| CIS Critical Security Controls v8 | `cis_benchmarks` | 8.0 | 153 |
| Cybersecurity Maturity Model Certification (CMMC) 2.0 | `cmmc` | 2.0 | 110 |
| Colorado Privacy Act | `colorado_privacy` | 2021 | 17 |
| Connecticut Data Privacy Act | `connecticut_cdpa` | 2022 | 17 |
| Digital Operational Resilience Act (DORA) | `dora` | 2022/2554 | 22 |
| EU AI Act | `eu_ai_act` | 2024/1689 | 43 |
| FedRAMP (Federal Risk and Authorization Management Program) | `fedramp` | Rev 5 | 176 |
| Family Educational Rights and Privacy Act (FERPA) | `ferpa` | 2024 | 21 |
| General Data Protection Regulation (GDPR) | `gdpr` | 2016/679 | 40 |
| Gramm-Leach-Bliley Act (GLBA) Safeguards Rule | `glba` | 2023 | 28 |
| HIPAA Security and Privacy Rules | `hipaa` | 2013 | 66 |
| HITRUST Common Security Framework (CSF) v11 | `hitrust-csf` | 11.0 | 72 |
| ISO/IEC 27001:2022 | `iso_27001_2022` | 2022 | 93 |
| NERC Critical Infrastructure Protection (CIP) Standards | `nerc-cip` | v7 | 37 |
| NIS2 Directive | `nis2` | 2022/2555 | 27 |
| NIST SP 800-171 Rev 3 | `nist_800_171` | Rev 3 | 93 |
| NIST SP 800-53 Rev 5 | `nist_800_53` | Rev 5 | 202 |
| NIST Cybersecurity Framework 2.0 | `nist_csf_2.0` | 2.0 | 106 |
| New York SHIELD Act | `ny_shield` | 2019 | 14 |
| PCI DSS 4.0.1 | `pci_dss_4` | 4.0.1 | 63 |
| CIS Red Hat Enterprise Linux 9 Benchmark | `rhel_cis` | 2.0.0 | 53 |
| SEC Cybersecurity Rules | `sec_cyber` | 2023 | 12 |
| SOC 2 Trust Services Criteria | `soc2` | 2017 | 56 |
| Sarbanes-Oxley Act (SOX) IT Controls | `sox` | 2002 | 38 |
| Texas Data Privacy and Security Act | `texas_dpsa` | 2023 | 19 |
| UK FCA/PRA Operational Resilience | `uk_fca_resilience` | 2021 | 9 |
| Virginia Consumer Data Protection Act | `virginia_cdpa` | 2021 | 13 |
| **TOTAL** | | | **1,787** |

## Competitor pricing (UNPROVABLE — needs sourcing)

**Status:** unsourced — needs a cited source or removal

**Headline floor:** `$110K+/yr` — Documented CONSERVATIVE FLOOR. Sum of the lowest defensible annual list price for one representative tool in each replaced category (VM + compliance automation + risk quantification). Pinned as a floor, not a precise total.

Proposed ONE canonical set (replaces the site-vs-README disagreement). Every entry must carry a cited public source before it ships:

| Vendor | Category | Proposed floor (USD/yr) | Provable | Needs |
|--------|----------|-------------------------|----------|-------|
| Tenable | Vulnerability management | $35,000 | no | cited public list price |
| Qualys | Vulnerability management | $25,000 | no | cited public list price |
| Rapid7 | Vulnerability management | $20,000 | no | cited public list price |
| RiskLens | FAIR risk quantification | $50,000 | no | cited public list price |
| Drata | Compliance automation | $30,000 | no | cited public list price |

> Note: the sum of the proposed floors is greater than the `$110K+` headline. The headline is intentionally pinned as a conservative floor, NOT the sum, and must be presented that way.
