> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/standards-and-compliance.md).

# Standards and Compliance

Measure your applications against a security verification standard, enforce the parts of it Heeler can enforce, and produce the evidence as a document.

Most of Heeler answers *what is wrong with our software?* This section answers a different question: **can we show that our software meets a standard?**

Those are not the same job. A findings list tells you what to fix. A standard tells you what you were supposed to be doing in the first place — and an auditor, a customer security review, or a certification will ask about the second.

Heeler does three things with a standard:

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Measures</strong></td><td>Assesses every application against the standard, and says which requirements it can verify from evidence rather than assertion.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/assessments.md">Assessments</a></td></tr><tr><td><strong>Enforces</strong></td><td>Turns the enforceable parts of a level into pull-request guardrails, applied as one set.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/guardrail-bundles.md">Guardrail Bundles</a></td></tr><tr><td><strong>Reports</strong></td><td>Produces the assessment, and your regulated-data inventory, as point-in-time documents.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/compliance-reports.md">Compliance Reports</a></td></tr></tbody></table>

The standard itself is **OWASP ASVS**:

{% content-ref url="/pages/RuDiNrj62gjaZi8WiuoU" %}
[OWASP ASVS](/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/owasp-asvs.md)
{% endcontent-ref %}

## Where standards show up

Standards are not confined to one page. The same assessment surfaces in several places, and it helps to know which one answers which question.

| Where                                                                                                                                                       | What it answers                                                                                                                                                                                       |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Standards** in the navigation                                                                                                                             | How does the whole portfolio measure up? One row per application, with its target level, score and violation count. See [Assessments](/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/assessments.md). |
| An application's **Standards** tab                                                                                                                          | How does *this* application measure up, requirement by requirement? See [Application Detail](/mrecEO40m5D6bt7Pq5pE/catalog/applications/application-detail.md#standards).                             |
| **ASVS** filter on [SAST](/mrecEO40m5D6bt7Pq5pE/findings/code-security-sast/findings.md) and [IaC](/mrecEO40m5D6bt7Pq5pE/findings/iac/findings.md) findings | Which findings bear on a given requirement?                                                                                                                                                           |
| **ASVS** on a SAST finding's Rule Details                                                                                                                   | Which requirement does this specific weakness map to?                                                                                                                                                 |
| **Guardrail bundles** on the Guardrails page                                                                                                                | Which parts of a level can be enforced at the pull request, and are they on? See [Guardrail Bundles](/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/guardrail-bundles.md).                            |
| **Generate Report**                                                                                                                                         | The assessment as a document. See [Compliance Reports](/mrecEO40m5D6bt7Pq5pE/standards-and-compliance/compliance-reports.md).                                                                         |

## Compliance is broader than a standard

One other kind of evidence lives outside this section but answers to the same audience: **what regulated data does our software handle?** That is the [Data Inventory](/mrecEO40m5D6bt7Pq5pE/catalog/data-inventory.md), and its **Compliance Report** is covered here alongside the standards report, because in practice the same person needs both.

## Related

* [Data Inventory](/mrecEO40m5D6bt7Pq5pE/catalog/data-inventory.md) — the regulated-data side of the same question.
* [PR Guardrails](/mrecEO40m5D6bt7Pq5pE/prevent/pr-guardrails.md) — the enforcement mechanism a bundle uses.
* [Applications](/mrecEO40m5D6bt7Pq5pE/catalog/applications.md) — the unit an assessment is scoped to.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/standards-and-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.