Automatic reports and evidence for auditors

QROS turns every scan and assessment into automatic reports and per-control evidence packages — an executive LaTeX/PDF document with the per-system quantum-risk score and migration priority bands, plus the underlying control-by-control evidence that DORA, PCI-DSS and ISO 27001 auditors ask for. No manual assembly: the report is regenerated from the live inventory, so the version an auditor sees always matches the version you operate.

What the reports include

• Executive LaTeX/PDF — cover, score gauge and the priority bands (Immediate / 12m / Long-term) for the committee
• Per-system quantum-risk score — the 0–100 posture with the weighting of algorithm, key length, data type and retention (HNDL)
• Per-control evidence — pass / fail / partial status for every CIS, STIG and PCI control, with the exact scan artifact attached
• Regulatory mapping — DORA, PCI-DSS 4.4 and ISO 27001 A.8.24 articles traced to the controls that satisfy them
• SIEM-ready export — the same findings export as JSON/CSV for Splunk, Elastic or your SOC

Evidence ready for auditors

Each evidence package bundles the raw scanner output (testssl.sh, OpenSCAP, ansible-lockdown) with the control mapping, so an auditor can trace any “pass” or “fail” back to the command that produced it. Reports regenerate from the live inventory on demand, so the audit version and the operational version are never out of sync.