Compliance, risk, and reports

Three related surfaces for posture reporting — each is a separate page in the product: Compliance, Risk, and Reports. Use them for frameworks and assessments, quantified scan-based risk, and auditor-ready exports.

♢

Compliance

Compliance maps technical signals — policy results, RBAC, audit logs, approvals, drift, and manual attestation — onto framework controls and assessments, not just raw scan findings.

Frameworks on the Compliance page (six built-in assessments):

  • CIS — CIS Benchmarks
  • SOC2 — SOC 2 Trust Services Criteria
  • ISO27001 — ISO/IEC 27001 (Annex A)
  • PCI — PCI DSS
  • HIPAA — HIPAA Security Rule
  • NIST — NIST 800-53

Policy Library bundles may reference additional frameworks (CIS cloud benchmarks, SOC 2 packs, PCI, HIPAA, Zero Trust, AI Governance, and others) for guardrails; the Compliance page assesses the six frameworks above.

Page sections:

  • Executive dashboard — average score, frameworks assessed, continuous coverage, open exceptions, trends, and recommendations.
  • Framework cards — control count, latest score, pass/fail/risk chips; Assess or View.
  • Recent assessments — score, risk level, pass / fail / manual / waived counts.
  • Continuous compliance — enable per-framework continuous mode; Run due assessments now.
  • Exceptions (waivers) — pending and approved waivers with justification and expiry.

Open an assessment to see control-level results (PASS, FAIL, MANUAL, WAIVED), evidence, re-assess, generate a markdown report, and export JSON, CSV, or Markdown for that assessment.

i

Compliance is not a substitute for fixing violations. A high framework score with open critical findings still needs remediation on the Governance Dashboard and My findings.

▥

Risk

Risk is the security intelligence command center for scan-based findings: severity mix, trends, heatmaps, top risks, and prioritized remediation recommendations.

The enterprise risk model scores each open finding 0–100 using weighted dimensions including severity, exploitability, internet exposure, asset criticality, business impact, compliance impact, identity exposure, lateral movement risk, finding age, KEV listing, EPSS, public exposure, and runtime activity.

Dashboard areas:

  • Overall risk score and severity breakdown (critical / high / medium / low).
  • Risk trend and category distribution charts.
  • Risk heatmap and top open risks table.
  • Remediation recommendations with links back to Security Insights and Governance.
i

This page does not run scans. It aggregates security scan findings (IaC misconfigurations, secrets, and related intelligence). Policy Library violations are tracked separately — open policy violations may appear in the executive summary chips but are remediated via Policy Library or the Governance Dashboard.

▤

Reports

Open Security & Governance → Reports for auditor-ready exports. The page shows posture KPIs (pass rate, open violations, active exceptions, enabled policies) for a selectable period (7, 30, or 90 days).

Tabs:

  • Exports — unified evidence bundle and standalone policy evidence CSV.
  • Persona reports — audience-specific KPI packs with JSON, CSV, or HTML download.
  • Report catalog — every artifact, format, and which export includes it.
☆

Entitlement: the unified evidence bundle and persona exports require the governance platform feature (Professional / Enterprise). The standalone policy evidence CSV is available with governance:read, policy:read, or compliance:read.

!

If evidence bundle download fails, the usual cause is a missing governance entitlement on the organization plan — not a permissions bug for org Owner.

What you can download

Export Contents Typical audience
Policy evidence (CSV) Violations, exceptions, remediations, and posture summary for the selected period Platform / DevSecOps
Evidence bundle (JSON manifest) Policy CSV, compliance JSON snapshot, governance audit CSV, drift evidence (when licensed), all five persona reports, manifest Auditors, GRC
Persona export JSON, CSV, or HTML per persona — Executive, CISO, Compliance, Auditor, DevSecOps Role-specific reviews
Compliance audit bundle Compliance page Export audit — JSON or CSV (separate from Governance Reports evidence bundle) Compliance officers
i

Scheduled evidence (Governance Dashboard → Settings)
Schedule evidence delivery to a webhook (HTTP POST). Email and S3 delivery may log intent until outbound mail and object-store credentials are configured in Administration. Change-management tickets for remediations are configured under Administration → Integrations → Change Management.

♢

Exceptions and waivers

Two waiver flows exist — do not confuse them:

Surface What it waives Approval
Compliance → Exceptions A failing or manual framework control Organization owner (org:delete) approves or rejects
Governance Dashboard → Exceptions An enforcing policy violation Requires governance:approve (Compliance Officer preset)
♢

Audit trail

Governance actions (gate changes, exception decisions, break-glass, policy publish) are written to Administration → Audit Logs. The governance audit trail is also included in the Reports evidence bundle.

Viewing audit logs requires audit:read (typically Admin roles — not granted to the default Member/Viewer presets).