Compliance

Overview

The Compliance page shows how your estate measures up against a security framework. Automated posture checks evaluate the controls that DeviceQuest can measure from your asset, vulnerability and ownership data. The remaining controls are manual: you satisfy them with a sign-off backed by evidence. Use this page to review your posture, find the next gap to close, open a control’s full record, and export a compliance report or a Statement of Applicability for an auditor.

Open it from Govern › Compliance in the sidebar.

Frameworks

Pick the framework in the Framework list next to the page title. Each framework keeps its own controls, sign-offs, evidence and reports.

You can also author your own frameworks with your own controls. See Custom frameworks.

Screen tour

Click to enlarge

The Overview tab

The Overview tab answers “where do we stand, and what do we fix next?”

• Posture headline. For example, NIST 800-53 — 49 controls in scope. When manual controls exist, two lines follow:

  • Monitored (n): how many automated checks are passing, failing and need attention.
  • Manual (n): how many manual controls are attested and how many are not assessed.

  If you excluded controls as not applicable, the headline adds the number of applicable and excluded controls.

• Last evaluated: when the automated checks last ran.

• Next gap: a badge such as 1 check failing with a link to the control that needs work first. Press n to jump to it.

• Sign-off line: how many controls have been signed off, and how many sign-offs have expired.

• Control posture: a bar for every monitored control, colored Failing, Needs attention, Passing or Not applicable. Manual controls appear in the Controls table.

• Framework crosswalk: the six automated checks and the controls each one maps to in every framework:

  Check	What it measures
  No critical vulnerabilities	No asset has an open critical vulnerability
  No high-severity vulnerabilities	No asset has an open high-severity vulnerability
  Vulnerability remediation in progress	Open findings are being remediated
  Software inventory collected	Every asset has a software inventory
  Every asset has an owner	Every asset has an assigned owner
  Every asset seen recently	Every asset was seen inside the freshness window

  A cell shows the matching control ID, +N when the check maps to several controls, or Not directly measured.

• Chain of custody: counts of orphan evidence files (uploaded but not linked to a sign-off), attestations without evidence, and intact chains (evidence linked to a sign-off linked to a control). When everything is linked, it reads All evidence is linked. Chain of custody is intact.

• Exceptions expiring soon: vulnerability exceptions that expire within 30 days.

• Recent activity: the last eight compliance reports, with their pass, fail and needs-attention counts.

On a framework that has never been evaluated, the tab shows Set up compliance monitoring with three steps: Run the first evaluation., Sign off on a control. and Attach evidence. Click Generate {framework} report to run the first evaluation.

The Controls tab

Click to enlarge

The table has the columns ID, Title, Severity, Status, Posture, Effective, Sign-off and Last evaluated. Click the ID, Title, Severity, Posture, Effective or Last evaluated header to sort. The count above the table shows how many controls match your filters, and how many are monitored and manual. The table shows 25 controls per page; use Previous and Next to page.

Click a row, or press Enter on it, to open the control record. To work with a control’s sign-offs and evidence, see Attestations and evidence.

Filter controls

The Filter row applies to the Controls tab.

Each active filter appears as a chip, for example Severity: High. Click × on a chip to remove that filter, or Clear all to remove every filter. Clearing keeps the current view and framework. On narrow screens, click Filters to show or hide the filter row; the button shows how many filters are active.

The view, framework, search and filters are part of the page address, so you can bookmark or share a filtered view.

Effective status

Every control has a raw Status from its automated check, and an Effective status that takes sign-offs into account. A sign-off counts while it is unexpired and has at least one evidence file linked to it. This table shows how the two combine.

Two more axes sit beside the effective status:

• Sign-off: Signed off (at least one active sign-off), Sign-off expired (every sign-off has expired) or Not signed off.
• Applicability: a control you mark as not applicable keeps its status but shows an Excluded chip and drops out of every count. See Mark a control as not applicable.

Hover over an Accepted risk badge to see until when the risk is accepted, for example Accepted until {date} or Accepted indefinitely — this sign-off carries no expiry date.

Assessed scope

For NIST 800-53, CIS Controls and ISO 27001, DeviceQuest ships a full control catalog. The scope bar above the posture headline decides which catalog controls your tenant is assessed against.

• Assessed control scope: the profile list, shown as {profile name} ({number of controls}). Product profiles come first, then publisher baselines, then your own.
• Status line: for example … scope · 49 of 1,196 controls · 6 monitored, 43 manual.
• Warning: Scoping is not a compliance claim. Choosing a profile decides which controls you are assessed against; it does not claim conformance. Controls with no automated check stay Not assessed until a sign-off backed by evidence attests them.

To change the scope:

1. Choose a profile in Assessed control scope.
2. Wait while the status line reads Applying {profile} — re-evaluating {n} controls….

Changing the scope needs compliance:write. Without it, the list is read-only and the status line adds Read-only — changing scope needs compliance:write.

Generate a compliance report

A compliance report is a point-in-time snapshot of every control in the framework. Generate one before an audit, and whenever you want Export to reflect the latest state.

1. Choose the Framework.
2. Click Generate report, or press Shift+G. The button reads Generating… while the checks run.
3. Read the confirmation, for example NIST 800-53 re-evaluated: 49 checks — 4 passing, 1 failing, 2 needing attention.

Generating a report needs compliance:write. If your role requires multi-factor authentication for sensitive actions, you must have signed in with MFA.

Reports you generate here also appear on the Reports page under Audit Readiness.

Export

1. In Export document, choose what to export:
   • Compliance report: the latest generated report for the framework.
   • Statement of Applicability: every control in scope, with whether it applies and why. See Statement of Applicability.
2. In Export format, choose the format.
3. Click Export. The file downloads and the page shows Exported {file name}.

The compliance report starts with a summary (Report Name, Framework, Exported At, Source Report Generated At, Status, Assets In Scope, Controls Evaluated, Passing, Failing, Needs Attention, Not Applicable, and Excluded (Not Applicable To Tenant) when controls are excluded). It then lists every control with Control ID, Title, Severity, Status, Effective and Description.

Export is available once the framework has at least one generated report. Hover over the button to see what it will export.

Keyboard shortcuts

Shortcuts work when the cursor is not in a text field.

In the tab bar, the arrow keys, Home and End move between tabs.

Permissions

By default, the administrator role holds these permissions. An administrator can grant them to other roles under Admin › RBAC. Users without compliance:read see Compliance is not available for your role.

Related pages

• Attestations and evidence
• Custom frameworks
• Reports
• Licenses