Skip to main content

Reports and compliance

Updated

The compliance features in Security give you a structured way to track your clients' posture against recognized frameworks, collect and store evidence, and generate reports for auditors or client reviews. The compliance dashboard provides a rollup of framework scores and control status across all active frameworks.

Compliance is a connected sub-product within the same service as Security. Framework and control data is accessible from the Compliance section in the navigation.

Compliance Dashboard

The dashboard shows:

  • Framework scores — an overall passing percentage per framework, calculated from the ratio of passing controls to total controls
  • Controls summary — counts of passing, failing, and unreviewed controls across all frameworks
  • Evidence count — total pieces of evidence collected
  • Recent compliance findings — issues created from security incidents mapped to framework controls

Supported Frameworks

Frameworks are pre-built templates with standard control sets. Available frameworks include compliance standards such as SOC 2 and HIPAA. When you add a framework, it is seeded with its control library.

To add a framework:

  1. Go to Compliance → Frameworks.
  2. Click Add Framework.
  3. Select the framework from the list.
  4. Optionally click Seed Defaults to populate controls with standard descriptions and guidance.

Managing Controls

Each framework contains a set of controls. For each control you can:

  • Set status to Passing or Failing based on current posture
  • Assign an owner responsible for the control
  • Mark a review date to track when it was last assessed
  • Attach evidence

Open any control from Compliance → Controls to edit its status and link evidence.

Collecting Evidence

Evidence records document the proof that a control is being met. Each evidence record links to a specific framework and control and stores:

  • Title and description
  • Evidence type (document, screenshot, policy, log, etc.)
  • Source (manual upload, auto-captured from a system)
  • A file attachment (uploaded via signed URL)
  • Capture and review dates

To upload evidence:

  1. Open the control you want to document.
  2. Click Add Evidence.
  3. Fill in the title, type, and description.
  4. Upload the file. The system generates a signed upload URL for the attachment.
  5. Save. The evidence record is linked to the control and appears in the evidence count on the dashboard.

Linking Incidents to Compliance

When a security incident has compliance implications (e.g., a data breach relevant to HIPAA or a SOC 2 availability incident), you can create a compliance finding from the incident:

  1. Open the incident in Security.
  2. Click Create Compliance Finding.
  3. Select the framework and control it maps to.
  4. Add a summary and remediation note.

The compliance finding is linked to the incident ID and appears in the framework's findings list. MITRE technique IDs on the incident are also mapped to NIST controls automatically where a mapping exists.

Exporting Reports

To export a compliance report:

  1. Go to Compliance → Frameworks and open the framework.
  2. Click Export Report.
  3. Select the output format and date range.
  4. Download the report. It includes framework score, control status table, evidence summary, and open findings.

Reports are suitable for client delivery, internal review, or auditor submission.

FAQ

Does Security automatically assess controls, or is it manual? Both. Some evidence is auto-captured from connected systems (for example, security event data that maps to a NIST control). Most control assessments require analyst review and manual status updates. The framework provides the structure; your team provides the judgment.

Can I create a custom framework that is not in the built-in list? Yes. When adding a framework, select the option to create a custom framework and define your own controls. Custom frameworks work the same way as built-in ones for evidence collection and reporting.

How does a compliance finding differ from a security finding? A security finding (in the Security product) is a durable record of a threat or vulnerability. A compliance finding is a record that a security event or gap has violated or put at risk a specific compliance control. They are related but stored separately — compliance findings reference the security incident or finding they were created from.

Related