Compliance

Compliance measures how well the security controls of your clients are implemented, and gives each client a compliance status from 0 to 100%. Use it to see which safeguards are in place, which are missing, and what to do next.

The compliance pages are in Cyber Console under Protection > Compliance. The pages are Overview, Actions, and Standards.

CIS Controls and safeguards

The compliance status is based on the CIS Critical Security Controls (CIS Controls) v8.1. The CIS Controls are a prioritized set of safeguards that defend against the most common cyberattacks on systems and networks. Multiple legal, regulatory, and policy frameworks map to the CIS Controls and refer to them, such as NIS2, NIST, PCI DSS, HIPAA, ISO 27001, and Cyber Essentials.

The CIS Controls contain 18 controls and 153 safeguards. Each control groups safeguards that relate to the same security topic. A safeguard describes one specific security measure, such as running active discovery scans periodically, deploying antimalware software, or providing security awareness training to employees. Most safeguards can be measured automatically.

Each safeguard belongs to one of the following security functions:

• Identify – understand your environment and assets.
• Protect – limit the impact of threats.
• Detect – find cybersecurity events in a timely manner.
• Respond – take action when an incident is detected.
• Recover – restore capabilities after an incident.

Each safeguard also applies to one type of asset, such as a device or a tenant.

Compliance standards

A compliance standard defines which safeguards a client must implement. The CIS Controls group their safeguards into three Implementation Groups: IG1, IG2, and IG3. IG1 is the baseline that every company should meet. IG2 and IG3 extend IG1 for companies with higher security needs. The default standard for clients is CIS Implementation Group 1.

Two types of standards are available:

• Built-in standards, which are included in the product, such as the CIS Implementation Groups.
• Custom standards, which you create for the compliance requirements of your clients or of their cyber insurers.

If more than one standard is assigned to a client, the compliance status uses all safeguards that the standards include, with every safeguard counted once. Each standard also appears individually, with the progress against it.

Compliance status

The compliance status is a percentage from 0 to 100 that shows how many of the applicable safeguards are implemented. A status of 100% means that all applicable safeguards are fully implemented. The console assesses the compliance of each client every hour.

The assessment excludes safeguards that are marked as Not applicable or Plan of action, and safeguards that do not apply to the type of asset.

Each safeguard scores up to one point. A safeguard receives the full point if the security measure is active and was used within the required recency window. The recency window is the period in which the safeguard must be performed to count. For example, a vulnerability scan might need to have run in the last 30 days. If the scan ran 60 days ago, the safeguard scores 0.

The status is assessed from the bottom up, from the individual assets to the client. If all applicable safeguards of an asset are fully implemented, the asset has a status of 100%. If all assets and all tenant-level safeguards are fully implemented, the client has a status of 100%.

Some changes affect the status only after the next assessment, such as installing an agent, enabling two-factor authentication, or changing the standards of a client.

A label describes the status:

• Insufficient (0–39%) – few safeguards are implemented, and there are major security gaps and a high risk.
• Partial (40–59%) – some safeguards are implemented, but important gaps remain.
• Strong (60–79%) – most safeguards are implemented, and the security posture is generally solid.
• Comprehensive (80–100%) – safeguards are widely implemented with mature security practices.

Compliance in the conversation with a client

A client might need to comply with frameworks such as NIS2, NIST, PCI DSS, ISO 27001, or Cyber Essentials. Compliance helps partners identify the security controls that support that work. It does this with the CIS safeguards, which map to the major standards.

For a client, compliance shows which safeguards are implemented, which are outstanding, which assets they affect, and who is responsible for them. This information gives partners a basis for agreeing on the next steps with the client, for explaining why a gap matters, and for suggesting the controls that address it. The same information supports the discussion in a monthly business review.