Product guide

Compliance Reports

Report on the control areas the platform can evidence, for the period and asset scope of your audit.

What a Compliance Report Is#

A compliance report turns platform data into evidence for a control area. It answers the auditor’s question - "show me that this is managed" - with a record rather than a description.

Reports are only as good as their scope and period. A correct report with the wrong scope is worse than no report, because it creates a false record.

Compliance and policy enforcement report — ISO 27001 / SOC 2 aligned compliance score, protection layers, and GPO enforcement.

Frameworks and Controls#

Nine regulations have a control by control report. Each report assesses the articles of the regulation with live platform evidence and marks the items the platform cannot measure as manual review.

Framework	Jurisdiction	Controls
KVKK	Türkiye	13
GDPR	European Union	13
ISO/IEC 27001:2022	International	18
HIPAA Security Rule	United States	14
PCI DSS v4.0	International	18
SOC 2	International	12
NIST CSF 2.0	United States	22
CIS Controls v8.1	International	18
ISO/IEC 42001:2023	International	9

The same reports are also organised around six control areas. Map these to the framework you are audited against:

Control area	What it evidences
Asset control	Every managed endpoint is inventoried, so the asset scope of the audit is defined.
Configuration control	Agent profiles and policies describe the required state of each device class.
Access control	Local accounts, administrative rights, and SaaS access are reported per asset and per user.
Data control	Classification rules, DLP policies, and DSPM findings describe how sensitive data is governed.
Change control	Policy changes, scripts, and automations are recorded with the operator who performed them.
Logging control	Panel actions are written to the audit log, so administrative activity is traceable.

Evidence, not assertion

The value of the report is that it comes from collected data. A policy document describes intent; the report describes what the platform actually observed.

One measurement, several frameworks

Each framework report lists the other frameworks that share the same evidence in an Also Satisfies column, and the Cross-Framework Control Mapping report shows every evidence source with the frameworks and the controls it satisfies. A control that is measured once can be reused in every audit that asks for it.

Generating a Report#

1
Select the framework
Choose the framework or regulation you are reporting against, so the report is structured around its control areas.
2
Set the period
Audit periods have a start and an end. Generate the report for exactly that period so it can be compared with the previous one.
3
Set the asset scope
Report on the endpoints in scope for the audit. An out-of-scope endpoint included by accident weakens the whole report.
4
Review before sharing
Read the report and check the gaps. A control with no evidence is the finding the auditor will ask about first.
5
Store the output
Keep the generated report with its scope and period, so a later audit can be answered from the same record.

Evidence Management#

Every report carries its period and scope; keep them together, because the report cannot be interpreted without them.
Keep a continuous chain. A gap in the report history is itself an audit finding.
Store exported evidence outside the retention window it must outlive.
Compare consecutive periods. A control that was evidenced last period and is not this period is the most useful thing a compliance report can show.

Frequently Asked Questions#

Does a report make us compliant?

No. A report demonstrates what the platform observes and enforces. Compliance also depends on process, policy, and organisational decisions that sit outside the platform.

Which frameworks are supported?

Nine regulations ship with a control by control report: KVKK, GDPR, ISO/IEC 27001:2022, HIPAA Security Rule, PCI DSS v4.0, SOC 2, NIST CSF 2.0, CIS Controls v8.1 and ISO/IEC 42001:2023. Each report is also structured around the control areas the platform can evidence: asset, configuration, access, data, change, and logging.

How long should evidence be kept?

Follow your regulatory retention requirement. Because retention on the appliance is under your control, export the reports that must outlive it.

Can I show the same report to two auditors?

Yes, if the scope and period are the same. If the scopes differ, generate two reports; a single report with a mismatched scope causes more questions than it answers.