Compliance
Spot Security provides information on how compliant your organization is with global security standards.
To view your compliance with global security standards, go to Spot Security in the left menu of the console and click Compliance.
Security Compliance
You can review the compliance of your assets under two tabs:
- Total Compliance: Provides information on how your organization complies with global security standards.
- CIS Benchmark: Provides compliance information against CIS recommended standards.
Favorite Standards Chart
You can select a compliance from the provided list as a favorite.
The line graph shows the compliance of the assets in your cloud infrastructure with the global security standards marked as a favorite. You can select the time frames of two weeks, one month, or three months. You can also view the compliance of assets on a specific date using Snapback. Click Export to export the summary of the compliance to an Excel sheet.
Hovering over a specific line that represents a global security standard shows the percentage of compliance with the global security standard.
CIS Benchmark
The CIS benchmark section shows the compliance of your cloud infrastructure with CIS standards. Move the View toggle to view Level 1 and Level 2 to check the compliance with each level. You can view the detailed controls with:
- Control ID
- Control Description
- Non-Conformant Assets
- Compliance Status
- Category
- Scoring
Each control is mapped to the security rules that were defined in the Analyze Risk page. You can also view the compliance of assets on a specific date using Snapback. Click Excel to export the details of the compliance to an Excel sheet.
Compliance Standards
This section displays the global standards that are tracked for an asset, and they are mapped to the security rules that are on the Risk Analysis page.
The toggle Show Favorites Only is turned on by default. To see all the global compliance standards, turn the toggle off. Click the pin in the top right corner of each compliance standard to mark specific standards as favorites. The percentage in the compliance bar shows how compliant your cloud infrastructure is with the standard.
Compliance Standard Details
In the Compliance Standards section, click a standard to view the standard compliance overview page.
The overview page lists the controls that the compliance defines. The security rules are mapped into each control, and you can find the following information:
- ID
- Control Description
- Non-Comformant Assets
- Compliance Status
You can also view the compliance of assets on a specific date using Snapback. Click Export to view the details of the compliance in an Excel sheet.
To see the rules associated with compliance controls, click Control ID or Control Descriptions. You can click on the filter icon and filter the rules by severity level (low, medium, or high), remediation effort (advanced or easy), and asset type (such as S3, virtual machine).
Remediate Failed Assets
You can remediate failed assets by completing the following steps:
- Click Failed Assets to view the list of assets that are at risk due to a specific security rule failing on it.
- Click Remediation for a step-by-step guide on how to remediate the risk.
You can also accept the risk by clicking Suppress. This removes the risk from your list. You can suppress one or multiple rules by selecting them and clicking Suppress in the Actions Menu. You can suppress a security rule completely for all assets. To learn more about security rules see the Analyze Risk Page.