Assess Compliance Posture
Table of Contents
Assess Compliance Posture
View a summary of your compliance posture across all the SaaS applications that SSPM
is monitoring.
Navigate to the Compliance dashboard to view a summary of your compliance
posture across all the SaaS applications that SSPM is monitoring. The dashboard
shows your overall compliance posture across the following common compliance
standards and frameworks:
- Critical Security Controls (v8): The Center for Internet Security (CIS) Critical Security Controls (CSC) Version 8 are a prioritized set of recommended actions and safeguards to help organizations protect their data from known cyberattack vectors.
- Health Insurance Portability and Accountability Act: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a United States federal law designed to protect a patient's sensitive health information. Under this law, the sensitive health information cannot be disclosed without the patient's consent.
- ISO 27001: The International Organization for Standardization (ISO) 27001 standard describes controls and processes for the establishment, maintenance, and improvement of an Information Security Management System (ISMS).
- Network and Information Security Directive: The Network and Information Security Directive (NIS 2) is a European Union (EU) cybersecurity directive (Directive (EU) 2022/2555). The directive's goal is to achieve a common high level of cybersecurity across the EU for critical network and information systems.
- NIST 800-53: The U.S. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 is a standard for Federal Information Security Modernization Act (FISMA) compliance. It governs the security and privacy of federal information systems.
- NIST Cybersecurity Framework: The U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides guidance to organizations on how to manage and reduce cybersecurity risks. Its recommendations are designed to help organizations of all sizes implement best practices.
- Payment Card Industry Data Security Standard: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements for storing, processing, and transmitting credit card data. Its primary purpose is to protect cardholder information and prevent credit card fraud.
- System and Organization Controls 2: The System and Organization Controls Type 2 (SOC 2) is an auditing framework, developed by the American Institute of Certified Public Accountants (AICPA), for assessing how well service organizations store, process, and transmit sensitive data on behalf of their clients or user entities.
For each of these standards and frameworks, the Compliance dashboard summarizes
the status of rules that map to the standard or framework. The failed policies
represent settings that are not compliant. From the dashboard, you can navigate to
compliance reports for each of the compliance standards and frameworks. The
compliance reports show the misconfigured settings by SaaS application. From there,
you can drill down further to view the settings that passed and failed, and
remediate settings as needed.
.- To navigate to the Compliance dashboard, select .The Compliance dashboard displays the overall compliance of SaaS applications that SSPM is monitoring, and the number of rules for each compliance standard that passed and failed. The dashboard table includes more details, such as the number of application instances with settings related to the compliance standard.To export a CSV file that contains the information in the table, click the table's download icon. SSPM will send a download link to your email address.
![]()
To view more details about your organization's compliance to a particular standard, click its name in the Standard column of the table.The details page shows the distribution of compliant and non-compliant rules and settings related to the standard. This distribution is across all SaaS applications monitored by SSPM. The compliance report breaks the distribution down by each SaaS application.To export a CSV file that contains the information in the table, click the table's download icon. SSPM will send a download link to your email address.To view the settings of a SaaS application that are not compliant with the standard, click the number in the Non-Compliant column of the table.The Security Settings page displays the misconfigured settings related to the compliance standard.You can use the Compliance filter this on this page to show settings for other compliance standards.On the Security Settings page, review the current settings that are not compliant with the standard. Review each setting's current value and recommended value and take action as needed.If automated remediation is available, you can Remediate the non-compliance with a single click. Otherwise, you can follow the steps for Manual Remediation.
