SaaS Security
Assess Compliance Posture
Table of Contents
Assess Compliance Posture
View a summary of your compliance posture across all the SaaS apps that SaaS Security Posture Management is monitoring.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
Or any of the following licenses that include the Data Security license:
|
Navigate to the Compliance dashboard to view a summary of your compliance posture
across all the SaaS apps that SaaS Security Posture Management is monitoring. The dashboard shows
your overall compliance posture across the following common compliance standards and
frameworks:
- Critical Security Controls (v8): The Center for Internet Security (CIS) Critical Security Controls (CSC) Version 8 are a prioritized set of recommended actions and safeguards to help organizations protect their data from known cyberattack vectors.
- Health Insurance Portability and Accountability Act: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a United States federal law designed to protect a patient's sensitive health information. Under this law, the sensitive health information can’t be disclosed without the patient's consent.
- ISO 27001: The International Organization for Standardization (ISO) 27001 standard describes controls and processes for the establishment, maintenance, and improvement of an Information Security Management System (ISMS).
- Network and Information Security Directive: The Network and Information Security Directive (NIS 2) is a European Union (EU) cybersecurity directive (Directive (EU) 2022/2555). The directive's goal is to achieve a common high level of cybersecurity across the EU for critical network and information systems.
- NIST 800-53: The U.S. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 is a standard for Federal Information Security Modernization Act (FISMA) compliance. It governs the security and privacy of federal information systems.
- NIST Cybersecurity Framework: The U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) provides guidance to organizations on how to manage and reduce cybersecurity risks. Its recommendations are designed to help organizations of all sizes implement best practices.
- Payment Card Industry Data Security Standard: The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements for storing, processing, and transmitting credit card data. Its primary purpose is to protect cardholder information and prevent credit card fraud.
- System and Organization Controls 2: The System and Organization Controls Type 2 (SOC 2) is an auditing framework, developed by the American Institute of Certified Public Accountants (AICPA), for assessing how well service organizations store, process, and transmit sensitive data on behalf of their clients or user entities.
For each of these standards and frameworks, the Compliance dashboard summarizes the
status of rules that map to the standard or framework. The failed policies represent
settings that are not compliant. From the dashboard, you can navigate to compliance
reports for each of the compliance standards and frameworks. The compliance reports
show the misconfigured settings by SaaS app. From there, you can drill down further
to view the settings that passed and failed, and remediate settings as needed.
- Log in to Strata Cloud Manager.
- Select .
- Review the SSPM Compliance dashboard.The Compliance dashboard displays the overall compliance of SaaS apps that SSPM is monitoring, and the number of rules for each compliance standard that passed and failed. The dashboard table includes more details, such as the number of app instances with settings related to the compliance standard.To export a CSV file that contains the information in the table, click the table's download icon. SSPM will send a download link to your email address.
- To view more details about your organization's compliance with a particular standard, click its name in the Standard column of the table.The details page shows the distribution of compliant and noncompliant rules and settings related to the standard. This distribution is across all SaaS apps monitored by SSPM. The compliance report breaks the distribution down by each SaaS app.To export a CSV file that contains the information in the table, click the table's download icon. SSPM will send a download link to your email address.
- To view the settings of a SaaS app that are not compliant with the standard, click the number in the Non-Compliant column of the table.The Security Settings page displays the misconfigured settings related to the compliance standard.You can use the Compliance filter this on this page to show settings for other compliance standards.
- On the Security Settings page, review the current settings that are not compliant with the standard. Review each setting's current value and recommended value and take action as needed.If automated remediation is available, you can Remediate the noncompliance with a single click. Otherwise, you can follow the steps for Manual Remediation.
