Assess Compliance Posture
View a summary of your compliance posture across all the SaaS apps that SaaS Security Posture Management is monitoring.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- SaaS Security Posture Management license
Or any of the following licenses that include the Data Security license:
|
Navigate to the Compliance dashboard to view a summary of your compliance posture
across all the SaaS apps that SaaS Security Posture Management is monitoring. The dashboard shows
your overall compliance posture across the following common compliance standards and
frameworks:
- Critical Security Controls (v8): The Center for Internet Security (CIS)
Critical Security Controls (CSC) Version 8 are a prioritized set of recommended
actions and safeguards to help organizations protect their data from known
cyberattack vectors.
- EU AI Act: The Artificial Intelligence Act of the European Union (EU AI
Act) is an EU regulation (Regulation (EU) 2024/1689) related to AI. The EU AI
Act's purpose is to promote human-centric and trustworthy AI and to regulate AI
systems to protect health, safety, and fundamental rights. The act assigns AI
applications to risk categories based on the level of risk. The act prohibits
unacceptable AI practices, and places rules on high-risk practices that could
impact health, safety, or rights.
- Health Insurance Portability and Accountability Act: The Health Insurance
Portability and Accountability Act of 1996 (HIPAA) is a United States federal
law designed to protect a patient's sensitive health information. Under this
law, the sensitive health information can’t be disclosed without the patient's
consent.
- ISO 27001: The International Organization for Standardization (ISO) 27001
standard describes controls and processes for the establishment, maintenance,
and improvement of an Information Security Management System (ISMS).
- Network and Information Security Directive: The Network and Information
Security Directive (NIS 2) is a European Union (EU) cybersecurity directive
(Directive (EU) 2022/2555). The directive's goal is to achieve a common high
level of cybersecurity across the EU for critical network and information
systems.
- NIST 800-53: The U.S. National Institute of Standards and Technology
(NIST) Special Publication (SP) 800-53 is a standard for Federal Information
Security Modernization Act (FISMA) compliance. It governs the security and
privacy of federal information systems.
- NIST AI RMF: The NIST AI Risk Management Framework (AI RMF) is a set of
guidelines designed to help organizations mitigate the unique risks posed by AI
systems. This voluntary framework was designed to be flexible enough to apply to
all organizations regardless of size or sector. Its guidelines concentrate on
responsible design, development, deployment, and use of AI systems to increase
their trustworthiness.
- NIST Cybersecurity Framework: The U.S. National Institute of Standards
and Technology (NIST) Cybersecurity Framework (CSF) provides guidance to
organizations on how to manage and reduce cybersecurity risks. Its
recommendations are designed to help organizations of all sizes implement best
practices.
- Payment Card Industry Data Security Standard: The Payment Card Industry
Data Security Standard (PCI DSS) is a set of requirements for storing,
processing, and transmitting credit card data. Its primary purpose is to protect
cardholder information and prevent credit card fraud.
- System and Organization Controls 2: The System and Organization Controls
Type 2 (SOC 2) is an auditing framework, developed by the American Institute of
Certified Public Accountants (AICPA), for assessing how well service
organizations store, process, and transmit sensitive data on behalf of their
clients or user entities.
For each of these standards and frameworks, the Compliance dashboard summarizes the
status of rules that map to the standard or framework. The failed policies represent
settings that are not compliant. From the dashboard, you can navigate to compliance
reports for each of the compliance standards and frameworks. The compliance reports
show the misconfigured settings by SaaS app. From there, you can drill down further
to view the settings that passed and failed, and remediate settings as needed.
Log in to
Strata Cloud Manager.
Select .
Review the SSPM Compliance dashboard.
The Compliance dashboard displays the overall compliance of SaaS apps that
SSPM is monitoring, and the number of rules for each compliance standard
that passed and failed. The dashboard table includes more details, such as
the number of app instances with settings related to the compliance
standard.
To export a CSV file that contains the information in the table, click the
table's download icon. SSPM will send a download link to your email address.
To view more details about your organization's compliance with a particular
standard, click its name in the Standard column of the table.
The details page shows the distribution of compliant and noncompliant rules
and settings related to the standard. This distribution is across all SaaS
apps monitored by SSPM. The compliance report breaks the distribution down
by each SaaS app.
To export a CSV file that contains the information in the table, click the
table's download icon. SSPM will send a download link to your email address.
To view the settings of a SaaS app that are not compliant with the standard,
click the number in the Non-Compliant column of the table.
The Security Settings page displays the misconfigured settings related to the
compliance standard.
You can use the
Compliance filter this on this page to show settings for other compliance
standards.
On the Security Settings page, review the current settings that are not
compliant with the standard. Review each setting's current value and recommended
value and take action as needed.
If automated remediation is available, you can
Remediate the noncompliance with a single click.
Otherwise, you can follow the steps for Manual
Remediation.
