22. Compliance: scans, results and the fix plan

A compliance scan checks the hosts against the controls of one framework (for example a CIS benchmark) and records, per host and per control, whether the control is met. A scan only reads. It never changes a host. Fixing what a scan found is done through hardening (chapter 26), starting from the scan's Fix plan.

The Compliance area has seven tabs:

Permissions:

22.1 What the Overview tab shows#

Path: Compliance (the Overview tab is selected).

• Tiles: Frameworks available, Total scans, Average score, Failing controls.
• Run compliance scan form (22.2).
• Active scans: running scans with a progress timeline. The refresh button reloads them.
• Scan history: Framework, Status, Score, C / P / V / NA (compliant / partial / violation / not assessed), Duration, Started. Click a row to open the scan.
• Framework registry: Name, Code, Version, Controls, Platforms. Select on a row chooses that framework in the scan form.
• Shortcut cards to Schedules, Drift, Heatmap and Trends.

How the score is calculated#

score = (passed + 0.5 x partial) / total x 100

• Partial earns half credit.
• Not assessed controls (the agent did not answer in time, had no command, or no agent was targeted) stay in the total. A 100% score needs every control assessed and passed.
• Attestations and exceptions are reported separately; see chapter 25.

22.2 Procedure: run a scan#

Permission: Run scans. Four-eyes: no. Risk: none to hosts (read-only). Rollback: not needed.

1. Open Compliance.
2. In Run compliance scan, choose the Framework (or press Select on a row of the Framework registry).
3. Under Target choose:
   • All agents - every online agent; or
   • Select agents - tick the hosts you want. Only online agents are listed; the line "N offline agent(s) hidden" tells you how many were left out.
4. Press the button. It reads Run scan on all N agents or Run scan on N selected agents (Select agents first while none is ticked).

What you see: the scan appears under Active scans, then moves to Scan history when it finishes. Open it for the results (22.3).

If it fails:

To run the same scan regularly, use a schedule (chapter 23). Administrators can also start a scan from Operations (chapter 39).

22.3 Reading a scan#

Click a scan in Scan history (or a failed scan on the Overview page). The scan page shows:

• Header: framework, status and score. While the scan runs it polls ("Polling...") and shows how many commands are still in flight.
• Scan timed out or Scan failed box when that happened. A timed-out scan keeps the results that arrived; the rest are not assessed.
• Target summary (targeted scans): Mode, Targeted, Responded, and a table per Host with Score, P / F / NA (passed / failed / not assessed) and Total. "N of M targeted agents did not respond" means those hosts' controls count as not assessed.
• Tiles: Total, Compliant, Non-Compliant, Partial, Not assessed, In-Flight.
• Fix plan (completed scans only; 22.4).
• Score explanation: the formula, the breakdown, and, when attestations apply to this framework, the Measured score next to the Adjusted score with Review attestations and exceptions.
• Control findings: filter buttons All, Failed, Not assessed, Partial, Error, Unsupported, Passed. Columns Control, Category, Severity, Status, Finding. Show all controls and Show all hosts expand long lists.
• Recommended next action: what to do next given the result.

Click a control row to open its detail: status, severity, host, Finding, Remediation and the raw Evidence the agent returned.

Note: the Recommended next action box and the control detail may still say "Hardening plan execution is not yet available in this build". That text is out of date; use the Fix plan panel on the same page (22.4).

22.4 Procedure: start hardening from the fix plan#

The Fix plan lists the failed controls that the platform can fix automatically on one host, ranked by how much each raises the score. It tells you how many are fixable here, how many need a manual change, and what the score would become.

Permission: Run hardening. Four-eyes: the run is created without a second signature; it then waits in Hardening as "Pending approval", and approving it is a critical action.

Risk: once approved and executed, the selected fixes change the host's configuration. Rollback: from Hardening, for every step that has a rollback script (chapter 26).

1. Open the completed scan.
2. In Fix plan, under "Hardening runs on one host. Choose which:", pick the host in Select a host.
3. Tick the fixes you want. The text "Fix the N selected and this scan goes from X to Y" shows the effect, and "The N quick ones alone reach X%" when some fixes are quick.
4. Press Start hardening (N).

What you see: "Hardening run <id> created. It waits for approval before anything changes on the host." and Open Hardening. Nothing has changed on the host yet.

5. Continue in chapter 26: review the steps, then Approve & Execute.

If it fails: "The hardening run could not be created." or a server message (for example missing permission). No run exists; nothing changed.

Before applying a control that can lock you out (key-only SSH, firewall lockdown, disabling the built-in administrator, disk encryption), issue a recovery artifact first (chapter 26).

22.5 Scans are kept: no cancel, no delete#

A scan cannot be cancelled, edited or deleted from the console in this release. This is deliberate: a scan is the record an auditor relies on.

• A scan you started by mistake: let it finish. It only reads the hosts. Ignore it, or run the right scan afterwards; scores and trends use the newest scan of each framework.
• A scan that hangs: it times out by itself. The controls whose answers did not arrive count as not assessed (22.3).
• A scan that should not have run again: disable the schedule that started it (23.1).

22.6 If something looks wrong#