25. Compliance: attestations, exceptions and reports

Some controls cannot be checked by a script: a reviewed policy, delivered training, a signed vendor assessment. An attestation records a person's statement about such a control, with a justification and an expiry. An exception takes a control that is not met, and will not be soon, out of scoring for a fixed period, with a compensating control. Attested and waived controls are always reported separately from measured results, never blended into one score.

Reports are dated documents covering a stated period, produced on demand or on a cadence, and optionally emailed.

Permissions:

25.1 Attestations#

Path: Compliance > Attestations (the attestations tab of the page).

What you see:

• A warning when attestations expire within 45 days: "When one lapses its control reverts to unassessed and the compliance score drops."
• Tiles: Attested met, Not applicable, Active exceptions ("Excluded from scoring, not counted as passes"), Expired attestations ("No longer credited to any score").
• The list of attestations with Revoke on each active one.

Procedure: record an attestation#

1. Open Compliance > Attestations and press New attestation.
2. Fill Record an attestation:

3. Press Record attestation.

What you see: "Attestation recorded." The scan page of that framework then shows a Measured score and an Adjusted score side by side.

Procedure: revoke an attestation#

Permission: Run scans (or Manage compliance). Four-eyes: no. Risk: the control reverts to unassessed and the score may drop. Rollback: record a new attestation.

1. Open Compliance > Attestations and find the active attestation.
2. Press Revoke on its row.
3. The browser asks "Why is this attestation being withdrawn? (recorded for audit)". Type the reason (at least 5 characters) and press OK. Cancel, or a shorter reason, sends nothing.
4. What you see: "Attestation revoked." The row now shows Revoked.

An attestation cannot be edited. To change one, revoke it and record a new one. Expired, revoked and superseded attestations stay in the list as a record; there is no delete.

If it fails: the form names the field in error (for example a justification under 20 characters, or an expiry in the past or beyond the maximum).

25.2 Exceptions#

Path: Compliance > Attestations, then the exceptions tab of the page.

An exception "removes a control from scoring for a fixed period. It is not a pass - the control is recorded as not met, with the risk accepted." It goes through two people: one requests, another approves.

Procedure: request an exception#

1. Open the exceptions tab and press Request exception.
2. Fill Request an exception:

3. Press Submit request.

What you see: "Exception requested. It has no effect until an administrator approves it."

Procedure: approve or revoke an exception#

Permission: Manage compliance. You cannot approve an exception you requested yourself.

1. Open the exceptions tab. Pending requests show Approve.
2. Read the reason and the compensating control.
3. Press Approve ("Exception approved."). The control leaves scoring until the expiry.
4. To end an exception early (pending or approved), press Revoke. The browser asks "Why is this exception being withdrawn? (recorded for audit)". Type the reason (at least 5 characters) and press OK. You see "Exception revoked." The control counts in scoring again.

An exception cannot be edited. To change one, revoke it and request a new one. Revoked and expired exceptions stay in the list as a record; there is no delete.

If it fails: "Only a pending exception can be approved" - it was already decided or revoked. A refusal when approving your own request is by design; ask a colleague.

25.3 The Reports tab#

Path: Compliance > Reports. "Frameworks with no scan in the period are marked not assessed rather than reported" as passing.

What you see:

• Refresh, Generate now, New schedule (with Manage reports).
• Schedules: each with its cadence, scope, Next run, Last run, Reports count, and a delete button. "Last run failed: <error>" when the last run failed.
• Generated reports: Report, Period covered, Status, Assessed, Generated, Download.

Report scopes#

Procedure: generate a report now#

1. Open Compliance > Reports and press Generate now.
2. The platform produces a Compliance posture report with a monthly period, in HTML.
3. Press Download on the new row.

Procedure: schedule a report#

Permission: Manage reports.

1. Press New schedule.
2. Fill the form:

3. Press Create schedule.

Emailing needs outbound email configured for the deployment (Settings > Setup, step "Configure outbound email"; see chapter 39). Without it reports are still produced and downloadable.

Procedure: change or stop a report schedule#

Permission: Manage reports. Four-eyes: no.

A report schedule has no edit or pause button in the console in this release. To change one, create the new schedule first, then delete the old one.

1. Open Compliance > Reports.
2. On the schedule, press the delete button (Delete schedule <name>).
3. The browser asks: "Delete "<name>"? Future runs stop. The N report(s) it has already produced are kept and stay downloadable." Press OK.
4. What you see: "Schedule deleted." The reports it produced stay under Generated reports.

Generated reports cannot be deleted from the console in this release. They are kept and stay downloadable. The permissions table above lists deleting a report because the server allows it, but no console screen offers it.

If it fails: