Compliance reports

Compliance reports provide you with a detailed, targeted, overview of your company's compliance with corporate governance policies, enterprise risk management, and company regulatory policies.

The report gathers data from your company's managed endpoints, groups it into compliance-relevant topics, and creates an easily readable, single source of insight into endpoint compliance.

Creating a compliance report

To create a compliance report, follow these steps:

Log into the GravityZone console.
Go to the Risk Management page.
Click on the Compliance report button on the upper right side of the page.
A confirmation window appears.
Configure the following settings:
- Report type - Select the type of report you want to generate.
- Format - Select the format you want to generate the report in.
Click Create to generate the report.

Reading compliance reports

A compliance report contains the following sections:

In PDF format

Executive summary

This section provides you with a general overview of the compliance adherence in your company and your regulatory posture. It contains the following subsections:

Check overview

This section provides compliance numbers and statistics for all your managed endpoints. It contains the following information:

Checks pass - The percentage of checks that were passed from the total number of checks performed.
Tip
Suppressed checks are not considered in calculating this number.
Total checks - The total number of checks that apply to your company's endpoints at the time of the latest Risk scan.
Total checks pass - The number of checks that were passed.
Total checks fail - The number of checks that were failed.
Total checks suppressed - The total number of checks that were suppressed at the time of the latest Risk scan.

Compliance controls overview

This section lists the compliance standards that apply to your endpoints and your company adherence to each one:

A control is the totality of checks that have to be done in order for a compliance standard to be verified. Checks are only processed for the subsections of the compliance standard that apply to each endpoint.

Control pass - The percentage of compliance controls that were passed from the total number of checks performed.
Total controls - The total number of compliance standards that apply to your company's endpoints at the time of the latest Risk scan.
Total controls pass - The number of controls that were passed.
Total controls fail - The number of controls that were failed.
Total controls not evaluated - The number of checks that could not be processed, either due to the information not being available or all the applicable checks associated to the compliance standard have been suppressed.

Failed checks by severity

This section provides a breakdown of all failed checks, grouped by their severity:

Legend

This section lists all the visual and written markings used in the report and provides additional details and context.

Check status

Indicator	Description
Pass	Indicates that the check has passed. Additional verification may be required to fulfill control requirements.
Fail	Indicates that the check has failed.
Suppressed	The number of suppressed checks that are being excluded in the count.

Control status

Indicator	Description
Pass	This status is assigned when all the checks performed on the applicable scope have passed. Additional verification may be required to fulfill control requirements.
Fail	This status is assigned when one or more checks performed on the applicable scope have passed.
Not evaluated	The control can not be performed, either due to the information not being available or all the applicable checks associated to the compliance standard have been suppressed.

Severity rating classification

Indicator	Description
High	High severity indicates that the discovered weakness is publicly disclosed and trivial to abuse. High severity indicators typically represent weaknesses that were leveraged to gain privileged access to networks, systems, or applications.
Medium	Medium severity indicates that the discovered weaknesses are likely to lead to compromise but either require other attacks to be significantly impactful, resulting in limited access, or require advanced knowledge and techniques to execute the attacks.
Low	Low severity indicates that the discovered weaknesses that are not directly exploitable. Low typically require a chain of weaknesses to exploit fully, disclose non-sensitive technical information, or do not lead to any additional compromise within an environment.

Controls overview

This section lists all of the controls that were performed on your endpoints and assets, and provides the following information for each one:

Control - The name of a control and the numbers of all its applicable subsection.
Guideline description - Provides a general description of what checks are made and what standards need to be met for the control to pass.
Status - States if your organization passed or failed this control.
Total checks - Indicates on how many entities the check was made.
Breakdown - Breaks down the total number of checks, based on the number of entities where they failed or passed.
Severity - Indicates the severity applied to the control.

List of resources

This section provides you with a breakdown of endpoints involved in the compliance verification that resulted in the report.

Legal notice

This section contains all relevant legal information related to the generation, use, sharing, and purpose of Bitdefender compliance reports.

In XLSX format

While providing the same level of insight as the PDF version, the XLSX report provides more specific data regarding the data compiled for the creation of the report.

The Summary tab