Audit Firms & Assessors

Evidence you can interrogate, limits included

Findings are mapped per control with the rationale stated. Where a scan set out to measure something and could not, the pack says so instead of passing it quietly: an analysis agent that did not run leaves a [COVERAGE GAP] AGENT NOT RUN record that fails that agent's own controls in all eight frameworks; and with SLA tracking on (--compliance-history or --sla-policy) and a prior --compliance scan of the same host in the history, a control that failed on a prior finding whose port, region or producer this scan did not measure is held FAILED by an evidence-gap record, counted under “Evidence gaps (not findings)” and never presented as a current finding. Since Enterprise 1.3.0 that hold also covers the prior CVE rows on a service whose lookup failed (a LOOKUP NOT MEASURED record, which does not name which lookup failed), the CVE mapper's and the service agent's rows on a TCP port whose service the scan could not identify, and an analysis agent's or the CVE mapper's rows when a plugin they read was left out of the scan; and on any scan the CVE mapper's own record of a failed lookup fails, as an evidence gap, the controls its CVE rows map to in seven of the eight frameworks (HIPAA has no CVE-mapper rule). SLA age no longer resets on every scan: since Enterprise 0.32.4 a pack stored its findings' prose with other frameworks' control ids removed and its punctuation tidied, and MTTR read the earlier scan from that text, so in the seven packs other than SOC 2 most cloud findings read as closed and newly found on every scan and their age never reached an SLA threshold, and in SOC 2 the tidy alone did the same to prose that named no other framework; a finding is now keyed on its prose with every framework's ids removed, on both sides, so an existing history reads correctly with no pack regenerated. Two measured limits are stated in the release notes rather than left for your fieldwork to find. A scan made before Enterprise 1.3.0 could not record a plugin left out of it, so in a comparison with one, an agent's row that scan lacks is not refused — the report's Basis cell says so on the row. And a scan that discovered ports with the Nmap plugin (024) alone records no port oracle, so an analysis agent's or the CVE mapper's row on a port it did not measure can read RESOLVED and count as closed in MTTR, and the control it failed can read PASS. Read the coverage gaps beside each verdict, and ask for compared scans made with Enterprise 1.3.0 that include the port scanner (003).