Compliance Scoring¶

CertifyClouds provides automated compliance assessments against industry frameworks to help you understand and improve your Key Vault security posture.

Overview¶

Compliance scoring evaluates your Key Vault configuration and contents against security best practices:

• Automated assessments: Continuous evaluation against 5+ frameworks
• Pre-built rules: 20+ automated compliance checks
• Score tracking: 0-100% compliance score with trend history
• Evidence collection: Automatic evidence for audit documentation
• Remediation guidance: Clear recommendations for violations

Supported Frameworks¶

CertifyClouds includes pre-built compliance rules for these frameworks:

CIS Azure Key Vault Benchmark¶

7 controls covering Key Vault security best practices:

SOC 2 Type II¶

5 controls related to security and availability:

ISO 27001¶

3 controls from Annex A:

NIST 800-53 Rev. 5¶

6 controls from SC and AU families:

Azure Security Benchmark v3¶

11 controls from DP (Data Protection) and IM (Identity Management):

Compliance Rules¶

Secret Rules (P001-P014)¶

Certificate Rules (C001-C006)¶

Key Rules (K001-K006)¶

Compliance Score¶

How Scoring Works¶

The compliance score is calculated as:

Score = (Passed Rules / Total Applicable Rules) × 100

Example:

• 50 total rules apply to your environment
• 45 rules pass
• Score = 45/50 × 100 = 90%

Severity Weighting¶

Violations are weighted by severity:

Score Interpretation¶

Viewing Compliance¶

Dashboard¶

The Compliance tab shows:

• Overall Score: Current compliance percentage
• Score Trend: Historical score over time
• Framework Breakdown: Score per framework
• Top Violations: Most common issues to fix

Violation Details¶

For each violation, view:

• Rule ID: Unique identifier (e.g., P001)
• Severity: Critical, High, Medium, Low
• Affected Assets: List of secrets/keys/certificates
• Evidence: Specific details (expiry date, key size, etc.)
• Remediation: Steps to resolve the violation

Running Compliance Checks¶

Automatic¶

Compliance is evaluated automatically:

• After each discovery scan
• When new assets are detected
• When asset properties change

Manual¶

Trigger a compliance check manually:

# Via API
curl -X POST http://localhost:8080/compliance/evaluate \
  -H "Authorization: Bearer $TOKEN"

Remediation¶

View Recommendations¶

Each violation includes remediation guidance:

1. Go to Compliance tab
2. Click on a violation
3. View Remediation Steps
4. Follow instructions to resolve

Common Remediations¶

Bulk Remediation¶

For large-scale remediation:

1. Export violations to CSV
2. Use Azure CLI/PowerShell scripts
3. Re-run compliance after fixes
4. Verify improved score

Reports¶

Generate Report¶

Create a compliance report for auditors:

1. Go to Compliance tab
2. Click Generate Report
3. Select frameworks to include
4. Choose format (PDF, JSON, CSV)
5. Download report

Report Contents¶

Reports include:

• Executive summary with overall score
• Framework-by-framework breakdown
• Complete violation list with evidence
• Remediation recommendations
• Historical trend data
• Audit timestamp and scope

Custom Rules (PRO)¶

PRO tier allows creating custom compliance rules:

Create Custom Rule¶

1. Go to Settings > Compliance Rules
2. Click Add Rule
3. Define:
4. Rule name and description
5. Asset type (secret, key, certificate)
6. Condition (expression)
7. Severity level
8. Save and enable

Example Custom Rules¶

Secret naming convention:

name must match pattern "^[a-z]+-[a-z]+-[a-z0-9]+$"

Maximum secret age:

(now - created_date) < 180 days

Required tags:

tags must include "owner" and "environment"

API Reference¶

Get Compliance Score¶

GET /compliance/score

Response:

{
  "score": 87.5,
  "passed": 42,
  "failed": 6,
  "total": 48,
  "by_severity": {
    "critical": 0,
    "high": 2,
    "medium": 3,
    "low": 1
  }
}

Get Violations¶

GET /compliance/violations?severity=high&framework=cis

Get Framework Details¶

GET /compliance/frameworks/cis-azure-keyvault

Best Practices¶

1. Monitor Continuously: Review compliance score after each scan
2. Prioritize Critical: Address critical violations immediately
3. Set Targets: Aim for 90%+ compliance score
4. Document Exceptions: Record accepted risks with justification
5. Track Trends: Use historical data to show improvement
6. Automate Remediation: Use alerts to trigger fix workflows