[ Applies to ] StorageGuard 9.2 and later / All supported storage, backup, SAN and cloud systems / Windows and Linux deployments
The Risks pages show what's wrong. The Compliance tab answers a different question: for a given standard, which checks pass, which fail, and on how many systems. It's the view to use when someone asks "are we PCI DSS compliant on our backup systems?" and expects an answer per requirement, not a list of findings.
In this article
Before you begin
- The policy for the standard is enabled, with the system scope you want to assess. See Choose and create baseline policies.
- A risk analysis has run since. See Run and schedule a risk analysis.
Open the Compliance view
Click the Compliance tab. Each row is one check, with the number of scanned systems that passed and failed it. The table reflects the last risk analysis.
Choose the standard and the systems
Use the sidebar on the left:
- Under Policies, select the standard or baseline to assess, for example PCI DSS or CIS Controls. The table shows only that policy's checks. Select several policies to see their combined checks.
- Under System types, select the platforms to include, for example Data Domain / PowerProtect DD and ONTAP. Leave all unselected to include every system type.
- Use Search to find a check by name or ID.
Tip: For an audit, select one policy and the system types in the audit's scope. The table then maps one-to-one to the standard's requirements, through the labels in each row.
Read the results
| Column | Meaning |
|---|---|
| Check name | The configuration check, with its ID. |
| CI type | The platform the check applies to. |
| Pass | Systems where the check passed. |
| Fail | Systems where it failed. Each failure is an open finding on the Risks page. |
| Insufficient Information | Systems where the scan didn't collect enough data to decide, usually a partial scan. |
| Not Applicable | Systems where the check doesn't apply, for example a protocol the system doesn't support. |
| Missing user input | Systems where the check needs a parameter value before it can decide, such as your list of approved NTP servers. |
| Labels | The standards and requirement identifiers the check satisfies, for example a PCI DSS requirement number or a CIS Control. |
A check is compliant for a system when it passes. Checks with zero failures across all systems in scope are the requirements you already meet; checks with failures are the gaps.
Deal with checks that couldn't be evaluated
An auditor will ask about every system that isn't a clear pass or fail. Clear these up before you present the results:
| Column | What to do |
|---|---|
| Insufficient Information | Fix the scan. The system was probably partially scanned. See Fix scan errors. |
| Missing user input | Set the parameter the check needs, then run the analysis again. See Change a check parameter. |
| Not Applicable | Nothing to fix. If you want these out of the picture, exclude the check from your policy, or note the reason for the auditor. |
[ Next step ]
Related articles
[ Still need help? ]
Our support team can help with compliance reporting. Submit a request
Comments
0 comments
Please sign in to leave a comment.