Compliance
Compliance shows, framework by framework, how far the technical controls CloudCerta can actually observe from a cloud scan line up with that framework’s criteria — currently SOC 2 and GDPR — plus a place for your team to attest to the controls a scan can’t see at all.
This is a readiness indicator, not a compliance assessment
It is not an audit, not a certification, and not an assertion that you are compliant — and not a substitute for a qualified assessor. This banner is permanent and appears on every page in this area.
What’s on the page
The index lists one card per framework: its name and version, a headline Technical readiness percentage (or —when nothing is assessable), a four-way count of Met / Gap / Not assessed / Not assessable controls, and how many of the framework’s criteria are assessable from a cloud scan at all.
Opening a framework shows the same headline numbers plus an attested readiness figure, then every control grouped into sections. Each control row shows its id, title and intent, a status pill, an attestation badge with an edit/attest link, a note when evidence is thin or absent, which checks map to it, and — only for controls with a gap — a link to the findings that are actually causing it.
What you can do
Anyone in your organisation can view this area. Attesting a control — recording that a human has confirmed a non-technical requirement is met — is Owner or Admin only. The attestation editor takes a status (Implemented, Partial, Not implemented, Not applicable), an owner, a note, an optional evidence link, and a “review by” date. Marking a control Not applicable requires a note, and is the only status that removes the control from the readiness percentage entirely rather than counting it as unmet.
Evidence links are stored and displayed only — CloudCerta never opens or fetches them. Saving an attestation carries the version you last saw; if someone else changed it first, you’ll be asked to refresh rather than overwriting their change.
How to read it
- Not assessed is not a pass.It means the control wasn’t evaluated this scan, and it still counts against the readiness percentage.
- Not assessablemeans CloudCerta has no way to evidence that control from a cloud scan at all, and is excluded from the percentage entirely — it’s neither a pass nor a fail.
- A brand-new tenant can show 0%, not a dash.Once a framework has controls mapped to checks, having never scanned forces those controls to “Not assessed” — which counts in the denominator — so the percentage computes honestly to zero rather than hiding behind a placeholder.
- An active finding counts as evidence of a gap even from a check that didn’t happen to run in the most recent scan — when in doubt, the system reports Gap rather than Met.
- Two percentages, not one.Technical readiness comes from scan evidence; attested readiness comes from what your team has confirmed by hand. They’re shown separately because they answer different questions.
- Once an attestation’s “review by” date passes, it’s relabelled “Review overdue” and counts as not-met again regardless of what it originally claimed.
- A control’s gap link only points at the checks that are actually raising active findings against it right now — not every check that could theoretically apply.
Before your first scan
If Cloud Posture isn’t enabled for your tenant, this area says so and stops there. Once it’s enabled, SOC 2 and GDPR are available immediately — every mapped control shows “Not assessed,” both readiness percentages sit at 0%, and the readiness disclaimer is already in place, all before your first scan has run.