Your First Compliance Audit

After discovering your infrastructure, run compliance audits to identify security gaps and policy violations.

How Compliance Auditing Works

Infracast evaluates your infrastructure graph against compliance rules mapped to industry frameworks:

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│   Node Graph    │────▶│   Audit Engine   │────▶│    Findings     │
│  (167 nodes)    │     │   (776 rules)    │     │  (violations)   │
└─────────────────┘     └──────────────────┘     └─────────────────┘
                               │
                               ▼
                        ┌──────────────────┐
                        │   Framework      │
                        │   Mappings       │
                        │  NIST, CIS, etc  │
                        └──────────────────┘

Step 1: Enable Compliance Frameworks

Navigate to Settings

1. Click Settings in the left sidebar
2. Select the Compliance Frameworks tab

Enable Frameworks

Toggle on the frameworks relevant to your organization:

Framework	Best For
NIST 800-53	Federal agencies, government contractors
CMMC	Defense contractors (DoD supply chain)
FedRAMP	Cloud services for federal agencies
PCI-DSS	Organizations handling credit cards
SOC 2	SaaS companies, service providers
HIPAA	Healthcare organizations
CIS Benchmarks	General security hardening
STIGs	DoD systems, high-security environments

Start with CIS

If you're unsure, start with CIS Benchmarks — they provide practical, actionable security guidance for AWS, Azure, and common platforms.

Save Settings

Click Save to enable the selected frameworks.

Step 2: View Findings

Navigate to Findings

Click Findings in the left sidebar. You'll see compliance violations discovered in your infrastructure.

Findings Overview

Each finding includes:

Field	Description
Severity	CRITICAL, HIGH, MEDIUM, LOW, INFO
Risk Score	0-100 calculated risk score
Framework	Which compliance framework (e.g., NIST 800-53)
Control	Specific control ID (e.g., AC-2)
Resource	Affected node (e.g., sg-legacy-open)
Description	What's wrong and why it matters

Example Finding

┌────────────────────────────────────────────────────────────────┐
│  ⚠️  HIGH — Security Group Allows Unrestricted SSH            │
├────────────────────────────────────────────────────────────────┤
│  Framework:   CIS AWS Foundations v1.5                         │
│  Control:     5.2 — Ensure no security groups allow 0.0.0.0/0 │
│  Resource:    aws:us-east-1:aws.ec2.security_group:sg-legacy  │
│  Risk Score:  78                                               │
├────────────────────────────────────────────────────────────────┤
│  Description:                                                  │
│  Security group sg-legacy allows inbound SSH (port 22) from   │
│  0.0.0.0/0. This exposes the associated instances to brute    │
│  force attacks from the entire internet.                       │
│                                                                │
│  Remediation:                                                  │
│  Restrict the source IP range to known bastion hosts or VPN   │
│  CIDR blocks. Consider using AWS Systems Manager Session      │
│  Manager for SSH-less access.                                  │
└────────────────────────────────────────────────────────────────┘

Step 3: Prioritize by Risk

Sort by Risk Score

The Risk Score (0-100) combines:

• Severity of the finding
• Exposure (internet-facing vs internal)
• Asset criticality (production vs dev)
• Exploitability

Sort by risk score to tackle highest-impact issues first.

Filter by Severity

Use the severity filter to focus on specific levels:

• CRITICAL — Fix immediately (data exposure, credential leak)
• HIGH — Fix within 1 week (public-facing misconfigurations)
• MEDIUM — Fix within 1 month (hardening gaps)
• LOW — Fix when convenient (best practices)

Step 4: Investigate a Finding

Click to Expand

Click any finding to see:

1. Full Description — Detailed explanation
2. Remediation Steps — How to fix it
3. Evidence — Node properties that triggered the finding
4. Related Nodes — Other affected resources
5. Framework Mapping — Which controls this violates

View in Topology

Click View in Topology to see the resource in context:

• What VPC/subnet is it in?
• What's connected to it?
• Is it internet-exposed?

Trace Path

For network-related findings, use Trace Path:

1. Check if the misconfigured resource is actually reachable from the internet
2. Identify chokepoints where you could add controls
3. Validate that your network segmentation works

Step 5: Remediate

Direct Remediation

For IaC-managed resources, Infracast can generate fixes:

Terraform fix for sg-legacy

resource "aws_security_group_rule" "ssh_restricted" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  # Changed from 0.0.0.0/0 to bastion CIDR
  cidr_blocks       = ["10.0.100.0/24"]
  security_group_id = aws_security_group.legacy.id
}

Create Ticket

Click Create Ticket to send the finding to Jira, ServiceNow, or your configured ticketing system.

Mark as Accepted Risk

If you've reviewed the finding and decided to accept the risk:

1. Click Accept Risk
2. Provide justification
3. Set review date (when to revisit)

Accepted risks don't count toward compliance percentages but remain visible for auditors.

Step 6: Generate Reports

Compliance Summary Report

Navigate to Reports and generate a summary:

Report Type	Contents
Executive Summary	Overall compliance posture, trends, top risks
Framework Detail	Per-framework control status (NIST, CIS, etc.)
Finding Detail	Full list of findings with evidence
Remediation Plan	Prioritized fix list with effort estimates

Export Formats

• PDF — For executives and auditors
• CSV — For importing into GRC tools
• JSON — For API/automation integration

Schedule Reports

Set up automated weekly or monthly reports:

1. Click Schedule Report
2. Select report type and format
3. Choose recipients (email addresses)
4. Set frequency (weekly, monthly)

Understanding Compliance Scores

Overall Score

The compliance score is calculated as:

Score = (Passing Controls / Total Applicable Controls) × 100

For example, if NIST 800-53 has 300 applicable controls and 240 pass:

Score = (240 / 300) × 100 = 80%

By Framework

Each framework shows its own score:

Framework	Passing	Applicable	Score
NIST 800-53	240	300	80%
CIS AWS	42	50	84%
PCI-DSS	180	200	90%

Trend Tracking

Infracast tracks your compliance score over time:

• Weekly trend charts
• Month-over-month improvement
• Regression alerts (score dropped)

Continuous Monitoring

Automatic Re-Evaluation

Every discovery run triggers compliance re-evaluation:

1. Discovery finds new/changed resources
2. Audit engine runs applicable rules
3. New findings appear (or existing ones resolve)
4. Compliance scores update

Real-Time Alerts

Configure alerts for compliance events:

• New CRITICAL finding detected
• Compliance score drops below threshold
• Previously fixed issue regressed

Integration with CI/CD

Block deployments that introduce compliance violations:

.github/workflows/compliance-gate.yml

- name: Check Compliance
  run: |
    SCORE=$(curl -s -H "Authorization: Bearer $TOKEN" \
      "$API_URL/api/v1/tenants/$TENANT/compliance/score" | jq '.score')
    if [ "$SCORE" -lt 80 ]; then
      echo "Compliance score $SCORE below threshold (80)"
      exit 1
    fi

What's Next?

• Compliance Deep Dives — Detailed guides for each framework
• Set Up Integrations — Connect Jira, Slack, ServiceNow
• Generate SSP — Auto-generate System Security Plans