Home
Frameworks

Frameworks

Framework posture you can trace to a check.

ACSE maps each of its cloud checks to the framework controls it supports. Every control shows what evaluates it, or says plainly that it is manual. Framework content is signed and versioned, and nothing changes for your team until two people adopt a new version.

Talk to us See how it works

One check, many frameworks

A single result on a bucket or a firewall rule feeds every framework it supports, so you run one set of checks rather than one per audit.

No silent gaps

A control with no check shows as manual. A check that could not run reads not evaluated and counts against the score. Nothing becomes a pass by default.

Versions you choose

When a standard changes, you see the changelog and preview your score under the new version before anyone adopts it. Until then, you stay pinned.

Coverage

How much each framework is backed by checks

For each cloud, the share of the controls ACSE tracks that at least one automated check evaluates. These numbers come straight from the provider packs.

Share of each framework’s tracked technical controls that ACSE checks evaluate, by cloud
Framework	AWS74 checks	Google Cloud21 checks	Azure13 checks
CIS Benchmarks	82%51 of 62 controls	47%18 of 38 controls	55%12 of 22 controls
PCI DSS 4.0.1	44%21 of 48 controls	31%15 of 48 controls	17%8 of 48 controls
NIST SP 800-53 Rev. 5	53%24 of 45 controls	33%15 of 45 controls	27%12 of 45 controls
FedRAMP Moderate	53%24 of 45 controls	33%15 of 45 controls	27%12 of 45 controls
CCCS Medium	53%24 of 45 controls	33%15 of 45 controls	27%12 of 45 controls
ISO/IEC 27001	13%12 of 93 controls	9%8 of 93 controls	8%7 of 93 controls
SOC 2	21%8 of 38 controls	18%7 of 38 controls	13%5 of 38 controls

Share of each framework’s tracked technical controls that at least one automated check evaluates. The rest are listed as manual controls, so nothing is silently left out. Kubernetes and AI infrastructure coverage is coming. Generated 2026-10-23 from the provider packs.

Supported frameworks

Seven frameworks, plus your own

CIS Benchmarks

The AWS Foundations Benchmark 3.0.0 in full, and the Google Cloud and Azure benchmarks’ core sections.

Explore 02

PCI DSS 4.0.1

The technical requirements for network, configuration, cryptography, access and logging.

Explore 03

NIST SP 800-53

Rev. 5 technical controls across ten families, from access control to system integrity.

Explore 04

ISO/IEC 27001

Every Annex A control of the 2022 edition, with the technical ones backed by checks.

Explore 05

SOC 2

The Security, Availability and Confidentiality criteria of the Trust Services Criteria.

Explore 06

FedRAMP Moderate

The NIST SP 800-53 Rev. 5 Moderate baseline’s technical controls.

Explore 07

CCCS Medium

The Canadian Centre for Cyber Security’s Medium cloud profile, by ITSG-33 control.

Explore

Custom frameworks

Your internal standard, mapped to ACSE’s checks, drafted by one person and published by another.

Framework versions

When a standard changes, you decide when

Framework content ships as signed packs. A pack holds control mappings, titles and a changelog. It references checks by id, version and digest and never carries code.

Published and signedInitValue authors a new version, a second reviewer approves it, and it is signed with an Ed25519 content key. Your runtime verifies the signature before use and refuses a pack that fails.
Previewed on your own evidenceYou see what is new, changed and retired, and your score under the new version side by side with the current one. A preview changes nothing.
Adopted by two peopleA Tenant Admin and a second person adopt the new version, and the decision is recorded. Ignoring it means staying pinned.
Supported for a yearAn older version stays supported for 12 months after the next is published, with warnings as the end nears. Two versions can run side by side during a transition.

Honest scoring

Unknown is never a pass

The raw score is controls passing, divided by controls passing, failing and unknown. If a check is turned off, missing from your runtime or older than the version a pack needs, its controls read not evaluated and count as unknown.

Attestations, accepted exceptions and exclusions produce a second, governed score. It is always labelled with what it includes, and the raw score sits beside it.

Every report, export and audit package names the framework version
Both scores carried in every export
An expired exception stops counting on its own

Our rule

A mapping is configuration. It supports your evidence; it is not a compliance claim.

ACSE shows how your cloud configuration stands against the controls it tracks. Your assessor decides whether you meet a standard.

Questions

What people ask us

Does ACSE make us compliant?

No tool can. ACSE checks your cloud configuration against the technical controls it tracks, records how each finding was fixed and gives your assessor evidence they can verify offline. Whether you meet a standard is your assessor’s call.

Why does ACSE list fewer controls than the standard has?

For most frameworks ACSE lists the technical controls that cloud configuration can speak to, and says so on each page. CIS AWS Foundations and ISO/IEC 27001 Annex A are listed in full, with the controls no check evaluates shown as manual.

Can we stay on an older version?

Yes. Nothing upgrades automatically. You stay pinned to the version you adopted until two people adopt a newer one, and older versions are supported for 12 months after the next is published.

Can we add our own framework?

Yes. A security engineer drafts a custom framework by mapping your controls to ACSE’s checks, and a security approver publishes it. If you turn on ACSE’s optional AI, it can draft the mapping for a person to review.

Keep reading

Platform

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to us Explore the platform