Compliance posture
Every framework, one honest score.
ACSE maps each check to the controls it satisfies across the frameworks you answer to. One finding updates every framework it touches, and the score tells you plainly what is passing, failing and not yet known.
One fix, many controls
A single check can satisfy controls in several frameworks, so one fix moves every report it affects.
Scores you can defend
Unknown never counts as a pass, and the raw score is shown beside the governed one.
Framework updates under control
New framework versions arrive signed, with a changelog and a preview, and two people adopt them.
Coverage
What the checks evaluate today
The share of each framework’s tracked technical controls that at least one automated check evaluates. The rest are listed as manual controls.
| Framework | AWS74 checks | Google Cloud21 checks | Azure13 checks |
|---|---|---|---|
| CIS Benchmarks | 82%51 of 62 controls | 47%18 of 38 controls | 55%12 of 22 controls |
| PCI DSS 4.0.1 | 44%21 of 48 controls | 31%15 of 48 controls | 17%8 of 48 controls |
| NIST SP 800-53 Rev. 5 | 53%24 of 45 controls | 33%15 of 45 controls | 27%12 of 45 controls |
| FedRAMP Moderate | 53%24 of 45 controls | 33%15 of 45 controls | 27%12 of 45 controls |
| CCCS Medium | 53%24 of 45 controls | 33%15 of 45 controls | 27%12 of 45 controls |
| ISO/IEC 27001 | 13%12 of 93 controls | 9%8 of 93 controls | 8%7 of 93 controls |
| SOC 2 | 21%8 of 38 controls | 18%7 of 38 controls | 13%5 of 38 controls |
Share of each framework’s tracked technical controls that at least one automated check evaluates. The rest are listed as manual controls, so nothing is silently left out. Kubernetes and AI infrastructure coverage is coming. Generated 2026-10-23 from the provider packs.
Framework content
Frameworks treated like code
Signed packs
Each framework version ships as a signed content pack that references checks by id, version and digest.
Preview before adopting
See the changelog and a side-by-side preview of what changes before a new version takes effect.
Custom frameworks
Build your own internal standard from ACSE’s checks. A second person publishes it.
Reports
Reports for leaders and auditors
An executive report for leadership and audit packages per framework, built from sealed cases and exportable as PDF or CSV.
Questions
What people ask us
Does ACSE make us compliant?
No tool can. ACSE maps checks to controls and keeps the evidence of how each was satisfied or fixed. Your auditor decides compliance; ACSE makes their work faster and your answers provable.
Keep reading
Related
Frameworks
ACSE maps its cloud checks to CIS, PCI DSS, NIST 800-53, FedRAMP Moderate, CCCS Medium, ISO 27001 and SOC 2, with signed, versioned framework content.
ReadSolutionsContinuous compliance
ACSE evaluates your cloud against signed framework packs on every scan, fixes what fails through your own code and shows a governed score beside the raw one.
ReadPlatformEvidence
ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.