Continuous compliance
Compliance that holds every day of the year.
Point-in-time audits leave you guessing the other eleven months. ACSE checks your cloud against the frameworks you answer to on every scan, routes each failure to a governed fix, and keeps a score that never hides what the cloud actually reports.
Know where you stand today
Posture per framework is current as of the last scan, not the last audit.
Catch drift before the auditor does
When a fixed resource slips back, the case reopens and the score shows it.
A number you can defend
The governed score always sits beside the raw one, with the attestations, exceptions and exclusions behind it counted out.
Two scores
An honest score, with the work shown
Your raw score is what the cloud says right now, and nothing ever adjusts it. Your governed score adds what your team has handled on the record: attestations and accepted exceptions count as handled, and exclusions leave the total.
The two always appear together, in the portal and in every report, so progress on governance can never mask a failing control.
- Unknown is never counted as a pass
- A control whose check is turned off reads not evaluated
- Reports carry both scores and the counts behind them
Example tenant · 120 controls
Governed: what your team has handled
Raw: what the cloud says right now, never adjusted
Both scores are always shown together, so a better governed score can never hide what the cloud reports. Illustrative numbers.
The loop
How compliance keeps itself current
- EvaluateOn every scheduled scan, or whenever you ask, ACSE evaluates your resources and maps each result to the framework controls it supports.
- Route the failuresEach failing control becomes a case with a proposed fix and a fix-by target set by severity and environment.
- Fix and verifyApproved fixes merge through your pipeline. ACSE re-reads the resource and watches it through the observation window.
- Seal the proofThe case is sealed into your evidence chain, ready to show against the control it satisfied.
Frameworks
Seven frameworks on one set of checks
CIS, PCI DSS 4.0.1, NIST 800-53 Rev 5, FedRAMP Moderate, CCCS Medium, ISO 27001 and SOC 2 ship as signed, versioned packs. One check can satisfy controls in all of them.
Signed packs
Each framework version is signed. You preview the changes and adopt a new version with two people.
Custom frameworks
Map your internal standards onto the same checks. A second person publishes the mapping.
Policy you can test first
Simulate a policy change against real findings before anyone turns it on.
Fix-by targets
Targets by severity and environment, with late cases listed. Lengthening a target needs a second person.
How it behaves
The rules behind the score
- When controls are evaluated
- On every scheduled scan, and on demand from the portal
- Facts that can’t be established
- Unknown, counted against the score, never as a pass
- After a fix
- An observation window, seven days by default, before the case is sealed
- Older framework versions
- Supported for 12 months after a new version is published, with warnings as the end nears
- Weakening a control
- Waits for a second person; strengthening applies at once
Questions
What people ask us
How is the governed score different from the raw score?
The raw score is pass divided by everything evaluated, including unknowns, and is never altered. The governed score counts attestations and accepted exceptions as handled and takes exclusions out of scope. Both are always shown together.
What happens when a framework publishes a new version?
ACSE publishes a new signed pack with a changelog. You preview it side by side with the version in force, and two people adopt it. Until then, your current version stays pinned.
Can we track our own internal standards?
Yes. Build a custom framework on ACSE’s checks. It appears in reports and audit packages like any shipped framework, once a second person publishes it.
Keep reading
Related
Compliance posture
ACSE maps its checks to CIS, PCI DSS, NIST 800-53, FedRAMP, CCCS Medium, ISO 27001 and SOC 2, with signed framework versions and honest scores.
ReadACSEFrameworks
ACSE maps its cloud checks to CIS, PCI DSS, NIST 800-53, FedRAMP Moderate, CCCS Medium, ISO 27001 and SOC 2, with signed, versioned framework content.
ReadSolutionsAudit readiness
ACSE builds audit evidence as your team works: sealed cases, packages organized by control and a signed chain your auditor can verify offline on their own.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.