Compliance Reports

A compliance report shows where one framework stands for your tenant: the score, the status of every requirement and control, the evidence behind each result, and the verdicts and notes people have recorded. You can run it at any time, record your own verdicts, and download it as a PDF for an auditor.

Before you start

• Opening reports and downloading PDFs needs compliance.read (all built-in roles).

• Running an evaluation, setting a status and adding notes need compliance.write (Administrator role).

• Without an Enterprise licence, only CMMC 2.0, GDPR and your own frameworks can be opened. See Compliance Overview.

Open a report

1. Click Compliance in the main menu. The Frameworks tab opens.

2. Click a framework card.

The report page shows the last report of that framework. Opening it does not run it again. If the framework has never run, you see "This framework has not been evaluated yet." and a Run evaluation button.

Each tenant has one standing report per framework. Every run replaces it.

Run an evaluation

Click Run evaluation. UTMStack runs every check of every automatic control in the framework and rebuilds the report.

The reporting window is the period the checks look at. It ends now and starts:

• the number of days set on a schedule for this framework, if there is one (see Scheduled Compliance Reports);

• otherwise, 30 days earlier.

Notes and verdicts recorded on the previous report are kept:

• A note stays on its control.

• A status a person set stays, even if the engine now says something else. The report then shows "Recorded when the engine said X; it now says Y", so you can decide whether the verdict still holds.

Read the report

Header

Score over time appears above the findings once the framework has run on at least two different days. It shows two lines over the last 90 days, one point per day:

• Compliance score: the score of the last run of that day.

• Evaluated: the share of requirements that could be judged.

A score that rises while Evaluated falls usually means a log source went quiet, not that a control was fixed.

Findings

The findings are grouped by the framework's sections, each with its own percentage. Under each requirement (its status, id and name) are the controls that satisfy it. Each control line shows:

• its status (an asterisk * means a person set it);

• the control id and name;

• the evidence: a one-line reason, for example "1 of 3 checks with data passed" or "no data for 4 check(s) in the window";

• the note, if any, with who wrote it;

• Coverage and Activity (in UTMStack v12.0.2 these are always 0; see Compliance Overview).

Control details

Click a control line to open its details:

Error means the check could not run, which is not the same as failing it. It neither passes nor fails the control.

Record a verdict

Use this for manual controls, which stay Out of scope until someone judges them, and for any automatic result you disagree with.

1. 1

   Pick the status

   On the control line, open the status drop-down (Set status) and pick the new status.

2. 2

   Give the reason

   The Reason required dialog opens: "Provide a reason for this status change. It will be recorded." Type the justification in Reason, for example where the evidence is kept. Up to 4,000 characters.

3. 3

   Confirm

   Click Confirm change. The requirement, section and score are recalculated at once.

Picking the same status the engine gave records only the note; the control keeps following the engine.

Add a note

Use a note to record context without changing the status, for example "Remediation in progress — ticket OPS-4412, due end of quarter."

1. Click the note button at the end of the control line (Add a note).

2. Type the note. "Recorded on the report. It does not change the control's status."

3. Click Confirm change.

A control has one note. Writing a new one replaces the old one.

Download the PDF

1. Click Download PDF. A preview of the PDF opens.

2. Click Download PDF in the preview to save it. The file is named after the framework, for example PCI_DSS_v4_0_1.pdf.

The PDF is built from the standing report; it does not run the framework again. It contains:

The PDF is always in English and is marked "Confidential — prepared for internal and audit use only."

Multi-tenant servers

Reports, verdicts, notes, score history and schedules are kept per tenant. Each tenant's report only counts that tenant's logs and alerts.

Read a report step by step

1. 1

   Check that the score can be trusted

   Look at Score over time. If the Evaluated line dropped, a log source went quiet and requirements could not be judged. Fix the source before you read anything else.

2. 2

   Read the status counters

   Non-compliant needs action. Not evaluated means missing data. Out of scope means manual controls nobody has judged yet. Pending means checks that are declared but not written.

3. 3

   Find the weakest sections

   Each section shows its own percentage. Start with the sections with the lowest percentage and the most requirements.

4. 4

   Open the non-compliant controls

   Click a Non-compliant control. Under Check results, the failed check shows how many records matched ("hits") and which rule it applies. For a limit check, the hits are the events that should not have happened, for example audit logs being cleared. Search for them in Log Explorer with the same data type and filters as the check, over the reporting window. The Remediation text says what to fix.

5. 5

   Settle the manual controls

   For each Out of scope control, decide whether your organization meets it and record the status with a reason that points to the evidence, for example "Access review procedure v3, SharePoint > Security > Policies, approved 2026-09-01".

Prepare evidence for an audit

1. Match the audit period. The reporting window is 30 days unless the framework has a schedule. To evaluate over the audit period, create a schedule for the framework with that number of days in Reporting window (days), for example 365; Run evaluation then uses the same window. See Scheduled Compliance Reports.

2. Run the evaluation after the end of the period.

3. Record verdicts on every manual control, with reasons that name where the evidence is kept. Re-check verdicts marked "Recorded when the engine said X; it now says Y".

4. Download the PDF. It lists every verdict and note with its author and date, and the controls that could not be judged with the log sources that would settle them.

5. Keep supporting exports where the auditor needs raw records: the logs behind a control from Log Explorer (Export CSV), and the alert and incident lists from Threat Management (Export CSV).

Troubleshooting