Compliance Evaluations

What this screen is for

This screen shows, in system context, how the deployment's tenants stand against each compliance pack the licence entitles, on today's date in UTC. It states the licence status, and per pack the score across tenants, the counts of items in each result, and how many tenants were evaluated.

The evaluation is read-only. It blocks no operation and is not signed evidence. This screen shows counts only, never a tenant's keys.

What must exist first

The permission to read platform analytics, held in the platform tenant, shows the screen.
A licence in force. A trial evaluates every pack of the catalogue; an expired licence evaluates none, and the screen then shows no score.

Decisions you make here

Reading the licence facts

The licence status decides which packs are evaluated. A trial evaluates every pack of this release's catalogue. A licence, grace period included, evaluates the packs it names. An expired licence evaluates none. A pack identifier the licence names that this release does not define is listed as not evaluated.

Packs not included in your licence

Every other pack of the catalogue appears under Packs not included in your licence, as a card labelled Not included in your licence, with the pack's name, description and controls. It has no score: no tenant is evaluated against it.

Contact your account manager to add this pack to the licence opens the License screen. View stored history opens the pack's history recorded while it was licensed, which stays readable.

When the licence ends

While the licence is close to its end or in its grace period, the note When the licence ends states that packs stop being evaluated and turn read-only when it ends: their history and remediation plans stay readable, and evidence already issued still verifies, but new evidence cannot be issued. It cannot be dismissed. Review the licence opens the License screen.

Reading the aggregate

The aggregate covers every tenant that has not been deleted, whatever its lifecycle status, except the platform tenant. An item fails across the deployment when it fails in any tenant, and the score is computed over those aggregate results, never as an average of tenant percentages.

Skipped tenants are tenants whose keys could not be evaluated, because a live key has no key identifier. They are counted, never shown as passing.

If the screen reports that the compliance evaluation could not be read, for example because the licence could not be read at that moment, use the retry it offers.

Reading the tenants × packs grid

The grid shows each tenant's score in each pack. Selecting a score, or Not scored, opens that tenant in that pack, with its items and the number of its keys each one concerns. Selecting a pack name at the top of a column opens the pack across every tenant. A cell whose pack could not be read, is still loading, or does not list the tenant (Not listed) opens nothing.

Tenants evaluated counts the tenant rows the grid shows, so the two always agree, even while a pack is loading or after one failed to read.

Downloading verification keys

Download verification keys saves the deployment's public keys that verify the signed evidence in the evidence packages tenants download for their packs. The file is the same one each package carries as verification-keys.json. This screen offers no signed evidence of its own.