Skip to content

Evaluate the tenant against a compliance pack

See how your tenant's live keys stand against each compliance pack the deployment licence includes, which items fail, which keys they name, and how the score has moved day by day.

Who can do it

Every built-in tenant role (tenant administrator, tenant access administrator, tenant key manager, tenant auditor and tenant viewer), and the platform roles working inside the tenant. The console shows Compliance evaluation in the navigation to a person who holds the permission to read the tenant's analytics. The evaluation is read-only: it blocks no operation and changes no key or policy.

Before you start

  • The deployment licence includes at least one compliance pack. A pack it does not include is shown locked and is not evaluated; only the platform administrator can have it added.
  • The evaluation is computed on today's date in UTC, over the tenant's live keys: those active, expired or suspended.

Steps

  1. Open Compliance evaluation in your tenant's navigation. The screen lists Your packs, each with its score, or Not measured when nothing could be scored, and the count of failed and warning items.
  2. On a pack's card, select View detail and plan.
  3. On Evaluation and evidence, read the Control results: every control and calendar entry of the pack with its result (Failed, Warning, Passed, Informational, Not applicable or Not evaluated), the reason, and the keys it names. Select a key to open its detail.
  4. Read the Trend: the score stored each day over the last 90 days. Select Show the stored days to read the figures as a table.
  5. To see what the pack says without comparing it with your keys, open the pack from Policies.

What you see when it worked

Each pack shows a score: the share of passed items among the items that passed or failed. Warnings, informational items, items that do not apply and items the platform cannot evaluate are counted beside it, not in it: a control that could not be evaluated is listed with its reason, so a score never means that every control passed. Not scored means no item was scored, for example because the tenant holds no live key; it is not a pass. Incomplete means a live key uses an algorithm no catalogue resolves, so the pack has no score until that key is resolved or retired. A satisfied item the platform observes does not mean the regime is satisfied.

Packs the licence does not include appear under Packs not included in your licence: their stored history and remediation plan stay readable through View stored history and View the remediation plan.

If it fails

What you see Cause What to do
No compliance pack is evaluated for this tenant. The deployment licence includes no pack Ask your platform administrator to have a pack added to the licence
The compliance evaluation could not be read. The evaluation or the licence could not be read at that moment Use the retry the screen offers
A pack is labelled Not included in your licence The licence does not include that pack Contact your platform administrator
A pack shows Incomplete, with keys whose algorithm no catalogue resolves A key uses an algorithm the catalogue does not know The pack has no score while such a key remains; review the key on Key Inventory

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API GET /api/v3/admin/tenants/{tenantId}/compliance-evaluations (operation listCompliancePackEvaluations); GET …/compliance-evaluations/{packId} (operation getCompliancePackEvaluation); GET …/compliance-evaluations/{packId}/history?from=…&to=… (operation getCompliancePackEvaluationHistory); GET …/compliance-packs (operation listCompliancePacks); GET …/compliance-packs/{packId} (operation getCompliancePack)