Compliance automation in QS-WAN scores nine frameworks from evidence your own network already produces. One control answers several frameworks at once. Controls with nothing behind them leave the calculation instead of counting as failures, and three of the seven states that do that cannot be set by hand.
Two engines and the reporting on top, and it helps to keep them apart.
One control usually answers the same question under more than one regime, so evidence gathered once lands everywhere it is asked for. Nine frameworks each carry a score: the HIPAA Security Rule, ISO/IEC 27001:2022, CIS Controls v8.1, PCI DSS v4.0, GDPR, the SOC 2 Trust Services Criteria, NIST RMF (SP 800-53 Rev. 5), NIS2 as transposed in Portugal, and NIST CSF 2.0. Alongside them sits QNova Cert, our own quantum-safe scorecard, which is not one of the nine.
The Security Dashboard carries the average across them and the ones you stand best against.
It runs published CIS benchmarks against each machine and scores it per host: CIS Microsoft Windows 11 Enterprise v3.0.0, plus CIS Apple macOS 26.0 Tahoe v1.0.0 and macOS 15.0 Sequoia v1.0.0.
The checks are concrete: password history, minimum password length, account lockout duration, BitLocker recovery, NTLM hardening.
The promise this page proves lives in the compliance management software use case. This one is where it gets measured.
Press the panel and watch the denominator move. Counting a control nobody measured as a failure is the other way to do this, and the two numbers are not the same number.
The diagram reads left to right. On the left, the configuration assessment scores each machine against the CIS benchmark for its own operating system, marking every check passed, failed or not applicable. That evidence feeds the crosswalk in the middle, where a single control answers the same question under several of the nine frameworks at once, so the lit lines run to more than one framework from the same control. On the right, the nine frameworks each carry their own score. Along the bottom, ten controls make up a sum: five satisfied, two partially satisfied and worth half a point each, one gap worth zero and still counted, and two with no evidence behind them, which sit outside the calculation. The two buttons compare the two ways of counting those last two, and leaving them out is what QS-WAN does. The states that take a control out of the denominator cannot be set by hand in the console; they follow the evidence.
The arithmetic is one line. Satisfied, plus half of the partials, over what was assessed. The configuration assessment runs the same rule on the evidence side, scoring passed over passed plus failed and leaving not applicable out of both halves.
Nothing physical moves. What changes is who assembles the answer.
Dated whenever somebody took them, which is the date the picture was taken and not the date the control was true.
Ten regimes, ten files, and nothing in one of them knows what the others have already answered.
Once for ISO 27001, once for NIS2, and once for a customer questionnaire, all three from the same evidence.
The collecting happens after hours, because during the day the job is the network. That is the part this takes off you.
The screenshot of a policy, the export of who has disk encryption, the email asking three site managers to confirm what you could check yourself: none of that was ever the control. It was proof the control existed.
The assessment produces that proof per host, against the benchmark for the operating system each machine is actually running.
Nothing unmeasured sits in the denominator, and the size of what was assessed sits beside it. There is no second sentence to add when somebody asks what the percentage covers.
A gap moves a named driver in the risk score rather than a document opened twice a year.
Nothing new goes into the rack. The endpoints already report and the policy is already applied; the assessment reads both and scores each host against the benchmark for its own operating system.
Each control lands in one of seven states. Four count: satisfied is a full point, partially satisfied is half, gap is zero, and in progress is zero too, because work underway is not evidence. Manual required, not evidenced and not applicable leave the sum.
The report composer builds a PDF from the sections you pick, inheriting scope and window from the dashboard you were on, so document and screen cannot disagree. The Management Report is the periodic one, emailed to people without console access.
A state that takes something out of the denominator is exactly what a person under audit pressure would reach for at eleven at night. It is not there to reach for.
Three of the seven leave the calculation, and none of the three is a setting:
The other four stay in the sum, including gap, which is worth zero and is still counted. Nothing leaves because somebody decided it should.
A high percentage on a small assessed set is still a small assessed set. The score declares its own denominator so that you can read the two together, which is the only way either of them means anything.
A gap also has a price you can point at. Compliance is one of the eight findings drivers in the risk score, where all 19 drivers weigh the same, about 5.26 points each.
One control answers every framework that asks, so what you gathered for ISO 27001 is already the answer to the question a customer sends you in a spreadsheet.
Evidence read per host against a named benchmark, one control answering every framework that asks, and a score that declares its own denominator.
You pick the sections, and the scope and the window come from the dashboard you were already on, so the document cannot disagree with the screen.
The Management Report is the periodic one. It goes by email, carrying aggregates only: no named employee, no individual device, no IP address.
These are not a related links box. Each one owns a piece of the same number, and the order is the order the evidence travels.
Runs the per host checks this score reads, and shows the passed, failed and not applicable counts sitting behind every benchmark.
Changes what is actually enforced on a machine. This page scores and names; that one is where the change gets made, and it stays your call.
Turns a compliance gap into a number that moves. Compliance is one of the eight findings drivers, and every driver weighs the same.
Holds the Security Dashboard the average is read from, and the report composer that inherits its scope and its window.
Every feature is listed in one place.
A meter in your console reads your own evidence. It is not an assessor signature, and no percentage here becomes one.
There is no QuantumNova analyst looking at your controls. You run the product, and the output is yours.
It scores and it names. Changing what is enforced on a machine is security policy management, and that stays your call.
That is what runs today. If your estate is mostly something else, ask on the call rather than assume the coverage.
Compliance automation means the evidence for security controls is read from the systems themselves and scored against the frameworks you answer to, instead of gathered by hand before an audit. Here it is a crosswalk over nine frameworks, fed by per host configuration assessments.
It leaves the calculation. It is not a failure and it is not a pass, so the percentage describes what was measured. Read it next to how much was assessed.
No. The three states that take a control out of the denominator, manual required, not evidenced and not applicable, cannot be set by hand.
It goes by email to people without console access, carrying aggregates only: no named employee, no individual device, no IP address.
An engineer, a console shaped like yours, and as long as you need. You watch one control land in several frameworks at once, then watch one with nothing behind it leave the sum. It is free and there is nothing to sign.
