Compliance frameworks and checks
Map framework controls to live checks on your estate, and see exactly which devices pass and fail.
AssetTrove turns your asset and licence data into evidence for security and compliance frameworks. You manage this under Compliance; changing it needs compliance management permissions, and Auditors can read everything.
Frameworks included
- ISO 27001:2022 Annex A
- CIS Controls v8
- SOC 2 (Trust Services Criteria 2017)
- NIST CSF 2.0
- Vendor audit readiness, a pack for software licence audits
Each framework contains controls. You connect a control to a check that AssetTrove evaluates.
Available checks
| Check | Passes when | Typical control |
|---|---|---|
| Asset field coverage | At least a minimum percentage of in-scope assets have a field filled in, for example 98% of in-use laptops have an assigned person | ISO 27001 A.5.9, CIS 1.1 |
| Devices reporting | At least a minimum percentage of assets reported in the last n days, for example 95% within 14 days | Asset inventory controls |
| Disk encryption | At least a minimum percentage of laptops and desktops report encryption switched on | Endpoint protection controls |
| Unauthorised software | No active installations of software you've blocked | CIS 2.3 |
| Licence position | No product is under-licensed or unlicensed in the latest reconciliation | Vendor audit readiness |
| Disposal evidence | Every storage device disposed of in the last year has a wipe or destruction certificate | ISO 27001 A.7.14 |
| Manual attestation | Evidence was uploaded and confirmed within the required interval, for example every 90 days | Anything AssetTrove can't measure. See Manual evidence and attestations |
For field coverage you can check: assigned person, location, cost centre, serial number, warranty end date or hardware model. Each check has an owner, who is responsible for fixing failures.
Results
Checks run every night and whenever you select Evaluate. Each result shows:
- Pass or Fail, with the score, for example 97.2%: 1,932 of 1,987 assets;
- a plain explanation, for example 55 in-use laptops and desktops have no assigned user (threshold 98%);
- the exact devices that fail, up to 500, so you can fix them straight away.
When nothing is in scope, the result is Not applicable, never Pass, so an empty check can't look like a success.
A failing control can trigger a webhook, for example to open a ticket in your service desk.