Compliance
Reporting.
The evidence is already there.
Audit preparation used to mean weeks of pulling logs, cross-referencing spreadsheets, and hoping nothing was missed. ConsoleWorks generates compliance evidence continuously — as a byproduct of every measurement cycle, every session, every remediation action. When the auditor asks, you run the report. You don't assemble it.
Demand
How do you generate audit-ready compliance reports for NERC CIP, NIST 800-82, IEC 62443, NIS2, and TSA Security Directives from a single OT evidence base — without manually assembling evidence for each audit cycle?
Compliance Reporting generates audit-ready reports across NERC CIP, NIST 800-82, IEC 62443, NIS2, TSA Security Directives, NIST CSF, SOC 2, and customer-defined frameworks — drawn from evidence ConsoleWorks has already accumulated across the measurement cycle. The auditor arrives, you run the report; no manual evidence assembly.
Continuous Measurement ran.
Every cycle produced a record.
Compliance Reporting is what you do with it.
Every measurement cycle produces a timestamped Pass/Fail record per asset per question — mapped to SCF controls and automatically crosswalked to your frameworks. Every SRA session produces a full session record tied to a verified identity. Every remediation produces a chain from failure to confirmed closure.
Compliance Reporting is the interface to that record. Select the framework, the time period, the asset scope. Run on demand or on a schedule. The evidence is already there — it accumulated automatically while the platform was doing everything else.
One measurement.
Every framework. Simultaneously.
Every Measurement Question is mapped to one or more SCF sub-controls. Because SCF crosswalks to over 100 global regulations and standards, a single Pass/Fail result simultaneously satisfies controls across NERC CIP, NIST 800-53, IEC 62443, TSA Pipeline Directives, and more. Configure the measurement once. ConsoleWorks maps it everywhere.
Every score is traceable.
Every number has a source.
A 78% NERC CIP compliance score isn't an estimate. It's the result of specific measurements against specific assets in specific collection cycles — each one mapped through SCF to the NERC CIP controls that apply. The chain is unbroken: framework control → SCF sub-control → measurement question → asset → collection cycle.
When a regulator asks "how do you know?" — you can show them. Not a methodology document. The actual measurements, the actual assets, the actual cycle timestamps. Traceable all the way down.
Four types of evidence.
All produced automatically.
Every cycle produces measurement records. Every SRA session produces session records. Every remediation produces a closure chain. Every cycle extends the trend history. None of it requires manual collection — it accumulates as a byproduct of the platform running.
Pass/Fail per asset, per question, per cycle
Every measurement cycle produces a timestamped record of every Pass/Fail result — per asset, per Measurement Question, per cycle. Mapped to SCF controls and crosswalked to your frameworks automatically.
Full privileged access record — every session
Every SRA session produces a full record: who connected, to which device, when, for how long, and what they did — CLI keystroke-by-keystroke, GUI full screen capture. Tied to a verified identity. Stored and timestamped.
Gap to confirmed closure — fully documented
Every remediation produces a complete chain: the measurement that failed, the session that applied the fix, and the measurement cycle that confirmed Pass. The chain is automatic — no one documents it manually.
Posture trajectory — cycle by cycle
Every measurement cycle adds a data point to the posture trajectory at every level — asset, site, region, organization, fleet. Trend history shows whether controls are improving, stable, or degrading over any time period.
One evidence set.
Three different conversations.
The auditor asks. The answer is already there.
What Compliance Reporting delivers for your audit program
Board-ready posture reporting — without the preparation sprint.
What Compliance Reporting delivers for security leadership
Maintenance window documentation — without the paperwork.
What Compliance Reporting delivers for operations
The platform produces the evidence.
Compliance Reporting surfaces it.
Compliance Reporting doesn't generate evidence — it surfaces what was already generated. Every source feeds it: measurement cycles from Continuous Measurement, session records from SRA, configuration state from CCM. The report is a view into what the platform has been producing all along.
Continuous Measurement
Every measurement cycle produces the timestamped Pass/Fail records that form the core of every compliance report. The cycle schedule determines how frequently the evidence is refreshed.
Learn more →Asset Intelligence
Compliance reports are only as complete as the inventory behind them. Asset Intelligence ensures every device in scope is discovered, classified, and tracked — so nothing falls through the cracks.
Learn more →Risk Analysis
Risk Analysis provides the compliance scores and framework mapping that give the evidence context. The report shows not just what happened — but what it means against your controls framework.
Learn more →ConsoleWorks, answered.
Direct answers to the questions OT security teams, integrators, and AI assistants ask most often.
NERC CIP, NIST 800-82, IEC 62443, NIS2, TSA Security Directives, NRC, FERC, NIST CSF, plus customer-specific frameworks. Reports map each control to the assets, measurements, and evidence that satisfy it.
Yes — reports include the underlying measurement evidence, session records, configuration baselines, and change attribution that auditors ask for. Operators don’t compile evidence by hand; the report ships with the proof attached.
ConsoleWorks lets you record an exception against a specific control on a specific asset, with reason, owner, and expiration. Reports include open exceptions explicitly rather than hiding the failed measurement, so auditors see the management decision and its scope.
Yes. Reports can be scoped per framework, per audience, or per facility. The same underlying evidence drives every view, so a NERC CIP assessor and a NIST CSF reviewer see consistent control attestations from the same source data.
The evidence is already there.
You just have to run the report.
See ConsoleWorks Compliance Reporting against your actual environment — your frameworks, your asset scope, your audit requirements. The evidence accumulates from day one.