Managing compliance postures and assessments

Before you begin

• A compliance assessment file should adhere to the NIST 800-53 (Rev4 for OpenShift Container Platform and Rev5), CIS, Payment Card Industry Data Security Standards (PCI DSS), or a custom standard if applicable. Assessment must also use OSCAL or XCCDF format for describing OSS components, their licenses, and compliance status. This can ensure that the compliance assessment results are structured, consistent, and easily interpretable, enabling efficient collaboration and decision-making among development teams and stakeholders.
  Note: Refer to the OSCAL website, Trivy Kubenetes and XCCDF format for acceptable compliance assessment templates.
• Create an environment under Environment inventory > Environments.
• Create a compliance profile and catalog for the assessment to be uploaded.
• For Trivy Kubernetes assessment - To generate a Trivy assessment report run the following command on your Kubernetes cluster :

  trivy k8s <cluster-name> --compliance <compliance_id> --report all --format json

  • cluster-name - is the name of Kubernetes cluster. You can provide your port and username along with the clustername. For example : dummy-cluster-trivy-ibm-com:6443/kube:admin.
  • compliance_id - will have the value k8s-cis-1.23 which is a compliance benchmark profile based on the CIS Kubernetes Benchmark for Kubernetes v1.23.
  This command will generate a JSON file including all passed configurations and mis-configurations.
  Note: The compliance profile name you create for a Trivy assessment should be the compliance_id and Environment name should be hostname where you run the assessment.
• For XCCDF assessment, profile idref tag should include corresponding compliance profile name. For example :

  
      <profile idref="<filepath>.content_<compliance profile name>"/>
      <target>target_system.xyz.com</target>  

Uploading a compliance assessment

1. Go to Dimensions > Compliance.
2. Choose Postures > Create assessment and choose Upload compliance scan.
3. Choose OSCAL, or Trivy assessment, or XCCDF as File format and upload assessment results of the appropriate format. File size should not exceed 20 MB.
   Attention: Upload only one compliance assessment file at a time.
4. Click Upload.

Creating a compliance assessment manually

Optionally, you can generate compliance assessments manually in cases where they cannot be generated automatically.

1. Click Dimensions > Compliance.
2. Click Create assessment and choose Create a new assessment from Postures sub navigation.
3. Provide an Assessment name, choose an appropriate Environment, Profile and give a Due date.
4. Click Create.

Create mapped assessment

You can evaluate your existing compliance postures from one standard to another using existing compliance catalog files, eliminating the need to generate assessments repeatedly and accelerating cross-framework compliance analysis.

Refer to compliance mapping topic for more details.

Discovering compliance data

Discover compliance data from your Kubernetes cluster. Go to Dimensions > Compliance > Create assessment > Discover compliance data. Refer to auto discovery of compliance data for succeeding steps.

Understanding Compliance score, Posture score and Scanner scores

Compliance score is generated for each assessment, while posture score is generated by gathering aggregated control status from multiple assessment results. From the Postures tab, under the listed postures that you can see Posture score, while to see Compliance score go to Assessment history within the compliance posture. You can see a list of all available compliance score that is listed against each assessment. The posture score is generated by the percentage of passed controls out of the all the controls available with in the profile, the assessment score does the same for each individual assessment.

A Low score indicates that the environment is only compliant with less than 50% of the available controls. A Medium score indicates it is compliant with 51-75% of the available controls, and High score indicates that the environment is compliant with more than 75% of the available controls.

A scanner score is also generated for each assessment, and is generated by the OpenSCAP v1.2.10 scanner. The Scanner score is generated by the scanning tool OpenSCAP and is derived by comparing the number of rules that have passed with the total number of applicable rules.

Go to Postures select a posture, from Assessment history sub navigation and select an assessment result, the Results tab lists assessed controls that are defined in the compliance profile that is associated with chosen assessment. You can expand each row to view details about the control, including a Control description and relevant Remarks. The additional remarks can provide helpful context if an environment is deemed non compliant with one of the specified controls. For example, remarks give details of a specific rule or regulation that was violated or the potential impact of noncompliance.

When available, compliance rules and checks for each control are listed under the Observations section within the Control description. You can see rules and checks that are listed under Name and Description providing a two-level component definition and a Status column, displaying the status of checks.

Compliance posture report

Posture risk

Go to Dimensions > Compliance > Postures and select a posture to analyze. Risk tab shows a Posture trend graph which shows compliance risk scores plotted against compliance assessment dates.

Concert also displays compliance risk scores and lists out most critical risks that affect the selected compliance posture. Risk score risk level indicates the estimated risk based on the current state of the controls that were assessed to determine the compliance posture. The control severity is estimated using watson. A Critical level can result either from one or more high-severity control failures or from a significant number of lower-severity controls failing within that category. The controls are classified into risk categories by watsonx during catalog upload. This classification remains fixed for that catalog thereafter.

You can also see a list of associated risks along with risk level and associated controls. You can click on the Risk name and get a watsonx generated risk description, associated controls and graph showing control group status.

Support for IBM Z SCC assessments

Concert supports assessment results that are generated by IBM Z SCC. The assessment results generated will be in OSCAL format. IBM Z SCC automates the collection of compliance relevant data on IBM Z and Linux on IBM Z. Concert consumes the OSCAL assessment results from IBM Z SCC and displays the status of all the checks that are executed along with the respective evidence of that check, highlighting any reasons for failure. Each observation in assessment includes rules along with the checks and the relevant evidence for the status of the check. Each check has a View details option to display the expected and actual values.