Compliance Policies

In order to make these trust decisions, Jitsuin Archivist can be configured with Compliance Policies to check assets against. These policies specify things like tolerance for vulnerability windows, or SLAs for open maintenance calls. For example:

“Assets must be patched within 40 days of vulnerability notification”

“Maintenance calls must be answered within 72 hours”

Individual assets either pass or fail, and organizations can calculate their overall security/compliance posture based on what proportion of their assets are breaching their policy set.

Compliance signals can also be used to identify where risk lies in an organization and help to prioritize remedial activities.

User-defined Compliance Policies

Note

User-defined compliance policies are currently not supported. Future versions of Jitsuin Archivist will allow users to create policies that are best tuned to their business needs

Built-in Compliance Policies

Every Jitsuin Archivist implements a default policy in compliance_policies/0000-0000-000000000-00000000 which checks for outstanding firmware vulnerabilities or maintenance requests. If any requests are outstanding then the asset fails compliance. If all reported vulnerabilities have been patched and maintenance requests serviced then it passes.

For further details on the API for compliance posture, see Compliance.