Compliance
ProPera continuous compliance - control catalogs mapped to live platform evidence. Only frameworks that apply to your location & profile are shown.
Overall 100%
Updated 2026-10-21 03:57 UTC
Applicability profile (geo-sensing)
Country: NZ
Industry: healthcare
Applies to you:
ISO 27001
ISO 27002
COBIT
NZ Privacy Act 2020
PCI DSS
CIS Controls v8
Not applicable (hidden):
NIST CSF
NIST 800-53
GDPR
CCPA / CPRA
APRA CPS 234
Australian Privacy Act
PSR (Privacy Safeguards, AU)
IRAP
FedRAMP
Essential Eight
Set your country, industry and data-handling attributes in Settings โ Compliance profile to refine this list.
Continuous monitoring sensors (what is watching your controls)
Microsoft Defender for Endpoint
Devices, alerts, incidents, vulnerabilities, remediation evidence
โ Demo
monitoring 100% of controls
Microsoft Intune
Endpoint compliance, ASR rules, managed-device posture
โ Demo
monitoring 100% of controls
Microsoft Purview
DLP policies, retention labels, audit evidence
โ Demo
monitoring 100% of controls
Microsoft Graph
Identity, directory, secure score evidence
โ Demo
monitoring 100% of controls
Microsoft Sentinel
Incidents, analytics rules, hunting evidence
โ Demo
monitoring 100% of controls
Microsoft Secure Score
Posture score, improvement actions
โ Demo
monitoring 100% of controls
Microsoft Teams
Notification & approval evidence
โ Demo
monitoring 100% of controls
Audit Log (platform)
Immutable action trail - who did what, when
โ Collecting
monitoring 100% of controls
Role-Based Access Control
Least-privilege role model, approval workflow
โ Collecting
monitoring 100% of controls
Automation Engine
Policy evaluation, dry-runs, approved remediations
โ Collecting
monitoring 100% of controls
Sensors feed evidence into the control catalog continuously. In demo mode sensors report sample evidence; connect Microsoft APIs for live monitoring.
Compliance evidence bridge (third-party control monitoring)
โ Connected
5
Control tests
3
Passing
1
Failing
5
Comments posted
7
Unpatched devices
| Control test | Category | Status | Comments / evidence |
|---|---|---|---|
| Endpoint operating system patching
Some devices are missing critical security updates.
|
VULNERABILITY_MANAGEMENT | Needs attention |
๐ฌ โ ๏ธ 3 devices are unpatched. Patch instructions attached by ProPera Online. ๐ฌ Administrator consent required to execute remediation (cloud + domain).
|
| All endpoints onboarded to Defender for Endpoint | COMPUTERS | Passing |
๐ฌ All managed devices report a healthy Defender sensor.
|
| Devices compliant with Intune policies
1 device is non-compliant.
|
COMPUTERS | In progress | - |
| Least-privilege access for platform admins | ACCOUNTS_ACCESS | Passing |
๐ฌ Role-based access control verified with the approval workflow.
|
| Immutable audit logging enabled | LOGGING | Passing |
๐ฌ Every automation action is recorded with actor, timestamp and result.
|
Compliance evidence can be synced to a third-party control-monitoring platform (managed devices + Critical/High vulnerabilities),
and control-test results pulled back for review. Set the bridge credentials in Configuration Centre to go live.
Unpatched devices (patch instructions + remediation consent)
๐ฆ Patch Applications โ
โ
Endpoint remediation consent granted - by demo
(2026-08-20) ยท scope:
cloud_domain_full.
ProPera Online may execute patch remediation after the normal approval workflow.
| Device | Risk | Missing update | Severity | CVSS | Instructions |
|---|---|---|---|---|---|
| corp-dc01 | Medium | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-dc01 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How to... |
| corp-srv-app02 | High | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-srv-app02 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How to... |
| corp-srv-file01 | Medium | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-srv-file01 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How... |
| corp-wks-1187 | High | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-wks-1187 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How to... |
| corp-wks-0421 | Medium | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-wks-0421 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How to... |
| corp-wks-0913 | Low | CVE-2024-38063 | Critical | 9.8 | ProPera Online detected that corp-wks-0913 is missing security update CVE-2024-38063 (CVSS 9.8, severity Critical).
Recommended action: Apply the August 2024 security update to all affected Windows systems.
How to... |
| corp-lap-2210 | Medium | CVE-2024-20653 | High | 7.8 | ProPera Online detected that corp-lap-2210 is missing security update CVE-2024-20653 (CVSS 7.8, severity High).
Recommended action: Apply the January 2024 security update.
How to patch:
1. Deploy the update... |
Patch remediation workflow
ISO 27001
iso27001
100%
52/52 controls satisfied
ยท 52 โ
0 ~
0 โ
International standard for information security management systems (ISMS).
ISO 27002
iso27002
100%
5/5 controls satisfied
ยท 5 โ
0 ~
0 โ
Code of practice for information security controls (companion to ISO 27001).
COBIT
cobit
100%
4/4 controls satisfied
ยท 4 โ
0 ~
0 โ
ISACA framework for governance and management of enterprise IT.
NZ Privacy Act 2020
nzprivacy
100%
2/2 controls satisfied
ยท 2 โ
0 ~
0 โ
New Zealand Privacy Act 2020 - 13 privacy principles for NZ personal information.
PCI DSS
pcidss
100%
5/5 controls satisfied
ยท 5 โ
0 ~
0 โ
Payment Card Industry Data Security Standard.
CIS Controls v8
cis
100%
18/18 controls satisfied
ยท 18 โ
0 ~
0 โ
Center for Internet Security Controls - 18 prioritized safeguard families.
Live evidence
Users10
Automation rules9 (8 enabled)
Automation runs24529
Approvals28645
Audit entries129501
Secure Score74.6
Integration health:
Defender: demo
Microsoft Graph: demo
Entra ID: demo
Intune: demo
Purview: demo
secure_score: demo
Sentinel: demo
vulnerability: demo
Teams: demo
Slack: demo
ServiceNow: demo
Jira: demo
VirusTotal: demo
AbuseIPDB: demo
OTX: demo
Compliance evidence: demo
How it works (ProPera continuous compliance)
01
Control catalog
15+ frameworks mapped to evidence checks
02
Auto evidence
Audit logs, automation, approvals, RBAC, score
03
Geo-sensing
Only frameworks for your country & profile
04
Continuous re-check
Posture refreshes as your environment changes
Full model documented in docs/compliance.md - control โ evidence โ gap โ remediation โ audit-ready evidence. Included on every plan.
Control catalog
| Control | Framework | Section | Title | Status | Evidence checks |
|---|---|---|---|---|---|
| iso-a5.1 | ISO 27001 | A.5.1 Management direction |
Information security policies
Security policies exist, are assigned and reviewed.
|
Satisfied |
โPlatform role model & policy engine present
|
| iso-a5.15 | ISO 27001 | A.5.15 Access control |
Access control
Access to information and assets is controlled by role.
|
Satisfied |
โRole-based access control with least privilege
โNon-admin roles available
|
| iso-a5.16 | ISO 27001 | A.5.16 Identity management |
Identity management
Identities are managed through a defined lifecycle.
|
Satisfied |
โUsers provisioned with unique accounts
|
| iso-a5.17 | ISO 27001 | A.5.17 Authentication information |
Authentication information
Authentication information is protected and managed.
|
Satisfied |
โEntra ID SSO integration available
โPassword hashing enforced (Werkzeug)
|
| iso-a5.24 | ISO 27001 | A.5.24 Use of cryptography |
Use of cryptography
Rules for the effective use of cryptography.
|
Satisfied |
โSecrets stored outside code (env/config)
โHTTPS enforced in deployment
|
| iso-a5.25 | ISO 27001 | A.5.25 Secure development life cycle |
Secure development life cycle
Security is embedded in the development lifecycle.
|
Satisfied |
โAutomated test suite present
|
| iso-a5.27 | ISO 27001 | A.5.27 Learning from information security incidents |
Learning from information security incidents
Knowledge gained from incidents is used to improve controls.
|
Satisfied |
โIncident records exist
|
| iso-a5.28 | ISO 27001 | A.5.28 Collection of evidence |
Collection of evidence
Evidence is collected and preserved for investigations.
|
Satisfied |
โEvidence captured per alert/incident
|
| iso-a5.29 | ISO 27001 | A.5.29 Security during disruption |
Security during disruption
Business continuity keeps security controls operational.
|
Satisfied |
โBackground workers with health status
|
| iso-a5.30 | ISO 27001 | A.5.30 ICT readiness |
ICT readiness for business continuity
ICT readiness is planned and tested.
|
Satisfied |
โContainerized deployment (compose)
|
| iso-a5.33 | ISO 27001 | A.5.33 Protection of records |
Protection of records
Records are protected against loss, destruction and falsification.
|
Satisfied |
โImmutable-style audit log present
|
| iso-a5.34 | ISO 27001 | A.5.34 Privacy and protection of PII |
Privacy and protection of PII
PII is protected according to applicable requirements.
|
Satisfied |
โAudit events omit secrets
|
| iso-a5.36 | ISO 27001 | A.5.36 Compliance with policies and standards |
Compliance with policies and standards
Compliance with policies is verified.
|
Satisfied |
โContinuous compliance engine active
|
| iso-a5.37 | ISO 27001 | A.5.37 Documented operating procedures |
Documented operating procedures
Operating procedures are documented and available.
|
Satisfied |
โDocumentation shipped with product
|
| iso-a6.1 | ISO 27001 | A.6.1 Screening |
Screening
Background verification for personnel.
|
Satisfied |
โRoles defined with clear responsibilities
|
| iso-a6.2 | ISO 27001 | A.6.2 Terms and conditions of employment |
Terms and conditions of employment
Contractual agreements reflect security responsibilities.
|
Satisfied |
โAuditor role available for oversight
|
| iso-a6.3 | ISO 27001 | A.6.3 Awareness |
Information security awareness
Personnel are aware of security responsibilities.
|
Satisfied |
โTraining surfaced via reports
|
| iso-a6.8 | ISO 27001 | A.6.8 Reporting information security events |
Reporting information security events
Events are reported through appropriate channels.
|
Satisfied |
โAlert & incident intake exists
|
| iso-a7.1 | ISO 27001 | A.7.1 Physical security perimeters |
Physical security perimeters
Physical perimeters protect information processing facilities.
|
Satisfied |
โDeployment guidance includes cloud hosting
|
| iso-a8.1 | ISO 27001 | A.8.1 User endpoint devices |
User endpoint devices
Endpoints are protected and monitored.
|
Satisfied |
โDefender for Endpoint integration
โDevice inventory tracked
|
| iso-a8.2 | ISO 27001 | A.8.2 Privileged access rights |
Privileged access rights
Privileged access is restricted and managed.
|
Satisfied |
โRole hierarchy separates admin from analyst
|
| iso-a8.3 | ISO 27001 | A.8.3 Information access restriction |
Information access restriction
Access is restricted per role.
|
Satisfied |
โPermission matrix enforced
|
| iso-a8.5 | ISO 27001 | A.8.5 Secure authentication |
Secure authentication
Secure authentication technologies and procedures.
|
Satisfied |
โEntra ID / SSO authentication
โSession security headers (HttpOnly, SameSite)
|
| iso-a8.6 | ISO 27001 | A.8.6 Capacity management |
Capacity management
Capacity is monitored and planned.
|
Satisfied |
โPlan usage limits tracked
|
| iso-a8.8 | ISO 27001 | A.8.8 Management of technical vulnerabilities |
Management of technical vulnerabilities
Technical vulnerabilities are managed.
|
Satisfied |
โVulnerability management module
โCVSS scoring surfaced
|
| iso-a8.9 | ISO 27001 | A.8.9 Configuration management |
Configuration management
Configuration changes are controlled.
|
Satisfied |
โSecure Score & recommendations tracked
|
| iso-a8.10 | ISO 27001 | A.8.10 Information deletion |
Information deletion
Information is deleted when no longer required.
|
Satisfied |
โRetention context via Purview integration
|
| iso-a8.11 | ISO 27001 | A.8.11 Data masking |
Data masking
Data masking is applied where required.
|
Satisfied |
โSecrets never displayed in UI
|
| iso-a8.12 | ISO 27001 | A.8.12 Data leakage prevention |
Data leakage prevention
DLP measures protect sensitive data.
|
Satisfied |
โPurview DLP context integration
|
| iso-a8.16 | ISO 27001 | A.8.16 Monitoring activities |
Monitoring activities
Activities are monitored for security events.
|
Satisfied |
โAudit log captures actions
โAlert/incident monitoring
|
| iso-a8.17 | ISO 27001 | A.8.17 Clock synchronization |
Clock synchronization
Clocks are synchronized to a reference time source.
|
Satisfied |
โTimestamps recorded in UTC
|
| iso-a8.19 | ISO 27001 | A.8.19 Installation of software on operational systems |
Installation of software on operational systems
Software installation is controlled.
|
Satisfied |
โRemediation actions governed by policy
|
| iso-a8.20 | ISO 27001 | A.8.20 Networks security |
Networks security
Networks are managed and controlled.
|
Satisfied |
โDevice isolation response actions available
|
| iso-a8.21 | ISO 27001 | A.8.21 Security of network services |
Security of network services
Security features of network services are agreed and implemented.
|
Satisfied |
โIntegration health monitoring
|
| iso-a8.22 | ISO 27001 | A.8.22 Segregation of networks |
Segregation of networks
Networks are segregated where required.
|
Satisfied |
โTenant isolation in multi-tenant SaaS
|
| iso-a8.23 | ISO 27001 | A.8.23 Web filtering |
Web filtering
Access to external websites is managed.
|
Satisfied |
โThreat intelligence enrichment available
|
| iso-a8.24 | ISO 27001 | A.8.24 Use of cryptography |
Use of cryptography
Cryptographic controls protect information.
|
Satisfied |
โTLS/HTTPS deployment support
|
| iso-a8.25 | ISO 27001 | A.8.25 Secure development life cycle |
Secure development life cycle
Security in software development.
|
Satisfied |
โAutomated tests
|
| iso-a8.26 | ISO 27001 | A.8.26 Application security requirements |
Application security requirements
Security requirements addressed in applications.
|
Satisfied |
โInput validation & CSRF protection
|
| iso-a8.27 | ISO 27001 | A.8.27 Secure system architecture |
Secure system architecture
Architecture follows security principles.
|
Satisfied |
โAPI-first modular architecture
|
| iso-a8.28 | ISO 27001 | A.8.28 Secure coding |
Secure coding
Secure coding principles applied.
|
Satisfied |
โSecrets never logged
|
| iso-a8.29 | ISO 27001 | A.8.29 Security testing in development |
Security testing in development
Security testing during development.
|
Satisfied |
โTest suite covers auth, automation, remediation
|
| iso-a8.31 | ISO 27001 | A.8.31 Separation of development, test and production |
Separation of environments
Development, test and production environments are separated.
|
Satisfied |
โDemo vs live mode separation
|
| iso-a8.34 | ISO 27001 | A.8.34 Protection of information systems during audit testing |
Protection during audit testing
Audit testing protects production systems.
|
Satisfied |
โDry-run mode for automation
|
| iso-a5.20 | ISO 27001 | A.5.20 Supplier relationships |
Supplier relationships
Supplier security requirements are defined.
|
Satisfied |
โIntegration status visibility
|
| iso-a5.21 | ISO 27001 | A.5.21 Managing security in supplier relationships |
Managing security in supplier relationships
Supplier security is managed.
|
Satisfied |
โThird-party connectors clearly labeled
|
| iso-a5.22 | ISO 27001 | A.5.22 Monitoring and review of supplier services |
Monitoring supplier services
Supplier services are monitored and reviewed.
|
Satisfied |
โConnector health checks
|
| iso-a5.23 | ISO 27001 | A.5.23 Cloud services |
Cloud services
Cloud service security is managed.
|
Satisfied |
โAzure deployment ready
|
| iso-a5.35 | ISO 27001 | A.5.35 Independent review of information security |
Independent review of information security
Information security is reviewed independently.
|
Satisfied |
โAuditor role available
|
| iso-a5.37b | ISO 27001 | A.5.37 Documented operating procedures |
Operating procedures documented
Procedures documented and available to staff.
|
Satisfied |
โRunbooks/playbooks module
|
| iso-a6.6 | ISO 27001 | A.6.6 Confidentiality or non-disclosure agreements |
Confidentiality / non-disclosure agreements
Confidentiality obligations are defined.
|
Satisfied |
โWorkspace isolation
|
| iso-a8.4 | ISO 27001 | A.8.4 Access to source code |
Access to source code
Source code access is controlled.
|
Satisfied |
โLeast-privilege access model
|
| cis-1 | CIS v8 | Inventory |
Inventory and control of enterprise assets
Maintain an inventory of managed assets.
|
Satisfied |
โDevice inventory tracked
|
| cis-2 | CIS v8 | Inventory |
Inventory and control of software assets
Maintain an inventory of software.
|
Satisfied |
โVulnerable software inventory
|
| cis-3 | CIS v8 | Protect |
Data protection
Develop and implement data protection processes.
|
Satisfied |
โPurview data protection context
|
| cis-4 | CIS v8 | Protect |
Secure configuration
Secure configuration of enterprise assets and software.
|
Satisfied |
โSecure Score improvement actions
|
| cis-5 | CIS v8 | Protect |
Account management
Manage identities and credentials.
|
Satisfied |
โEntra ID identity management
|
| cis-6 | CIS v8 | Protect |
Access control management
Use and manage access control.
|
Satisfied |
โRBAC permission matrix
|
| cis-7 | CIS v8 | Protect |
Continuous vulnerability management
Find and remediate vulnerabilities continuously.
|
Satisfied |
โContinuous vulnerability sync
โCVSS + exploit availability
|
| cis-8 | CIS v8 | Protect |
Audit log management
Collect and retain audit logs.
|
Satisfied |
โAudit log present and searchable
|
| cis-9 | CIS v8 | Protect |
Email and web browser protections
Protect against email and web threats.
|
Satisfied |
โThreat intelligence enrichment
|
| cis-10 | CIS v8 | Protect |
Malware defenses
Prevent and control malware.
|
Satisfied |
โMDE antivirus response actions
|
| cis-11 | CIS v8 | Protect |
Data recovery
Recover data from backups.
|
Satisfied |
โDeployment includes database volume
|
| cis-12 | CIS v8 | Protect |
Network infrastructure management
Manage network infrastructure securely.
|
Satisfied |
โDevice isolation capability
|
| cis-13 | CIS v8 | Protect |
Network monitoring and defense
Monitor and defend the network.
|
Satisfied |
โAlert correlation & incident management
|
| cis-14 | CIS v8 | Detect |
Security awareness and skills training
Train personnel on security responsibilities.
|
Satisfied |
โReporting & dashboards available
|
| cis-15 | CIS v8 | Detect |
Service provider management
Manage third-party service providers.
|
Satisfied |
โIntegration health visibility
|
| cis-16 | CIS v8 | Respond |
Application software security
Manage application software security.
|
Satisfied |
โAutomated tests & secure coding
|
| cis-17 | CIS v8 | Respond |
Incident response management
Respond to incidents consistently.
|
Satisfied |
โIncident playbooks & automation
|
| cis-18 | CIS v8 | Recover |
Penetration testing
Test effectiveness of controls.
|
Satisfied |
โDry-run mode for testing automation
|
| 27002-1 | ISO 27002 | Controls |
Control selection & implementation
Select and implement controls aligned with the ISMS risk assessment.
|
Satisfied |
โPlatform control catalog present
|
| 27002-2 | ISO 27002 | Controls |
Organizational controls
Policies, roles and responsibilities for information security.
|
Satisfied |
โRBAC roles defined
|
| 27002-3 | ISO 27002 | Controls |
People controls
Screening, awareness and responsibilities.
|
Satisfied |
โAuditor role for oversight
|
| 27002-4 | ISO 27002 | Controls |
Physical controls
Physical security for facilities and assets.
|
Satisfied |
โCloud-hosted deployment guidance
|
| 27002-5 | ISO 27002 | Controls |
Technological controls
Technical security measures for data and systems.
|
Satisfied |
โEncryption & HTTPS support
|
| cobit-1 | COBIT | Governance |
Governance objectives
Evaluate, direct and monitor enterprise IT.
|
Satisfied |
โManagement dashboards & reporting
|
| cobit-2 | COBIT | Align |
Align IT with business goals
IT investment and risk aligned with strategy.
|
Satisfied |
โRisk posture visibility
|
| cobit-3 | COBIT | Deliver |
Deliver services & support
Deliver IT services reliably.
|
Satisfied |
โSystem status & health monitoring
|
| cobit-4 | COBIT | Monitor |
Monitor and evaluate
Monitor performance and conformance.
|
Satisfied |
โAudit log & compliance engine
|
| nzp-1 | NZ Privacy Act | Privacy principles |
NZ privacy principles
Handle NZ personal information per the 13 principles.
|
Satisfied |
โAccess controls & audit trail
|
| nzp-2 | NZ Privacy Act | Breach notification |
Notifiable privacy breach reporting
Notify the Privacy Commissioner of harmful breaches.
|
Satisfied |
โIncident detection & response
|
| pci-1 | PCI DSS | Build and maintain secure networks |
Firewalls & secure configurations
Protect cardholder data environments.
|
Satisfied |
โNetwork security posture
|
| pci-2 | PCI DSS | Protect cardholder data |
Protect stored cardholder data
Encrypt and restrict cardholder data.
|
Satisfied |
โEncryption support
|
| pci-3 | PCI DSS | Protect cardholder data |
Protect transmitted cardholder data
Secure transmission of cardholder data.
|
Satisfied |
โTLS/HTTPS enforced
|
| pci-4 | PCI DSS | Maintain vulnerability management program |
Vulnerability management
Identify and remediate vulnerabilities.
|
Satisfied |
โVulnerability management module
|
| pci-5 | PCI DSS | Monitor and test networks |
Monitoring and testing
Monitor and test the cardholder environment.
|
Satisfied |
โContinuous monitoring & audit
|
