Skip to main content

Generate a Compliance Report

Tasks

Close the most common compliance gaps, then export a coverage report for security reviews, vendor assessments, or regulatory submissions.

Close common gaps​

The Help button in the page header explains what the coverage figures do and do not verify.

Filter a framework tab to Not covered to see what has no policy behind it. Coverage comes only from enabled policies that name a control, so every gap closes the same way — a policy that carries the control's identifier:

  1. Install the shipped policy packs. The policy packs already carry framework annotations, so installing one moves every control it names out of Not covered without your writing anything.

  2. Annotate the policies you wrote yourself. A policy you authored contributes nothing until it declares which controls it covers — see Annotate your own policies below.

  3. Review the mapped policy mode. Enabled policies in Enforce, Approval, RequireApproval, or WarnApprove mode contribute Covered configuration mappings. Other modes contribute Audit only. Choose the mode for the control’s intended behavior; the configuration label does not verify recorded enforcement or operating effectiveness.

Settings that are not policies — the Prompt Scanner, anomaly-detection thresholds, an S3 export target, or a budget rule — change nothing on the Compliance page, even where they address the same concern a control describes.

note

Enforce, Approval, RequireApproval, and WarnApprove policies count as Covered configuration mappings. Other modes count as Audit only. Human-oversight controls may appropriately use approval modes; changing them to Enforce is not required to obtain the Covered label.

Annotate your own policies​

A policy contributes to coverage only when it declares which controls it covers. The shipped policy packs are already annotated; a policy you wrote yourself needs the annotation added:

metadata:
  annotations:
    proxy.nirmata.io/frameworks: "owasp:LLM01,nist:MP-2.3,eu-ai-act:Art.14"

Look up the identifiers in Compliance Controls. Coverage recomputes as soon as the policy loads.

Export a report​

  1. Navigate to Security → Compliance.

  2. Select Export Report. A JSON file downloads as compliance-report-<date>.json, carrying the generation timestamp and, for every framework, its version, its covered/total count, and each control's id, name, status (covered, audit-only, or not-covered), and the names of the policies covering it.

The coveredBy list names enabled policies annotated for each control. The export identifies its basis as current configuration and states that runtime evidence is not included. It does not prove operating effectiveness or whole-control compliance. Use this configuration report as supporting context for:

  • Internal security reviews and board-level AI risk reporting
  • Customer trust questionnaires and vendor assessments
  • SOC 2 or ISO 27001 supplementary evidence (AI controls annex)
  • Regulatory submissions where EU AI Act or NIST AI RMF alignment is requested

The generation timestamp is the export time, not a server observation timestamp. The exported mappings reflect the latest loaded response; they are not historical evidence.

See also​

Last updated on