Compliance

Compliance turns your scan results into a posture you can defend to an auditor. It has two tabs, and they map to two different jobs: Framework Overview for reporting upward, and Control Management for investigating a specific control and planning the work that closes the gap.

Nothing here is configured by hand. Compliance is evaluated automatically whenever a datastore is scanned, so the page reflects your last scan rather than a questionnaire you filled in. How controls are mapped and how the score is computed is in Compliance mapping & scoring.

The summary row

Present on every tab.

Tile	What it means
Overall Score	Aggregate compliance percentage, annotated with coverage: the share of applicable controls Argus could actually verify
Frameworks Tracked	How many are being assessed
Scanned Datastores	The evidence base behind every other number
Total Violations	Failing controls across all frameworks

The score is deliberately greyed out when coverage is low rather than displayed as authoritative. A high score over thin coverage is not a good posture, and the page refuses to present it as one.

Not Verified is a status, not a failure

This is the single most important thing to understand about the page, and it appears everywhere on it.

A control reads Not Verified when Argus could not read the evidence to judge it, almost always because the agent’s IAM role is missing a read permission. It is not a pass and not a fail: it is a blind spot, and it drags your score down for a reason that is fixable in minutes.

When posture verification is blocked, a banner appears under the tabs naming how many datastores are affected and, where it can, the exact permissions to grant. It is not dismissible by design, though you can collapse it to one line. It clears itself when the underlying block is fixed. The fix is IAM permissions, not anything about your data.

Six statuses exist across the page:

Status	Meaning	What to do
Compliant	Every signal the control needs was observed and satisfied	Nothing
Non-compliant	A confirmed failure	Remediate the resource
Partial	A softer gap, or a control passing everything Argus can see but not all of it	Read the “not assessed” line
Not Verified	Argus could not read a signal it needed	Grant the permission
Not applicable	Out of scope for your estate	Nothing
Manual attestation	Procedural or physical. No signal can decide it	Handle it outside Argus

The last two are easy to confuse and mean opposite things. Not Verified is a blind spot Argus should be able to see through - a permission grant fixes it, and it drags Coverage down until you do. Manual attestation (internally not_assessable) is something Argus can never see, like a breach-notification deadline or a physical facility control. No permission would help, so it is excluded from both the score and Coverage. It counts neither for nor against you.

About half the control set is manual attestation. That is a property of the regulations, not a gap in Argus - see Compliance mapping & scoring for the per-framework breakdown.

Tab 1: Framework Overview

The reporting view. Three charts across the top:

Violations by Framework - where your failures concentrate.
Top Violations - the most common failing categories, so you can spot one root cause behind many controls.
Severity Breakdown - critical, high, medium, low across everything.

Below them, Framework Compliance: one card per framework with its score, a progress bar, and a control breakdown of Passed, Partial, Failed, Not Verified and manual-attestation counts. Each card states its coverage in words, for example “18 of 25 controls automatically assessed, 13 need manual attestation”. Cards also show a violation count split by severity and an estimated exposure figure.

Read the breakdown rather than the score. A framework at 70% with a large Not Verified count is not 30% broken, it is largely unmeasured, and the work to fix it is a permission change rather than a remediation project.

A framework is never greener than its coverage allows. Below 90% coverage the score renders amber however high it is; below 70% it renders grey and is marked provisional. A 100% score over thin coverage is a real number, but the page will not let it read as “you are done” when much of the framework was never evaluated.

Tab 2: Control Management

The investigation view: every control, individually.

Pick All Frameworks or one framework from the selector, then search across control references, titles, descriptions, and framework names. Filters cover Category (Data Security, Privacy, Access Control, Encryption, Breach Notification, Data Integrity), Severity, and Status, plus Framework when you are viewing all of them.

Two view modes, toggled at the right of the toolbar:

Table - Ref, Control (title with its description beneath), Severity, Status, Category, and the count of Affected datastores. Sorted by status by default so the worst sits at the top, and every sort falls back to severity, so ties never order arbitrarily.
Matrix - a compact grid for scanning many controls at once.

The Status filter covers every status the backend can emit, including Not Verified and Manual attestation, so blind spots and procedural controls are both reachable from here.

The control detail drawer

Clicking any control opens it.

Overview carries the control name, framework, reference, category, severity, status, the count of affected datastores, the full description, and the data types affected, which is what connects an abstract control to the actual sensitive data that triggered it.

Affected Datastores lists every datastore failing the control, each badged with risk level, lifecycle status, and type, and each linking straight to its own drawer. This is the fastest path from “we fail this control” to “here are the eleven buckets to fix”.

Associated Alerts lists the alerts raised from the same underlying condition, so you can see whether the control failure is already being worked.

Evidence is why Argus reached this verdict: a plain sentence, then the signals it consulted with the value observed, the API call each came from, and when. If the control could only be partly assessed, this section names exactly which facets were out of reach, so a partial verdict can never be read as a complete one. For a manual-attestation control this section replaces the status entirely, stating what would satisfy the control instead.

Recommendations surfaces the suggested fixes for the control. See Recommendations.

Exporting for an auditor

There is no export button on this page. Compliance exports live under Reports, which produces the compliance report (overall and per-framework scores plus failing controls with citations, statuses, severities, and affected datastores), the manual-attestation list (every control Argus cannot assess, with the reason, ready to import into a GRC tool), and the executive summary.

Two guarantees hold for audit integrity: exports carry counts and metadata only, never the sensitive values themselves, and they exclude hidden and stale datastores while surfacing the count of what was excluded, so posture cannot be quietly improved by hiding a bad asset.

A workflow that works

Start on Framework Overview and pick the framework with the worst score.
Check its Not Verified count first. If it is significant, fix the permission and re-scan before doing anything else, because the rest of the numbers will move.
Move to Control Management, filter that framework to Non-compliant, and work down by severity. Criticals first, then partials.
Open a control’s Evidence section when you need to answer an auditor’s question about it, or to see which facets of a partial control were out of reach.
Export the manual-attestation list once and route it to whoever owns policy and process. That half of the control set is not going to resolve itself from the Argus side.