Feature Overview

Compliance Standards is a page within CoreStack’s Graphion module where you assess your cloud accounts against industry benchmarks and regulatory standards. Each standard contains controls, which are the individual rules your resources must meet. Use the page when you need to measure compliance, track improvement over time, or define your own standards for internal audits.

The page is most valuable to Compliance Admins and Compliance Members who run assessments and report on compliance. It supports AWS, Azure, GCP, and OCI accounts. It does not show trends or violated policies by account. To review those, use Compliance Posture.

The page has five tabs:

How It Works

When you run an assessment, CoreStack evaluates the selected cloud account against each control in the standard. Automated controls take their status from the policies mapped to them. Manual controls start as Open and you set their status yourself. The assessment stays In Progress until you mark it Complete, so you can track improvement within the same assessment over time.

Any policy run updates every in-progress assessment that the policy is mapped to, including runs started outside Compliance. Control statuses update to match. Once you mark an assessment Complete, it appears in Assessment History as a finished record, and CoreStack sends any configured notifications.

Prerequisites

Before you begin, ensure the following:

• Role: You have the Compliance Admin or Compliance Member role.
• Cloud account: At least one cloud account is onboarded to Compliance.
• Policies: For automated controls, the policies you want to use exist in your tenant.
• Access: You can reach Graphion > Compliance > Compliance Standards in the left navigation pane.

Supported Standards

CoreStack provides 1600+ policies (guardrails) mapped to the standards below. You assess once to measure compliance against multiple standards.

Browsing Marketplace Standards

Navigate to Graphion > Compliance > Compliance Standards. The page opens on the Marketplace Standards tab.

Marketplace standards are managed by CoreStack and available to all tenants. Each card shows the standard name, a short description, and three icons for Assess, History, and Download, plus a View Controls button.

To find a standard, type a name or description in the Search box above the cards.

Viewing Controls in a Standard

1. Click View Controls on a standard card. The controls page opens with a Control Family / Sub-Family panel on the left.

   

2. Click a family, or type in the panel’s search box to find one. The controls in that family appear on the right.

Each control shows its statement, its Nature (Manual or Automated), and its Severity. Automated controls also show View Policy, which lists the policies mapped to the control.

3. Click Control Details on a control. The Control Details panel opens.

The panel shows the control name, family, and statement under Control Attributes. Control Action Attributes lists the category, baseline, classification, level, nature, purpose, and action method.

Downloading Controls

1. Click the Download icon on the standard card. CoreStack prepares the file.

2. In the Download Controls dialog, click Download when the message “Your download is ready!” appears.

   

Running an Assessment

An assessment evaluates one cloud account against one standard. You can run it on demand from any Marketplace or Custom standard.

1. Click the Assess icon on the standard card. The Start Compliance Assessment dialog opens.

2. In the Cloud Accounts list, select the cloud account to assess.

3. Click Start Assessment. CoreStack assesses the account’s resources against the controls in the standard.

   

You can also run an assessment at the control level.

Continuing an Assessment

An assessment stays In Progress until you mark it Complete. Use Continue Assessment to work through it control by control through the Compliance Posture page.

Open the in-progress assessment. The control-by-control view opens.

1. Review the status of each control. Automated controls show the result of their mapped policies.
2. Answer each control that needs your input, and add comments and attachments as evidence.
3. To refresh results, re-scan at the standard level or the control level.
4. When you finish, click Complete to mark the assessment complete*[*

Policy runs update in-progress assessments automatically. You don’t need to re-scan after a mapped policy runs, and this includes runs started outside Compliance.

Updating Manual Controls

Manual controls cannot be automated, so you set their status yourself. Each manual control starts as Open.

1. In the control-by-control view, open the manual control.
2. Set the status to Success or Violation.
3. Add a comment and attach evidence, such as a screenshot or document.
4. Save your changes. The control status and the assessment summary update.

You can also override the status of an automated control. Add a comment to explain the override.

Managing Assessment History

The Assessment History tab lists assessment jobs across all standards. Each row shows the assessment job ID, standard, cloud account, user, created date, last scan date, and status. An assessment shows IN_PROGRESS until you mark it complete, then COMPLETED.

• Search: Type an assessment job ID in the Search box.

• Filter: Click ADD and select Cloud Account or Compliance Standard, then choose a value.

  

To see the history of one standard, click the History icon on its card. The tab opens filtered to that standard.

Managing Custom Standards

Custom standards are visible only to users in your tenant. Open the Custom Standards tab to see them. Each card has the same icons as Marketplace cards, plus Edit and Delete.

Creating a Custom Standard

You create the standard and all its controls in a single upload.

1. On the Custom Standards tab, click Create Custom Standard. The New Standard panel opens.

2. Under Basic Information, enter a Name and, optionally, a Description.

3. Under Configuration, select a Cloud Provider and a Scope

4. Under Assets, click Choose Logo and select an image. Supported formats are PNG and JPG. The recommended size is 48 x 48 px, and the maximum file size is 2 MB.

5. In Control Definitions, click Upload and select your control definitions file.

6. Click Create. The new standard appears on the Custom Standards tab.

   

Editing a Custom Standard

1. Click the Edit icon on the standard card. The Edit Standard panel opens.

2. Update the name, description, cloud provider, scope, or logo.

3. Click Update. CoreStack runs validation checks before it saves the changes.

   

Deleting a Custom Standard

1. Click the Delete icon on the standard card. The Delete Standard dialog opens.

2. Click Yes to delete the standard, or No to keep it. CoreStack runs validation checks before it deletes the standard.

   

Managing Controls in a Custom Standard

Click View Controls on the card to add, edit, or delete controls. You can add a control in two ways:

• Form: Add one control at a time and fill in its fields.
• Upload: Upload a CSV or XLSX file to add many controls at once.

For an automated control, map policies while you create or edit the control. No separate mapping step is needed

Managing Schedules

Schedules run assessments automatically. Open the Schedules tab. The list shows the schedule name, standard, cloud account, recurrence, next run time, and who requested it. Upcoming schedules appear by default.

To narrow the list, click ADD and select Compliance Standard or Recurrence.

Creating a Schedule

1. Click Create Schedule. The Create Schedule panel opens.

2. In Compliance Standard, select a standard.

3. In Schedule Name, enter a name. Optionally, add a Description.

4. Set the Start Date and Start Time.

5. In Recurrence, select how often the assessment runs, select from Once, Daily, Weekly, or Monthly.

6. Set the End Date.

7. Click Create. The schedule appears in the list.

   

Editing or Deleting a Schedule

1. Click the ellipsis (…) in the Actions column next to the schedule.

2. Select Edit to change the schedule, then click Update. Select Delete to remove it.

   

Managing Notifications

Notifications send compliance alerts to the email addresses and webhooks you choose for a cloud account. CoreStack sends a notification only when a full automated policy scan finishes or when an assessment is marked Complete.

Open the Notifications tab. The list shows each cloud account, its provider, and the channels enabled for it.

Creating a Notification

1. Click Create Notification. The Add Compliance Notification panel opens.
2. In Cloud Account, select an account onboarded to Compliance.
3. Enter an email address and click Add. Repeat for each recipient.
4. Enter a webhook URL and click Add. Optionally, do the same for Microsoft Teams Webhook.
5. Click Save & Apply.

   📘

   Note: You must add at least one email address, webhook, or Microsoft Teams webhook.

Editing or Deleting a Notification

1. Click the ellipsis (…) in the Actions column next to the cloud account.
2. Select Edit. In the Edit Compliance Notification panel, add or remove recipients, then click Save & Apply. Select Delete to remove the notification

Frequently Asked Questions

Q: Why is my assessment still In Progress?

An assessment stays In Progress until you mark it Complete. This lets you track improvements within the same assessment as policies run and controls change. Open the assessment and click Complete when you are done.

Q: Do policy runs from outside Compliance update my assessment?

Yes. Any policy run updates the in-progress assessments that the policy is mapped to, and control statuses update to match. You don’t need to start a new assessment.

Q: What happens to the current assessment when I run a standard again?

You can complete the current assessment first, then start a new one. Completed assessments stay in Assessment History.

Q: Can I change the status of an automated control?

Yes. You can override an automated control’s status and add a comment. Manual controls start as Open and you set them to Success or Violation.

Q: Who can see my custom standards?

Only users in your tenant. Marketplace standards are available to all tenants and cannot be edited.

Q: Do I need a separate step to map policies to a control?

No. Map policies while you create or edit the control.

Troubleshooting

Custom standard upload fails

Cause: The control definitions file did not pass validation, for example a required column is missing or a value is invalid.

Solution:

1. Review the error message shown after the upload.
2. Correct the file and upload it again.
3. Click Create. The standard appears on the Custom Standards tab.

If the issue persists, contact CoreStack support with: tenant ID, standard name, the file you uploaded, and a screenshot of the error.

Standard cannot be updated or deleted

Cause: CoreStack runs validation checks before it updates or deletes a custom standard, and one of the checks failed.

Solution:

1. Read the message shown in the panel or dialog.
2. Resolve the condition it describes, for example complete an in-progress assessment or delete a linked schedule.
3. Try the update or delete again.

Notification email or webhook not received

Cause: Notifications are sent only when a full automated policy scan finishes or an assessment is marked Complete. If neither event has happened, no notification is sent. The recipient address or webhook may also be incorrect.

Solution:

1. Open the Notifications tab and confirm the cloud account has the correct recipients.
2. Check Assessment History to confirm an assessment completed.
3. Re-enter the webhook URL if you changed it recently, then click Save & Apply.

If you still don’t receive notifications, contact CoreStack support with: tenant ID, cloud account name, assessment job ID, and the recipient email or webhook.

Cloud account is missing from the Assess or Notification list

Cause: The cloud account is not onboarded to Compliance.

Solution:

1. Confirm the account is onboarded and active.
2. Refresh the page and open the list again.