Analyzing compliance postures from detection to remediation
IBM Cloud® Security and Compliance Center Workload Protection provides comprehensive compliance posture management capabilities that help security teams, compliance officers, and DevOps engineers continuously monitor, evaluate, and improve their security posture across cloud environments. The platform enables organizations to detect compliance violations, understand their security posture, and drive remediation through to resolution.
Information about your compliance posture is included in an inventory, which enhances resource visibility and provides full-context prioritization.
This information helps you drive remediation and resolution of compliance violations. To access your inventory and other compliance-related information, open the Workload Protection UI. In the console, click the Navigation Menu icon 
> Security > Compliance and click the name of your instance of Workload Protection. Then, click Open dashboard to open the Workload
Protection UI.
How compliance posture management works
Workload Protection evaluates the resources in your zones against compliance policies. Any violations are collected and displayed as tiles on the Compliance page in the Workload Protection UI. This evaluation is performed once daily to provide up-to-date compliance status.
You can use Workload Protection predefined policies or create custom policies tailored to your organization's specific requirements. When evaluating violations, you can select individual resources to see their associated list of violations, enabling targeted remediation efforts.
Key concepts
The compliance workflow consists of the following key components:
- Zones
- Logical groupings of resources that represent different parts of your infrastructure. The default Entire Infrastructure zone is automatically created by Workload Protection, and you can define custom zones to match your organizational structure. Zones are defined by a collection of scopes or resource types.
- Policies
- Collections of requirements that define a compliance standard. A policy includes one or more controls to define that compliance standard. Policies can be based on industry frameworks or custom organizational requirements.
- Requirements
- Specific compliance criteria that must be met. Each requirement consists of one or more controls.
- Controls
- Identifies a potential issue or violation within the environment and the solution to remediate the problem. Different types of controls are used to address business, security, compliance, and operational requirements.
The Compliance overview page displays key posture performance indicators for each policy applied to your zones. For more information, see Understanding the Compliance UI.
Compliance workflow overview
The typical compliance posture management workflow follows these stages:
- Detection and assessment. Workload Protection scans your environment daily and evaluates resources against defined policies. Workload Protection identifies violations and categorizes them by severity, providing a comprehensive view of your compliance posture.
- Analysis and prioritization. Security and compliance teams can review high-level posture performance indicators for each policy applied to their zones. By selecting a policy, teams can see detailed results, including failing requirements, associated controls, and affected resources.
- Evaluation and decision making. When reviewing violations, teams can examine the control pane to understand the hierarchy of requirements and controls. Each item indicates whether it's passing or failing.
- Remediation. Workload Protection provides multiple remediation options to address compliance violations. For more information, see Evaluate and Remediate.
- Reporting and documentation. Organizations can generate compliance reports that can be downloaded from the UI or accessed via API. These reports can be shared with development teams, executives, auditors, and other stakeholders who require compliance status information.
- Source detection and patching. When Git integration is implemented, Workload Protection scans and analyzes the manifests from your defined Git sources daily or whenever a new Git source is added. The system determines which resources are declared in your source files and attempts to match discovered resources with deployed and evaluated resources.
Use cases by role
Different organizational roles benefit from compliance posture management in specific ways:
Compliance and security teams
Compliance and security team members use the compliance feature to:
- Check the current compliance status of business zones against predefined policies.
- Demonstrate to auditors the compliance status of their business zone at a specific point in time.
- Create reports of compliance status to share with auditors and management teams.
- Understand the magnitude of the compliance gap and track improvement over time.
- Monitor trends in compliance posture through historical data visualization.
DevOps engineers
DevOps team members use the compliance feature to:
- Identify compliance violations for predefined policies on their business zones.
- Manage violations according to their severity, prioritizing high-severity issues.
- Efficiently fix violations using automated patches or pull requests.
- Document exceptions and acceptable risks according to organizational risk management policies.
- Integrate compliance checks into their CI/CD pipelines.
Cloud architects
Cloud architects use the compliance feature to:
- Design infrastructure that meets compliance requirements from the start.
- Understand which controls apply to different resource types and configurations.
- Evaluate the compliance impact of architectural decisions.
- Ensure new deployments align with organizational security policies.