Skip to main content

Status Transitions

Compliance Engine tracks how the compliance status of each asset changes over time. This guide focuses on status transitions at the policy/finding level.

Core Statuses​

For each policy and asset pair, Compliance Engine maintains an output object (for example, a policy violation or benchmark check) whose status can be:

  • Compliant – the asset currently meets the control’s conditions.
  • Incompliant – the asset violates the control.
  • Inapplicable – the control does not apply to the asset.
  • Closed/Out of Scope – the asset is no longer in scope for the policy.

These statuses are updated on each evaluation run.

Transition Examples​

Typical transitions include:

  • Not yet evaluated → Compliant/Incompliant/Inapplicable
    The first time an asset is evaluated, a new output object is created with the appropriate status.

  • Compliant → Incompliant
    A previously compliant asset drifts out of compliance; the violation records the new status and timestamps.

  • Incompliant → Compliant
    The underlying misconfiguration is fixed; the violation is updated to Compliant and its incompliant period ends.

  • Any status → Inapplicable
    The asset no longer meets the prerequisites for the control (for example, a feature is disabled); the finding becomes inapplicable.

  • Any status → Closed/Out of Scope
    The asset leaves the policy scope entirely (for example, the resource is deleted or moved to an excluded environment); the finding is closed and no longer counts against current posture.

See State Model for more on how these transitions are represented in the data model.

Timestamps and MTTR​

To support reporting and KPIs, Compliance Engine tracks timestamps such as:

  • When an asset first became incompliant.
  • When it returned to compliant.
  • When it became inapplicable.
  • When a finding was closed because the asset went out of scope.

These fields allow you to calculate metrics like:

  • Mean time to remediate (MTTR) – how long violations remain incompliant before being fixed.
  • Violation age – how long current incompliant findings have been open.
  • Exception aging – how long accepted risks have remained in place.

Objects that are closed due to scope loss should typically be excluded from MTTR measurements, because they no longer represent active risk.

On this page