Skip to main content

Status Transitions

Compliance Engine tracks how the compliance status of each asset changes over time. This guide focuses on status transitions at the policy/finding level.

Core Statuses​

For each policy and asset pair, Compliance Engine maintains an output object (for example, a policy violation or benchmark check) whose status can be:

  • Compliant – the asset currently meets the control’s conditions.
  • Incompliant – the asset violates the control.
  • Inapplicable – the control does not apply to the asset.
  • Closed/Out of Scope – the asset is no longer in scope for the policy.

These statuses are updated on each evaluation run.

Transition Examples​

Typical transitions include:

  • Not yet evaluated → Compliant/Incompliant/Inapplicable
    The first time an asset is evaluated, a new output object is created with the appropriate status.

  • Compliant → Incompliant
    A previously compliant asset drifts out of compliance; the violation records the new status and timestamps.

  • Incompliant → Compliant
    The underlying misconfiguration is fixed; the violation is updated to Compliant and its incompliant period ends.

  • Any status → Inapplicable
    The asset no longer meets the prerequisites for the control (for example, a feature is disabled); the finding becomes inapplicable.

  • Any status → Closed/Out of Scope
    The asset leaves the policy scope entirely (for example, the resource is deleted or moved to an excluded environment); the finding is closed and no longer counts against current posture.

See State Model for more on how these transitions are represented in the data model.

Timestamps and MTTR​

To support reporting and KPIs, Compliance Engine tracks timestamps such as:

  • When an asset first became incompliant.
  • When it returned to compliant.
  • When it became inapplicable.
  • When a finding was closed because the asset went out of scope.

These fields allow you to calculate metrics like:

  • Mean time to remediate (MTTR) – how long violations remain incompliant before being fixed.
  • Violation age – how long current incompliant findings have been open.
  • Exception aging – how long accepted risks have remained in place.

Objects that are closed due to scope loss should typically be excluded from MTTR measurements, because they no longer represent active risk.