Compliance Management

It would be nice to be able to audit and report on CIS benchmarks instead of just the general CIS controls.

We are looking for PIPEDA compliance framework. Is it possible for that to be added please? PIPEDA Compliance Framework

Compliance Progress Visibility: Currently, users cannot view or report partial compliance progress. The customer is requesting a feature to display percentage-based compliance (e.g., 40% compliant, 60% non-compliant) based on checks performed. This would help in tracking incremental progress and communicating it effectively within their organization. NIST 800-Aligned Report Export: The downloadable compliance report is currently aligned with CIS benchmarks. The customer is requesting a version aligned with NIST 800, which they follow internally. This would assist in compliance reporting and audit readiness.

We are fairly new to ConnectSecure and one large issue we are having with the platform is not being able to mark HIPAA Compliance Standards as Mitigated. There are many Standards that would not have a direct resolution but instead be mitigated. Below is an example: 164.312(a)(2)(iii) - Automatic Log off - Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity The 164.312(a)(2)(iii) standard is listed as "Addressable". This signifies that the approach to comply with this standard is flexible and allows to put a technical procedure in place as screen timeout, screen lock and many others that would satisfy this standard. Currently, there is no way to prove a client of ours is compliant with this standard as most of our clients have screen lockout and not Automatic logoff in place. We would like to see a suppression field similar to the Vulnerability Suppression field as shown in the attached image. This would be an amazing feature and allow compliance to be more flexible in approach.

It is really difficult to present compliance scan results to clients when there are known risks show as non-compliant when they are accepted or have compensating controls in place. For example, we cannot disable laptop webcams for 99% of our clients or they will not be able to use videoconferencing software. Physical camera shutters are used to block the camera when not in use. It would be great to be able to mark this registry key detection within the assessment as manual compliant or a new accepted/compensated measure rather than 100% non-compliant.

BLUF// Add the Criminal Justice Information Services (CJIS) Security Policy 6.0 The state of Ohio just signed into law House Bill 96, mandating all political subdivisions (County, city, township, and village) to establish a cybersecurity program by 1 January 2026. They need to be able to show they have adopted a security framework, conducted a risk assessment, and have plans for an incident response. It goes a bit deeper than that, but essentially, almost everything the connectsecure tool does. We all have 911 emergency call centers, and we all have to comply with the CJIS framework. As of early 2025, Ohio has over 3,000 political subdivisions, including its 88 counties and all other municipal, township, school district, and special district governments. We are audited and can be sanctioned for not complying with the framework.

In Compliance Standards I can click on the CIS Compliance ID to open a details window, and that is not available for other standards like NIST 800 171. Support confirmed that it is only available for CIS and requested that I open this ticket. The details for other standards would be very helpful and consistent functionality.