Compass and Insights

A posture score for the estate and every account, SOC 2 and NIST controls scored from Anchor's own records, and an advisory review of what deserves attention.

Compass: posture you can trace

Compass scores how well your privileged estate is governed, from Anchor’s own records rather than questionnaires. Every score links to the evidence behind it, and missing evidence stays visible as missing instead of counting as a pass.

Compass overview with an estate score of 87, evidence coverage of 83 percent, and the five areas behind the score — AcmeCorp's estate score of 87, with 83% evidence coverage, and the five areas behind it.

The five areas are weighted: management reliability 30, Policy and credential lifecycle 25, privileged access governance 20, runtime and trust health 15, and evidence and audit assurance 10.

Every account has its own score

Account posture scores each privileged account on the same checks: its Policy, password strength, scheduled work and its outcomes, reveal and retrieval, and target trust. Open an account to see what lowers its score, by how much, and the change that would raise it.

Account posture for svc_backup@acme-linux01: score 84, lowered by four checks, with the SOC 2 and NIST controls they weaken — svc_backup@acme-linux01 scores 84. Four checks lower it, and the panel names the SOC 2 and NIST controls they weaken.

One setting on one account traces straight to SOC 2 CC6.1 or NIST AC-6. A check with nothing to score lowers evidence coverage, never the score.

When a setting is deliberate, such as an integration that must retrieve a key, a Compliance Reviewer can Accept as intended for 7 to 90 days, with a reason and a step-up, and it is audited. A failed job is a fact to fix and cannot be accepted.

GRC scoring for SOC 2 and NIST

Framework evidence scores the same records against the SOC 2 Trust Services Criteria, NIST SP 800-53 and NIST CSF 2.0: an evidence alignment score for each framework, a score for each family, and a status for each control.

Status	Control score
Met	90 or more
Partly met	60 to 89
Not met	Below 60
Not evidenced	Too little evidence to score

SOC 2 framework evidence: alignment 83, and the Logical access family at 77 with each control's status and score — SOC 2 on AcmeCorp: evidence alignment 83. Logical access (CC6) scores 77: two controls met, two partly met, one not met.

Open a control to see how Anchor checks it: each check behind the score, the lowest first, and a diagnosis with the fix and where to make it.

SOC 2 control CC6.1, partly met at 82, with the checks it is scored from — CC6.1 is partly met at 82, pulled down by MFA for privileged users.

A control that does not apply can be marked not applicable, with a reason. Accepting the risk on a finding, for up to 90 days, never changes a score. Export evidence gives an assessor the records behind it all. This is evidence alignment, not certification: it shows an assessor where to look.

Insights: an advisory second look

Insights reviews recent, redacted records and raises advisory findings, each with a priority and its evidence. Insights never changes anything.

Insights runs inside Anchor by default, as a deterministic review. No record is sent to an external AI service unless an administrator chooses a provider, and even then only the redacted review context travels: never a password, key or recording.

Next stop · 08Running AnchorHealth, upgrades, backups, Engines and maintenance, from the console or the command line.