Skip to content

Compliance Reporting

Auto-generate compliance reports for SOC 2, ISO 27001, and HIPAA.

Overview

Nefia's compliance reporting feature analyzes audit logs, configuration, and policy state to automatically assess compliance against major security frameworks.

Supported Frameworks

FrameworkDescription
SOC 2 Type IIInternal controls for service organizations
ISO 27001:2022Information security management system
HIPAATechnical safeguards for healthcare information (45 CFR 164.312)

Report Generation

Table Output (Default)

bash
nefia compliance report --framework soc2

Specifying a Period

bash
# Relative period
nefia compliance report --framework iso27001 --period 90d
 
# Absolute period
nefia compliance report --framework hipaa --period 2026-01-01..2026-03-10

HTML Report

bash
nefia compliance report --framework soc2 --format html --out report.html

JSON/YAML Output

bash
nefia compliance report --framework soc2 --format json
nefia compliance report --framework iso27001 --format yaml

Evidence Collection

Reports automatically collect evidence from the following sources:

Audit Log Analysis

ItemDescription
Total recordsNumber of audit log entries within the period
Operation distributionCount by operation type (exec, fs_read, fs_write, etc.)
Unique hosts/usersNumber of accessed devices and operators
JIT operationsRequest/approval/denial/revocation counts
Policy denialsNumber of denied operations
HMAC verificationHash chain integrity

Configuration Assessment

ItemCheck
Audit loggingEnabled, HMAC signed, retention days
PolicyEnforce mode
VPNEnabled
Device LockEnabled
JIT accessEnabled
SIEM integrationConfigured
AlertsConfigured
Session recordingConfigured

Control Assessment

Each control is assessed with one of the following statuses:

StatusScoreDescription
pass1.0Fully compliant
partial0.5Partially compliant (gaps exist)
fail0.0Non-compliant
not_applicable—Not applicable (excluded from score calculation)

Compliance score = (pass + partial x 0.5) / (total - not_applicable) x 100%

HTML Report Structure

HTML reports are self-contained and include the following sections:

  1. Header — Framework name, reporting period, generation date
  2. Summary grid — Compliance score (color-coded), number of controls
  3. Configuration table — Status of audit, policy, VPN, device lock, JIT, SIEM, etc.
  4. Control details — Each control's ID, name, category, status, evidence, gaps, and recommendations

Score color coding:

  • 80% or above: Green
  • 60% or above: Amber
  • Below 60%: Red

Best Practices

  • Automate regular report generation with a scheduler
  • Share HTML reports with the audit team
  • Improve configuration based on gaps and recommendations
  • Set audit log retention periods to match framework requirements