Security and governance checks
Understand what Costframe's security findings establish, how evidence gaps limit coverage, and why automated checks do not certify compliance.
On this page
Use a control finding in a security review
Open the finding available to your workspace and identify the affected resource and control. Read the observed configuration, collection time and checks that could not be completed.
Ask the system owner to confirm the intended configuration before deciding on remediation. Keep any compliance assessment separate: a resource check does not certify your organization or replace an assessor's judgment.
Evidence preparation, not certification
Security checks are mapped to common control areas for evidence preparation. They are not SOC 2, PCI, HIPAA, CIS, or ISO certification claims.
Execution source
Checks run over latest completed audit snapshots and connection health. PASS means no violation was detected in available in-scope evidence.
Read-only provider posture
Provider adapters construct supported read clients. Costframe emits evidence and implementation guidance; it does not expose a provider write path.
Auditability
Authoritative administrative completion must come from trusted backend mutations or verified external events. Client-visible success alone is not authoritative.