Compliance & audit readiness
Back in policy before it gets in anyone’s way.
When a laptop drifts out of policy, the employee usually finds out first: the VPN refuses them, or an app locks them out. Nanoheal puts drifted devices back into policy on the device, and keeps the record you hand the auditor when they ask which laptops had encryption off last quarter.
- PolicyDriftedStatusOutside policy
- Screen lock after 10 minutes 14 Restored 3 min avg
- Defender real-time protection on 3 Restored 1 min avg
- Remote Desktop disabled 2 Awaiting approval 2 h 10 min
- Firewall on for every profile 0 Holding —
A laptop drifts out of policy. It’s back before anyone is locked out.
Encryption is off after a bad reimage, or a required agent is missing. We hold the state each device should be in, so the drift itself is the trigger: drift detected and corrected on the device, on the same engine that fixes other faults. The employee never sees a refused login, and the record shows how long each device spent outside policy.
- 01The device driftsEncryption off, an agent missing, a setting changed.
- 02Put back on the deviceDrift is a fault like any other, fixed by the same engine.
- 03Recorded for the auditWhen it drifted, for how long, and what put it back.
Desired state, held as policy templates.
Baselines attach to the groups you already use.
Site, region, business unit and role are groups the console already understands: policies attach to them, releases target them, and auditors ask by them.
Start from pre-built Group Policy (GPO) baselines and the packs for SOC 2, IT sustainability (GreenIT) and more in the automation library, among 3,000+ device policies, scoped to the groups above.
Every device is checked all the time, and drift is timed.
Swipe to see the whole quarter →
The state now, not on scan day.
A quarterly scan reports the fleet on one morning. Continuous evaluation reports it now, and records how long each device spent outside policy, the figure an audit turns on.
A baseline for each group of people.
An engineer’s workstation, a shared ward device and a board member’s laptop cannot share one standard without it losing its meaning. Baselines are enforced per persona: one condition corrected silently for one group and prompted on another, set per population, without a second automation.
Fail rate by controlRanked worst first
For every unattended fix, you can show what ran and who approved it.
- Signed and versionedEvery fix comes from a fixed set of signed actions. Nothing is generated on the device.
- Validated onceA person approves each fix; the approval is versioned with it through staged, approved and versioned publishing.
- Scoped before it runsPolicy fixes which population a run may touch; a sensitive run waits for a person to approve or deny the run first.
- Recorded with its resultEach run lands in the execution history as success, failed or pending, per device, read from the device.
- 09:02 Edited BitLocker key escrow, version 3
J. Rivera · Author
- 09:03 Validation passed
System
- 10:15 Approved version 3Approval
A. Chen · Approver
- 10:16 Published to Pilot · 50 devices
A. Chen · Approver
- 13:30 Widened to Finance · 2,140 devices
A. Chen · Approver
- 14:05 Run succeeded · key escrowed, encryption on
LT-2207 · Device
The evidence is already recorded.
Configuration edits, publishes and policy links are logged as they happen, with the module, the account and the outcome. The console sits behind role-based access, MFA and a full audit log.
So an audit request is a filter on that record: the period, group and policy narrow it, and the result is exportable as an evidence pack.
Audit request Who changed remediation assignments since December, and when?
Swipe to see each marked column →
- 1 · the filter
- 2 · what changed
- 3 · who, and when
Finding drift is the report. Putting the device back is the job.