Security and compliance

Outpost helps you hold your endpoints to the security frameworks your organization is measured against. You choose a framework, Outpost enforces its minimum settings on every endpoint in scope, reports which endpoints meet each control, and packages the result as a document you can hand to an auditor. This page is for IT managers and MSP owners deciding what Outpost can carry for an audit, and for technicians who work the findings.

What Outpost does for security posture

Capability	What it does	Page
Framework baselines	A built-in profile per framework. Assigning it sets minimum values, called floors, that your own profiles cannot weaken.	Compliance framework baselines
Compliance posture	Compares what each endpoint reports against what each framework requires, control by control and endpoint by endpoint.	Review compliance posture
Exceptions	Records a control you have decided not to meet, with a justification, a second person’s approval, and an expiry date.	Request and approve exceptions
Evidence packs	A PDF for one framework over one closed period, generated once and never regenerated.	Generate evidence packs
Local administrator password rotation	Rotates a local administrator password on a schedule and stores every password in the credential vault before it is set.	Rotate local administrator passwords
Disk encryption recovery keys	Stores BitLocker and FileVault recovery keys in Outpost, and records every reveal in the audit log.	Disk encryption recovery keys
FIPS 140-3 cryptography	The Outpost agent and Depot run their cryptography in FIPS 140-3 mode.	FIPS 140-3 mode

The tamper-evident audit logs of console actions and endpoint changes also support an audit. Every evidence pack records whether both are intact.

Frameworks

Outpost ships content for these frameworks, and every plan includes all of them:

Framework	Kind
SOC 2	Enforced floors
HIPAA Security Rule	Enforced floors
PCI DSS 4.0	Enforced floors
CJIS Security Policy	Enforced floors
NIST SP 800-171	Enforced floors
NIST SP 800-53 Rev 5	Enforced floors
CMMC Level 2	Enforced floors
ISO/IEC 27001	Enforced floors
DISA STIG	Advisory recommendations
Microsoft security baseline	Advisory recommendations
CIS Benchmarks	Listed, with no content, for licensing reasons

The difference between enforced and advisory frameworks is explained in Compliance framework baselines. Every setting each framework sets is listed in Baseline settings by framework.

How it works

Outpost turns a framework into enforced settings and a measured posture in five stages:

• Assignment. You assign a framework’s baseline profile to your organization, a site, a device group, or one endpoint, in the first-run setup wizard or later under Profiles.
• Resolution. Outpost resolves each endpoint’s policy. Where a framework sets a floor, the result is at least as strict as the floor, whatever your other profiles say.
• Enforcement. The agent applies the settings and reports what each one reads as on the endpoint.
• Measurement. The Compliance pages compare those reports with each framework and give every endpoint a verdict per control.
• Evidence. You fix the gaps, record the ones you accept as exceptions, and generate an evidence pack for the audit period.

Endpoints enforce and report on Windows, Linux, and macOS. macOS support is a preview. FreeBSD and OpenBSD endpoints have no policy enforcement, so they are not measured. See Platform support.

On the MSP plan, each client has its own frameworks, posture, exceptions, and evidence packs.

What Outpost does not do

• It is not antivirus or EDR. Outpost has no malware detection of its own. It works alongside your antivirus or EDR and reports its status: Windows Security Center and Microsoft Defender on Windows, and recognized products on Linux such as ClamAV, Sophos, ESET, Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne.
• It does not certify you. Outpost is not certified against any framework, and using it does not make your organization compliant. It enforces and measures endpoint settings that support specific controls, and records the evidence. Most controls in every framework cover people, processes, and systems Outpost does not manage, and your auditor decides what the evidence shows.
• It measures only what endpoints report. An endpoint that has not reported a setting, or whose last report is more than 24 hours old, is Not measured rather than compliant.
• It does not ship CIS Benchmark content. CIS content is licensed, so the CIS entry has no settings.

Who can use it

The Compliance section of the console appears for anyone who holds compliance:read. Approving exceptions, generating evidence packs, and creating remediation tickets or alerts need compliance:manage. On Enterprise and MSP, a remediation becomes a ticket. On Home Lab and Essentials, it raises an alert for each endpoint, which closes when the endpoint reports the setting as compliant. See Review compliance posture.

Role	compliance:read	compliance:manage
Owner	Yes	Yes
Support Manager	Yes	Yes
Field Technician	Yes	No
Support Rep	Yes	No
Accounting	No	No

See Roles and permissions.

Related

• Compliance framework baselines
• Review compliance posture
• Set up your Outpost
• Audit logs