--- title: "Security and compliance" description: "How Outpost enforces security settings against compliance frameworks, reports where your endpoints fall short, and produces evidence for an audit." url: "https://support.outpostplatform.com/compliance/" product: "depot" type: "concept" status: "draft" ai_summary: "Overview of Outpost security and compliance. Framework baselines (SOC 2, HIPAA, PCI DSS 4.0, CJIS, NIST SP 800-171 and 800-53, CMMC Level 2, ISO/IEC 27001, plus advisory DISA STIG and Microsoft baselines) set floors profiles cannot weaken. Posture, exceptions, evidence packs, local admin rotation, recovery key escrow. Not EDR or antivirus. No certification is claimed." availability: plans: ["home-lab", "essentials", "enterprise", "msp"] platforms: ["windows", "linux", "macos"] permission: "compliance:read" preview: false source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/index.md" license: "CC BY 4.0" --- # Security and compliance Outpost helps you hold your endpoints to the security frameworks your organization is measured against. You choose a framework, Outpost enforces its minimum settings on every endpoint in scope, reports which endpoints meet each control, and packages the result as a document you can hand to an auditor. This page is for IT managers and MSP owners deciding what Outpost can carry for an audit, and for technicians who work the findings. ## What Outpost does for security posture | Capability | What it does | Page | | --- | --- | --- | | Framework baselines | A built-in profile per framework. Assigning it sets minimum values, called floors, that your own profiles cannot weaken. | [Compliance framework baselines](/compliance/framework-baselines/) | | Compliance posture | Compares what each endpoint reports against what each framework requires, control by control and endpoint by endpoint. | [Review compliance posture](/compliance/compliance-overview/) | | Exceptions | Records a control you have decided not to meet, with a justification, a second person's approval, and an expiry date. | [Request and approve exceptions](/compliance/exceptions/) | | Evidence packs | A PDF for one framework over one closed period, generated once and never regenerated. | [Generate evidence packs](/compliance/evidence-packs/) | | Local administrator password rotation | Rotates a local administrator password on a schedule and stores every password in the credential vault before it is set. | [Rotate local administrator passwords](/compliance/local-admin-rotation/) | | Disk encryption recovery keys | Stores BitLocker and FileVault recovery keys in Outpost, and records every reveal in the audit log. | [Disk encryption recovery keys](/compliance/recovery-keys/) | | FIPS 140-3 cryptography | The Outpost agent and Depot run their cryptography in FIPS 140-3 mode. | [FIPS 140-3 mode](/compliance/fips/) | The tamper-evident [audit logs](/depot/audit-log/) of console actions and endpoint changes also support an audit. Every evidence pack records whether both are intact. ## Frameworks Outpost ships content for these frameworks, and every plan includes all of them: | Framework | Kind | | --- | --- | | SOC 2 | Enforced floors | | HIPAA Security Rule | Enforced floors | | PCI DSS 4.0 | Enforced floors | | CJIS Security Policy | Enforced floors | | NIST SP 800-171 | Enforced floors | | NIST SP 800-53 Rev 5 | Enforced floors | | CMMC Level 2 | Enforced floors | | ISO/IEC 27001 | Enforced floors | | DISA STIG | Advisory recommendations | | Microsoft security baseline | Advisory recommendations | | CIS Benchmarks | Listed, with no content, for licensing reasons | The difference between enforced and advisory frameworks is explained in [Compliance framework baselines](/compliance/framework-baselines/). Every setting each framework sets is listed in [Baseline settings by framework](/compliance/framework-settings/). ## How it works Outpost turns a framework into enforced settings and a measured posture in five stages: - **Assignment.** You assign a framework's baseline profile to your organization, a site, a device group, or one endpoint, in the first-run setup wizard or later under **Profiles**. - **Resolution.** Outpost resolves each endpoint's policy. Where a framework sets a floor, the result is at least as strict as the floor, whatever your other profiles say. - **Enforcement.** The agent applies the settings and reports what each one reads as on the endpoint. - **Measurement.** The **Compliance** pages compare those reports with each framework and give every endpoint a verdict per control. - **Evidence.** You fix the gaps, record the ones you accept as exceptions, and generate an evidence pack for the audit period. Endpoints enforce and report on Windows, Linux, and macOS. macOS support is a preview. FreeBSD and OpenBSD endpoints have no policy enforcement, so they are not measured. See [Platform support](/get-started/platform-support/). On the MSP plan, each client has its own frameworks, posture, exceptions, and evidence packs. ## What Outpost does not do - **It is not antivirus or EDR.** Outpost has no malware detection of its own. It works alongside your antivirus or EDR and reports its status: Windows Security Center and Microsoft Defender on Windows, and recognized products on Linux such as ClamAV, Sophos, ESET, Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne. - **It does not certify you.** Outpost is not certified against any framework, and using it does not make your organization compliant. It enforces and measures endpoint settings that support specific controls, and records the evidence. Most controls in every framework cover people, processes, and systems Outpost does not manage, and your auditor decides what the evidence shows. - **It measures only what endpoints report.** An endpoint that has not reported a setting, or whose last report is more than 24 hours old, is **Not measured** rather than compliant. - **It does not ship CIS Benchmark content.** CIS content is licensed, so the CIS entry has no settings. ## Who can use it The **Compliance** section of the console appears for anyone who holds `compliance:read`. Approving exceptions, generating evidence packs, and creating remediation tickets or alerts need `compliance:manage`. On Enterprise and MSP, a remediation becomes a ticket. On Home Lab and Essentials, it raises an alert for each endpoint, which closes when the endpoint reports the setting as compliant. See [Review compliance posture](/compliance/compliance-overview/#remediation-alerts). | Role | `compliance:read` | `compliance:manage` | | --- | --- | --- | | **Owner** | Yes | Yes | | **Support Manager** | Yes | Yes | | **Field Technician** | Yes | No | | **Support Rep** | Yes | No | | **Accounting** | No | No | See [Roles and permissions](/depot/roles-and-permissions/). ## Related - [Compliance framework baselines](/compliance/framework-baselines/) - [Review compliance posture](/compliance/compliance-overview/) - [Set up your Outpost](/depot/first-run-setup/) - [Audit logs](/depot/audit-log/)