Use compliance plans

Compliance plans schedule and manage comprehensive compliance reporting across multiple Golden Configurations. Use them to maintain regular compliance checks and generate audit reports.

What are compliance plans?

Compliance plans orchestrate compliance checks across multiple Golden Configurations, device groups, and schedules. They provide centralized management for enterprise-wide compliance programs and generate consolidated reports for audit and analysis.

How compliance plans work

Compliance plans follow this process:

Create a compliance plan

To create a new compliance plan:

Configure compliance plan scope

Define what the plan should check.

Add Golden Configurations

To include Golden Configurations in the plan:

Add device groups

To include device groups:

Scope example:

Compliance Plan: Enterprise Network Compliance
Scope:
  - Golden Config: Campus Switches (all nodes)
  - Golden Config: Data Center Switches (production node only)
  - Golden Config: Firewall Policy (all nodes)
  - Device Group: Branch Office Devices
  - Device Group: Core Network Devices

Set compliance plan schedule

Configure when compliance checks run.

Schedule options

Configure schedule

To set the plan schedule:

Schedule examples:

Daily monitoring:

Frequency: Daily
Time: 2:00 AM local time
Days: Monday through Sunday
Retry: 2 attempts if failure

Weekly audit:

Frequency: Weekly
Day: Sunday
Time: 1:00 AM local time
Retry: 3 attempts if failure
Timeout: 4 hours

Configure compliance reports

Define how compliance results are reported.

Report settings

To configure reports:

Report content options

Distribute reports

To configure report distribution:

Run compliance plans

Manual execution

To run a compliance plan immediately:

Scheduled execution

Compliance plans run automatically based on their schedule:

• Plan starts at scheduled time
• Compliance checks execute for all scoped items
• Reports generate upon completion
• Distribution occurs based on settings
• Results archive for audit purposes

View compliance plan results

Access plan reports

To view compliance plan results:

Understand report data

Compliance plan reports include:

Summary metrics:

• Total devices checked
• Compliant device count
• Non-compliant device count
• Compliance percentage
• Comparison to previous runs

Detailed results:

• Per-device compliance status
• Configuration differences
• Golden configuration alignment
• Remediation recommendations

Trend data:

• Compliance percentage over time
• Recurring non-compliance issues
• Improvement or degradation trends
• Device-specific compliance history

Manage compliance exceptions

Some devices may have approved deviations from Golden Configurations.

Document exceptions

To add an exception:

Review exceptions

Periodically review documented exceptions:

Best practices

Plan scope strategically:

• Group related Golden Configurations together
• Align plans with audit requirements
• Consider network segmentation
• Balance scope size with execution time

Schedule appropriately:

• Run during maintenance windows
• Avoid peak usage times
• Stagger large plans across time periods
• Consider device impact and load

Manage reports effectively:

• Customize reports for different audiences
• Archive reports for audit requirements
• Automate report distribution
• Set appropriate retention periods

Handle exceptions properly:

• Require approval for all exceptions
• Document business justification
• Set expiration dates for temporary exceptions
• Review exceptions regularly
• Update golden configs when exceptions become standard

Monitor plan health:

• Track plan execution success rates
• Review execution duration trends
• Monitor for recurring failures
• Adjust scope or schedule as needed

Example: Enterprise compliance plan

Plan: Monthly Security Compliance Audit

Scope:

• Golden Config: Firewall Security Policy (all nodes)
• Golden Config: Switch Security Settings (all nodes)
• Golden Config: Router Security Baseline (all nodes)
• Device Group: Production Network
• Device Group: DMZ Devices

Schedule:

• Frequency: Monthly
• Day: First Sunday of each month
• Time: 12:00 AM EST
• Retry: 3 attempts
• Timeout: 6 hours

Reports:

• Format: PDF (executive) + CSV (detailed)
• Content: Summary, device details, diffs, trends
• Distribution:
  • CISO: Executive summary PDF
  • Network team: Detailed CSV
  • Security team: Full PDF report
  • Audit team: Archive all formats

Exceptions:

• Lab devices: Development configurations approved
• Legacy systems: EOL devices with documented risks
• Review cycle: Quarterly

Troubleshoot compliance plans

Plan execution fails

If a compliance plan doesn’t complete:

• Check golden configuration validity
• Verify device connectivity
• Review execution logs for errors
• Confirm adequate execution timeout
• Check for scheduler issues

Reports not generated

If reports don’t appear:

• Verify plan completed successfully
• Check report format configuration
• Review storage capacity
• Confirm report generation settings
• Check for template errors

Distribution fails

If reports don’t reach recipients:

• Verify email addresses
• Check email server configuration
• Review distribution logs
• Confirm integration settings
• Test with manual distribution

Next steps