ServerMind for Kubernetes/Compliance & Audit

Compliance & Audit

Benchmark results from the scanners you already run, graded NIS2 and CRA evidence packs, and CRA Article 14 artefacts built from stored findings. Every manager action lands in a hash-chained audit log whose daily roots are signed with a key the database does not hold.

NIS2 · CRA

Compliance Benchmarks

Trivy OperatorClusterComplianceReport objects: CIS, NSA and Pod Security Standards baseline and restricted specs. Custom specs are read the same way.
Rancher cis-operatorClusterScan and ClusterScanReport objects, joined by benchmark version.
OpenShift Compliance OperatorComplianceCheckResult objects, grouped per profile.
  • Results read from the benchmark scanners you already run; ServerMind records them, it does not author or run a benchmark
  • Scanner results polled every 5 minutes; a re-poll never duplicates a run
  • Score is pass divided by pass plus fail. Manual controls are never counted as a pass or a fail
  • Every run states which Kubernetes version was graded, and each spec links to its publisher
  • Runs, Benchmarks and Pod security tabs, with the newest 28 runs kept per profile
  • Profiles are per tenant, so two tenants running the same spec never share a row

NIS2 / CRA Evidence Packs

Two Catalogs

NIS2 Article 21(2)(a) to (j) plus Article 23, and CRA controls for vulnerability handling, SBOMs, disclosure, reporting and updates.

Honest Grades

Each control is Covered (records exist now), Attested (enforced by design), Partial, Gap or Not applicable. Readiness is covered plus attested over scored controls.

Sealed Packs

Canonical JSON hashed with SHA-256, and HMAC-signed with the off-database audit key when one is configured. The report footer says plainly whether the pack is signed.

Auditor Report

A self-contained HTML report ready to print to PDF. Packs are append-only, admin-only and record a declared reporting period (90 days by default).

CRA Article 14 Reporting

  • Article 14 deadlines computed from the awareness time you supply: 24-hour early warning, 72-hour notification, and a final report on both the vulnerability and severe-incident tracks
  • Notification artefact built from stored findings (clusters, artefacts, packages), with the clauses only a human can answer listed as explicit gaps
  • CSAF 2.0 VEX document for impacted users, with vendor_fix or none_available remediation from scan data
  • Fleet CVE exposure: which running pods carry the affected image right now, matched by digest or by spec, with unreachable clusters named instead of silently skipped
  • Filing stays manual: you submit the artefacts through the ENISA Single Reporting Platform portal, which offers no API

Audit Trail & Integrity

  • Every manager action recorded in an append-only, hash-chained audit log: who invoked which operation, on which cluster
  • Paged search with readable action labels and resolved actor names; tenant users see only rows for clusters they own
  • Integrity check recomputes daily Merkle roots, verifies their off-database signatures and walks the day chain, over up to 366 days
  • Per-day verdicts of ok, tampered or unsigned, rolled up to intact or tampered
  • Kubernetes API server audit log streamed from each cluster for admins

GDPR User Erasure

  • GDPR Article 17 erasure removes the account with its sessions, API tokens, MFA factors, role assignments and access requests in one transaction
  • Receipt with counts of everything removed
  • Audit rows are kept and shown under a random erased-user pseudonym, with IP address and user agent hidden
  • Erased ids can never be reused, and restoring an older backup does not bring the person back
  • Disabling a user is a separate, reversible action
← Security PostureIdentity & Access →