Evidence for every contractor login.
Each check writes a timestamped record showing the user, the device, the controls evaluated, and the result. The records export on request.
Key facts
- Every PosturePass check writes a timestamped record of the user, device, controls evaluated, and the result.
- Records export on demand, filterable by contractor group, security control, date range, remediation status, or exception.
- Evidence maps to ISO 27001 (A.8.1, A.9.4), NYDFS Part 500 (§500.7, §500.12, §500.14), NAIC Model Law 668, CIS Controls v8, and CMMC AC.L2 / IA.L2.
- Failed checks and the time-to-remediate are logged alongside passes, providing continuous-monitoring evidence rather than a point-in-time snapshot.
- Reports are designed to answer the four questions auditors ask about third-party device controls: what controls, proof they ran, what happens on failure, and evidence for a given date range.
The gap between written policy and enforced policy.
What auditors actually ask
Show me the controls you apply to third-party devices.
Show me proof those controls were active at the time of access.
Show me what happens when a device fails, and whether it was fixed.
Show me this evidence for a specific date range.
A policy document and a walk-through tell auditors what should happen.
An exportable log of checks, failures, and fixes tells them what did happen.
Where the gap usually sits
Most contractor programs have written policies. What they lack is a timestamped record showing those policies ran at the moment of access.
Report views
Filter by partner, control, time period, remediation, or exception.
By contractor group
Filter by partner, vendor, or team to show posture across a relationship.
By security control
Review encryption, antivirus, firewall, or OS compliance across devices.
By time period
Pull evidence for any audit window. Q4 2025, last 90 days, custom range.
By remediation
See what failed, how fast it got fixed, and whether the user resolved it.
By exception
Find contractors with open gaps. Track outstanding issues.
Mapped to the frameworks your auditors use
Exporting an audit pack
Within the first hour
- Pull the report for the audit period. Export by group, control, or date. Send it.
Within the first day
- Answer follow-ups with drill-down reports, remediation timelines, and continuous-monitoring proof.
Within the first week
- Provide trend data, document exceptions, and show how issues were handled.
Want to see the verification flow?
How it works