CISO and ISSO operations / every cloud, every framework
Single pane. Every cloud, every framework.
The Command Center is the view over the record: where CISOs and ISSOs see top-priority findings, the posture strip, and the live activity feed across every cloud and framework. Every item on it is traceable to a hash-chained record, every remediation path runs through the trust mode you set, and every action taken from it lands in proof of agency.
What an operator's view must prove
A CISO is asked what the estate's posture is right now and what is being done about the worst of it. An ISSO is asked the same within a boundary. The dashboards they are handed answer with tiles: a percentage with no provenance, a count with no owner, a status with no timestamp. When the assessor or the board asks where a number came from, the tile has nothing behind it.
Triage also has to leave a trail. Who looked at the finding, who approved the fix, what the fix was permitted to do, and what it did are questions about the operator's actions, and they need the same record as the estate.
- cc.audience
- CISOs see the organization; ISSOs see their boundary. Severity thresholds, framework scope, and owner-filtered views are configurable.
- cc.posture
- Overall, critical, policies, issues: each figure on the strip is a projection of records, with the rows behind it one step away.
- cc.findings
- A finding carries severity, framework, environment, days open, owner, and the confidence figure the engine published with its proposal.
- cc.integrations
- Findings export to Splunk or Sentinel as events; tickets open in Jira or ServiceNow; Slack and Teams carry notifications and approvals.
The record behind every figure in the view
The Command Center reads the record; it does not replace it. Where each proof files:
- Posture strip
- Proof of state: every figure is a projection of point-in-time records, regenerable to any date, so a percentage has provenance.
- Top-priority findings
- Findings are recorded differences between expected and observed state, ranked by severity and the published confidence figure. Critical first; low confidence to a review queue.
- Remediation paths
- Proof of agency: Fix, View Script, Create Ticket, Notify, Snooze. A fix runs inside an envelope in the trust mode you set; GATED is the default, and the approving human becomes part of the record.
- Activity feed
- Proof of change: every action taken from the view, by a person or a machine, is a chained row with actor, authority, and rollback identifier.
- Frameworks
- CMMC Level 2, NIST 800-171 and 800-53, FedRAMP, SOC 2, PCI DSS, ISO 27001, HIPAA: one control mapping per record.
How a figure in the view is verified
For an operator's view the recomputation answers where a number came from: every figure on the posture strip opens to the rows it was projected from, and those rows recompute.
Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 in an append-only chain with declared gaps for any unobserved interval, so any second party can recompute the log independently without our API.
Access and onboarding for your operators
During agreed read-only onboarding, the view fills from captured records. A CISO sees the organization and an ISSO sees the boundary within their assigned access, with no remediation executing in SHADOW mode.
- eval.mode
- SHADOW. Watch only; nothing executes.
- eval.onboarding
- Access is reviewed. Scope and onboarding are agreed with your team.
- eval.location
- Your tenant. Azure, AWS, and GCP are observed clouds, including AWS GovCloud, Azure Government, and GCC High.
- eval.egress
- None. No telemetry pipeline to PolicyCortex servers; no evidence leaves the tenant.
- eval.after
- You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional.
Questions assessors and buyers ask
What is the confidence figure next to a finding?
The engine publishes a confidence figure with each remediation proposal it generates. High-confidence proposals surface first; low-confidence ones go to a review queue before anyone acts. The engine cannot execute; a person or the envelope does.
How does the posture strip update?
As captures land. Findings, control coverage, and policy results update when a capture or a change is recorded; each figure is a projection of rows you can open.
Can we customize what is surfaced?
Yes. Severity thresholds, framework scoping, and owner-filtered views are configurable. CISOs see organization-wide; ISSOs see their boundary.
Does it integrate with our SOC tooling?
Yes. Findings export to Splunk or Sentinel as events. Tickets can be created in Jira or ServiceNow. Slack and Teams carry notifications on critical findings and the approvals that become part of the record.
Does PolicyCortex make us compliant?
No. It produces the records compliance decisions rest on. The authorizing official, the C3PAO, or the accountable official makes the determination; PolicyCortex hands them evidence they can recompute instead of a narrative they have to believe.
Where does the data live?
In your own tenant. There is no telemetry pipeline to PolicyCortex servers and no egress of evidence.
One view. Every figure with a record behind it.