sha3:89a1e32350db6a4ecdd74b361ed9dbbbf43615b704da51b4c8f57874502b7b1eIntactCISO and ISSO operations / every cloud, every framework
Single pane. Every cloud, every framework.
The Command Center is the view over the record: where CISOs and ISSOs see top-priority findings, the posture strip, and the live activity feed across every cloud and framework. Every item on it is traceable to a hash-chained record, every remediation path runs through the trust mode you set, and every action taken from it lands in proof of agency.
39e95ea5cb80709e7d141b7488a1afbc4aa1e01855970cc294f0758f5bd19edfprev:4ce53981e20cWhat an operator's view must prove
A CISO is asked what the estate's posture is right now and what is being done about the worst of it. An ISSO is asked the same within a boundary. The dashboards they are handed answer with tiles: a percentage with no provenance, a count with no owner, a status with no timestamp. When the assessor or the board asks where a number came from, the tile has nothing behind it.
Triage also has to leave a trail. Who looked at the finding, who approved the fix, what the fix was permitted to do, and what it did are questions about the operator's actions, and they need the same record as the estate.
- cc.audience
- CISOs see the organization; ISSOs see their boundary. Severity thresholds, framework scope, and owner-filtered views are configurable.
- cc.posture
- Overall, critical, policies, issues: each figure on the strip is a projection of records, with the rows behind it one step away.
- cc.findings
- A finding carries severity, framework, environment, days open, owner, and the confidence figure the engine published with its proposal.
- cc.integrations
- Findings export to Splunk or Sentinel as events; tickets open in Jira or ServiceNow; Slack and Teams carry notifications and approvals.
cdeff1264ea4d060c1f259be46d6c87f183555f5dec7046eaf5ca0ec84de49fbprev:39e95ea5cb80The record behind every figure in the view
The Command Center reads the record; it does not replace it. Where each proof files:
- Posture strip
- Proof of state: every figure is a projection of point-in-time records, regenerable to any date, so a percentage has provenance.
- Top-priority findings
- Findings are recorded differences between expected and observed state, ranked by severity and the published confidence figure. Critical first; low confidence to a review queue.
- Remediation paths
- Proof of agency: Fix, View Script, Create Ticket, Notify, Snooze. A fix runs inside an envelope in the trust mode you set; GATED is the default, and the approving human becomes part of the record.
- Activity feed
- Proof of change: every action taken from the view, by a person or a machine, is a chained row with actor, authority, and rollback identifier.
- Frameworks
- CMMC Level 2, NIST 800-171 and 800-53, FedRAMP, SOC 2, PCI DSS, ISO 27001, HIPAA: one control mapping per record.
Exhibit SB-4 · posture, controls satisfied, and the action queue, every figure traceable to a record. Illustrative demo data; the interface is real.
30c5112b63c7699cbd988f8968bf282e1f41beb195ec674d767d216588ea6b5aprev:cdeff1264ea4How a figure in the view is verified
For an operator's view the recomputation answers where a number came from: every figure on the posture strip opens to the rows it was projected from, and those rows recompute.
Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 and carries the digest of the record before it, so each line commits to the entire history above it. The log is append only: a correction is a new record, never an edit. Verification is a recomputation, not an assertion. Run the chain from the first record forward and it returns one of two answers: intact, or the sequence number of the first record that breaks.
A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop. When a collector was down or a scope was unobserved, the chain carries a declared gap with the interval and the reason, never silently fewer rows. Absence is declared, not inferred.
9c7ff63e81530e52cb41cf42a6b41567e796046fd36c7d0b760f316e6210f609prev:30c5112b63c7Access and onboarding for your operators
During agreed read-only onboarding, the view fills from captured records. A CISO sees the organization and an ISSO sees the boundary within their assigned access, with no remediation executing in SHADOW mode.
Request access so we can review your environment, evidence needs, and onboarding scope. After access is approved, read-only onboarding uses SHADOW mode inside your own tenant. Nothing executes. Policy evaluation, evidence collection, and action gating run where your data already is; there is no telemetry pipeline to PolicyCortex servers and no egress of evidence. You hold the records and can recompute the chain yourself.
- eval.mode
- SHADOW. Watch only; nothing executes.
- eval.onboarding
- Access is reviewed. Scope and onboarding are agreed with your team.
- eval.location
- Your tenant. Azure, AWS, and GCP are observed clouds, including AWS GovCloud, Azure Government, and GCC High.
- eval.egress
- None. No telemetry pipeline to PolicyCortex servers; no evidence leaves the tenant.
- eval.after
- You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional.
89a1e32350db6a4ecdd74b361ed9dbbbf43615b704da51b4c8f57874502b7b1eprev:9c7ff63e8153Questions assessors and buyers ask
What is the confidence figure next to a finding?
The engine publishes a confidence figure with each remediation proposal it generates. High-confidence proposals surface first; low-confidence ones go to a review queue before anyone acts. The engine cannot execute; a person or the envelope does.
How does the posture strip update?
As captures land. Findings, control coverage, and policy results update when a capture or a change is recorded; each figure is a projection of rows you can open.
Can we customize what is surfaced?
Yes. Severity thresholds, framework scoping, and owner-filtered views are configurable. CISOs see organization-wide; ISSOs see their boundary.
Does it integrate with our SOC tooling?
Yes. Findings export to Splunk or Sentinel as events. Tickets can be created in Jira or ServiceNow. Slack and Teams carry notifications on critical findings and the approvals that become part of the record.
Does PolicyCortex make us compliant?
No. It produces the records compliance decisions rest on. The authorizing official, the C3PAO, or the accountable official makes the determination; PolicyCortex hands them evidence they can recompute instead of a narrative they have to believe.
Where does the data live?
In your own tenant. There is no telemetry pipeline to PolicyCortex servers and no egress of evidence.
One view. Every figure with a record behind it.