Account and security
Compliance records
Account-level checklists for PCI-DSS, HIPAA and CMMC with a status and notes per control, plus incident and WISP records, as evidence for auditors and insurers.
Updated · 2 min read
Compliance records are your own answers about your own controls, kept beside the scan evidence that supports them. Nothing here certifies anything; it is a dated, structured record of what you have and what you lack.
Where
- Web: Dashboard, Compliance. The iOS app opens this page with your session from a domain's Compliance module.
- API/MCP:
GET /api/compliance,POST /api/compliance(initialise the checklist),PUT /api/compliance/:id,PUT /api/compliance/bulk; toolsget_compliance_records,update_compliance_item. Thecompliancescope.
The frameworks
| Framework | Controls |
|---|---|
| PCI-DSS v4.0 | The twelve requirements: network security controls, secure configurations, protecting stored account data, encryption in transit, anti-malware, secure systems and software, need-to-know access, unique ids and MFA, physical access, logging and monitoring, regular testing, and a security policy |
| HIPAA Security Rule | The administrative, physical and technical safeguards |
| CMMC 2.0 Level 2 | The practice families: access control, awareness, audit, configuration management, identification, incident response, maintenance, media, personnel, physical, risk, assessment, communications, integrity |
Each control links to the framework's own published text, and the checklist is written as plain requirements with a one-line description.
Statuses
| Status | Meaning |
|---|---|
| Unanswered | Not yet considered |
| Met | In place |
| Partial | In place for some systems or with gaps |
| Not met | A recorded gap, which is different from a blank |
| N/A | Does not apply to this business |
Notes hold your evidence in your own words: the vendor, the policy name, the date. Over MCP the assistant is told to quote your wording rather than paraphrase it.
Records are account-level, one row per control, and saved as you edit (debounced).
Incident and WISP records
GET/POST/DELETE /api/incident-wisp (tool create_incident_record) records an incident: its type, title, severity and summary, the playbook steps taken, and the Written Information Security Program text produced for it. Together with the compliance checklist they are the two documents a cyber-insurance questionnaire asks for.
How scan evidence helps
Several controls are answered by what DomainGuard already records: encryption in transit (certificate and TLS findings), regular testing (exposure scan history), logging (the audit log), email security (DMARC evidence), vulnerability management (KEV alerts and dismissals with reasons). Cite the scan date in the note.
Common questions
Is cyber-insurance a framework here? The checklists are PCI-DSS, HIPAA and CMMC. Insurance questionnaires map onto them; the incident and WISP records cover the rest of what insurers ask.
Can I have one checklist per client? Records are per account. An agency keeps a separate DomainGuard account per client for separate checklists.
Keep reading
Related articles
- Privacy and data retentionWhat DomainGuard stores, what it hashes or encrypts, how long operational records are kept, what it never reads or changes, and the ads on Free.Account and security ·Updated
- The domain setup guideThe per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.Getting started ·Updated
- A tour of the web dashboardWhat each section of nhmohio.com/dashboard shows: Overview, Domains, Fixes, Security, SEO, Monitor, Reports and Compliance.Getting started ·Updated