Account and security
Compliance records
Account-level checklists for PCI-DSS, HIPAA and CMMC with a status and notes per control, as evidence for auditors and insurers.
Updated · 2 min read
Compliance records are your own answers about your own controls, kept beside the scan evidence that supports them. Nothing here certifies anything; it is a dated, structured record of what you have and what you lack.
Where
- Web: Compliance in the rail. The iOS app opens this page with your session from a domain's Compliance module.
- API/MCP:
GET /api/compliance,POST /api/compliance(initialise the checklist),PUT /api/compliance/:id,PUT /api/compliance/bulk; toolsget_compliance_records,update_compliance_item. Thecompliancescope.
The frameworks
| Framework | Controls |
|---|---|
| PCI DSS v4.0.1 | The twelve principal requirements (unchanged from v4.0): network security controls, secure configurations, protecting stored account data, encryption in transit, anti-malware, secure systems and software, need-to-know access, unique ids and MFA, physical access, logging and monitoring, regular testing, and a security policy |
| HIPAA Security Rule | The administrative, physical and technical safeguards |
| CMMC Level 2 | A selection of 17 practices (Level 2 has 110, from NIST SP 800-171) from nine families: access control, audit and accountability, configuration management, identification and authentication, incident response, media protection, personnel security, risk assessment, and system and communications protection |
Each framework links to its own published source, and the checklist paraphrases each control as a plain requirement with a one-line description.
Statuses
| Status | Meaning |
|---|---|
| Unanswered | Not yet considered |
| Met | In place |
| Partial | In place for some systems or with gaps |
| Not met | A recorded gap, which is different from a blank |
| N/A | Does not apply to this business |
Notes hold your evidence in your own words: the vendor, the policy name, the date. Over MCP the assistant is told to quote your wording rather than paraphrase it.
Records are account-level, one row per control, and saved as you edit (debounced).
How scan evidence helps
Several controls are answered by what DomainGuard already records: encryption in transit (certificate and TLS findings), regular testing (exposure scan history), logging (the audit log), email security (DMARC evidence), vulnerability management (KEV alerts and dismissals with reasons). Cite the scan date in the note.
Common questions
Is cyber-insurance a framework here? The checklists are PCI-DSS, HIPAA and CMMC. Insurance questionnaires map onto them.
Can I have one checklist per client? Records are per account. An agency keeps a separate DomainGuard account per client for separate checklists.
Keep reading
Related articles
- Privacy and data retentionWhat DomainGuard stores, what it hashes or encrypts, how long operational records are kept, what it never reads or changes, and the ads on Free.Account and security ·Updated
- The domain setup guideThe per-domain checklist computed from what is actually set up: first check, alerts, email records, DMARC reports, ownership proof, monitoring and more.Getting started ·Updated
- A tour of the web dashboardWhat each page of nhmohio.com/dashboard shows: Overview, Alerts, Fixes, Domains, Software, Security, SEO, Monitoring, Reports and Compliance, plus Settings and Help.Getting started ·Updated