Compliance Operations
Compliance Operations is your continuous-compliance calendar: the recurring tasks that keep your CUI environment compliant between assessments rather than only at certification time. Each task is scheduled on a cadence (weekly, monthly, quarterly, annually, and more), assigned to an owner, and completed with a short guided checklist. Completing a task automatically produces a dated attestation — a piece of evidence linked to the NIST SP 800-171 objectives that task satisfies.
CMMC and NIST SP 800-171 expect security practices to be operated, not just documented once. A control like audit-log review or user-access review is only real if it happens on a schedule and you can show it happened. This module is where that operating record lives, and its output feeds your evidence library, your compliance posture, and the AI connector.
/dashboard/compliance-ops). It's visible to every role that can read compliance data; completing tasks and changing the schedule require additional permissions — see Permissions.Key concepts
Task tiers
Every task in the catalog belongs to one of three tiers, which tells you how it's expected to be operated.
| Tier | Meaning |
|---|---|
| Required | Directly backs a required NIST practice — expected for every organization it applies to |
| Recommended | Strengthens your posture and evidence, but is not strictly mandated |
| Event-driven | Doesn't run on a clock — you log it when the triggering event happens (e.g. an employee termination, a security incident) |
Cadence
A cadence is how often a task recurs. Cadences are calendar-fenced, not "every N days" — quarterly means the next quarter boundary, monthly means the end of next month — so schedules never drift and line up with how assessors think about review periods.
| Cadence | Recurs |
|---|---|
| Weekly | Each week |
| Monthly | End of each month |
| Quarterly | End of each quarter |
| Annual | End of each year |
| Triennial / Quinquennial | Every 3 or 5 years |
| Custom | A pattern you define — e.g. every 3 weeks — when none of the presets fit |
| Event-driven | No recurrence; logged on demand when the event occurs |
Task status
Each scheduled occurrence of a task moves through a status. Some statuses are derived automatically from the due date and the clock — you never set "due soon" or "overdue" by hand.
| Status | Meaning |
|---|---|
| Upcoming | Scheduled, more than a week out |
| Due soon | Within a week of its due date |
| Overdue | Past its due date and not yet completed |
| Completed | Finished, with evidence generated |
| Skipped | Consciously skipped for this period, with a reason recorded |
Using the module
Compliance Operations has three tabs: Calendar (your scheduled tasks and their status), Manage Tasks & Cadences (which tasks are on, how often, and who owns them), and Log an Event (record an event-driven task when it happens).
First-run setup
The very first time you open the module, a short setup wizard proposes a starting set of tasks tailored to your environment.
Review the suggested tasks
The wizard pre-selects the tasks that apply to your environment (cloud, hybrid, on-prem, and so on), based on the systems you've told us about. Required-tier tasks are pre-selected for you.
Adjust the selection
Toggle individual tasks on or off, and — where you want to — override the recommended cadence or pick an owner for a task.
Finish setup
The module schedules the first occurrence of every enabled task on its next calendar boundary. Your calendar is now live.
Complete a recurring task
Open the task
From the Calendar tab, open the task you want to complete. Each task shows why it matters, the NIST objectives it satisfies, and the systems in scope.
Fill in the checklist
Work through the task's completion form — a short guided checklist tailored to that task. Depending on the task this may include yes/no confirmations, counts, a per-system checklist, or an itemized list of findings (for example, each inactive account you removed).
Record findings and notes
Set an overall findings level — None, Minor, or Major — and add any notes. The module assembles a plain-language attestation narrative from your answers, which you can edit before submitting.
Submit
The task is marked Completed, an attestation record is generated automatically (see How it works), and the next occurrence is scheduled at the following cadence boundary.
Log an event-driven task
Some tasks don't run on a clock — they happen in response to an event. When an employee is terminated, a security incident occurs, or a policy is revised, open the Log an Event tab, pick the matching task, and complete its checklist the same way. Each logged event produces its own dated evidence record.
Skip a task for this period
If a task genuinely doesn't apply in a given period, you can skip that occurrence and record a reason. Skipping is documented — it's part of your operating record — and the task still recurs on schedule for the next period.
Change cadence, owner, or scope
From Manage Tasks & Cadences you can turn any task on or off, change how often it recurs, assign an owner, and scope it to specific systems. You can also create your own custom task when your program requires something beyond the built-in catalog.
Permissions
Access is governed by three permissions in the role matrix.
| Capability | Permission |
|---|---|
| View the calendar, task history, and evidence | VIEW_COMPLIANCE_OPS |
| Complete a task, log an event, skip an occurrence | COMPLETE_COMPLIANCE_TASKS |
| Enable/disable tasks, set cadence, assign owners, create custom tasks | MANAGE_COMPLIANCE_OPS |
VIEW_COMPLIANCE_OPS is held by every non-platform role, including Assessor (read-only). COMPLETE_COMPLIANCE_TASKS is held by Org Admin, Org User, MSP Super, and MSP Admin. MANAGE_COMPLIANCE_OPS — configuring the program — is held by Org Admin, MSP Super, and MSP Admin, but not Org User.
How it works
Extra detail on what the module produces and how it behaves — product behavior, not internals.
What a completed task holds
Every completed occurrence is a permanent record.
The attestation artifact
For most tasks, completing the checklist automatically generates a formatted attestation document and files it in your evidence library — no separate upload step. The attestation captures who reviewed what, over which period, across which systems, with the overall finding, and is linked to the exact NIST objectives the task backs. Where a task expects you to attach your own artifact (for example, an exported scan report), you can supply that file instead and it becomes the evidence.
Because these attestations are linked to objectives, completing your recurring tasks steadily fills in your evidence coverage — the same coverage that drives your assessment completeness and SPRS view.
The rolling completion rate
The module tracks a 90-day completion rate: of the task occurrences that came due in the last 90 days, what share were completed. It's a rolling health signal for whether your program is actually being operated, not just configured — a falling rate is an early warning that tasks are slipping. The dashboard also surfaces how many tasks are due this month, how many are overdue, and how many you've completed this month.
Task history
Every task keeps a full history: each past occurrence, its checklist answers, its finding, who completed it, and a link to download that period's attestation. This is your audit trail — when an assessor asks "show me that you've been reviewing audit logs every week," the history is the answer.
How tasks map to NIST objectives
Each task in the catalog is mapped to the specific NIST SP 800-171 objectives it satisfies. Some tasks also reference an organization-defined parameter for a control (for example, how frequently a review must occur) and show both the DoD default and the value your organization has set. When you complete a task, its attestation is linked to those objectives across your active assessments, so operating the task and satisfying the control stay in sync.
AI assistant access
When the AI Connector is enabled, assistants can read (never change) your compliance-operations data through two tools:
get_compliance_ops_overview— active, overdue, and upcoming tasks, the 90-day completion rate, and each task's NIST objectives.get_compliance_ops_history— the completion history for a single task.
Access follows the same permissions as the app: an assistant only ever sees what the connected user's role is allowed to see.