Skip to content

Compliance & Hardening

Compliance & Hardening reporting maps PegaProx node-hardening checks to external frameworks as audit evidence - it is a reporting aid, not a certification.

Framework mapping

Node-hardening checks are cross-referenced against:

  • CMMC L1 / L2 (NIST SP 800-171)
  • DISA STIG
  • BSI IT-Grundschutz
  • ISO 27001
  • NIS2
  • SOC 2
  • VS-NfD

Each mapped control links back to the concrete CIS hardening check that provides the evidence, so an auditor can trace a framework requirement down to the check result on a specific node.

Not certified

PegaProx is not FIPS / STIG / CMMC-certified. The mapping supports audit preparation only - it does not make a node compliant on its own.

CVE scanning

Per-node vulnerability scanning is driven by debsecan against the Debian security tracker. Results are grouped by severity (Critical / High / Medium / Low), with each CVE linking to its advisory and fix information.

Hardening apply / rollback

Automatable CIS controls can be applied per node with one click, and rolled back if a change causes trouble. Runs are profile-scoped (cis-l1 / cis-l2 and framework profiles such as vs-nfd).

A node's hardening state is node-wide, so from 1.3 users limited to pools or single guests can neither apply it nor read it.

French frameworks (Diffusion Restreinte, RGS)

Two French compliance frameworks are supported:

  • Diffusion Restreinte (II 901)
  • RGS (Référentiel Général de Sécurité)

Both map to the ANSSI-BP-028 control set - real R-numbers and French titles - providing a 25-control hardening scope.

Not certified

As with every other framework in PegaProx, these are audit-evidence / audit-preparation tooling only. PegaProx is not certified against Diffusion Restreinte or RGS.

API

Method Endpoint Description
POST /api/clusters/<id>/reports/cve-scan Run a CVE scan across the cluster's nodes
GET /api/compliance/mapping Framework-to-control mapping
GET /api/security/compliance Compliance posture summary
GET POST /api/clusters/<id>/nodes/<node>/hardening Read status / apply hardening
POST /api/clusters/<id>/nodes/<node>/hardening/rollback Roll back a hardening run