> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Frameworks & scanning

> The compliance frameworks Security Posture covers — CIS, NIST, ISO 27001, PCI DSS, SOC 2, MITRE ATT&CK, AWS, FedRAMP, and CISA — how findings map to them, and how continuous and on-demand scanning produce them.

import { CardGroup, Card, Note, Steps, Step, Tip } from '@mintlify/components';

Every finding in [Security Posture](/documentation/security-posture/overview) is measured against the standards your organization has to answer to. [Athena](/documentation/multi-agent-system/athena) maps what the scanners find to a set of industry and regulatory frameworks, so a single audit tells you both what's misconfigured *and* which controls it affects.

## Frameworks covered

Security Posture aligns findings to these frameworks:

* **CIS** — the Center for Internet Security benchmarks for hardened configuration.
* **NIST** — the U.S. National Institute of Standards and Technology cybersecurity guidance.
* **ISO 27001** — the international standard for information security management.
* **PCI DSS** — the payment card industry data security standard.
* **SOC 2** — the trust-services criteria for service organizations.
* **MITRE ATT\&CK** — the adversary tactics-and-techniques knowledge base.
* **AWS** — cloud security and well-architected best practices for AWS.
* **FedRAMP** — the U.S. federal cloud security authorization program.
* **CISA** — U.S. Cybersecurity and Infrastructure Security Agency guidance.

These same frameworks form the columns of the **compliance heatmap** on the [Security Posture dashboard](/documentation/security-posture/overview#what-the-dashboard-shows).

## How findings map to frameworks

Each finding is tagged with every framework control it touches. That mapping does two things:

* **The heatmap** rolls findings up per framework, so you can see where you're strong and where you're exposed against, say, PCI DSS versus CIS.
* **The findings table** lets you filter by framework, so you can pull every issue that affects a single standard — useful when you're preparing for a specific audit.

<Tip>
  Use **Analyze** on a finding to have Athena walk through exactly which
  controls it maps to and why. See
  [Remediation & risk acceptance](/documentation/security-posture/remediation#analyze).
</Tip>

## How scanning works

Findings come from two kinds of scan:

<CardGroup cols={2}>
  <Card title="Continuous auditing" icon="arrows-rotate">
    A rolling **24-hour audit** keeps each enabled target's posture current
    without you having to do anything.
  </Card>

  <Card title="On-demand scans" icon="bolt">
    Trigger a **Run scan** at any time from a target's detail view when you
    need a fresh result now.
  </Card>
</CardGroup>

## What gets scanned

Two scanners feed Security Posture, covering both your cloud and your hosts:

<CardGroup cols={2}>
  <Card title="Cloud integrations" icon="cloud">
    A **cloud posture scanner** audits your connected cloud accounts and
    services. See [Integrations](/documentation/integrations/overview).
  </Card>

  <Card title="Host devices" icon="server">
    The **Myrmex agent** runs host-hardening checks on **Windows, Linux, and
    macOS** endpoints.
  </Card>
</CardGroup>

Both feed the same score, heatmap, and findings table, so cloud and host posture live in one view.

## Enabling per-target auditing

Auditing is turned on per target, from that device or integration's own detail view:

<Steps>
  <Step title="Open the target">
    Open a device or integration from the [Directory](/documentation/ai-workspace/overview#the-directory).
  </Step>

  <Step title="Go to its Security Posture tab">
    Each target's detail view has a Security Posture tab.
  </Step>

  <Step title="Enable continuous auditing or run a scan">
    Turn on the continuous 24-hour audit, or trigger an on-demand **Run scan**
    for an immediate result.
  </Step>
</Steps>

<Note>
  Posture scanning is proactive analysis. For active threats, alerts, and
  investigations, see [Detection & Response](/documentation/detection-response/overview);
  for the AI-driven audits you run directly in chat, see
  [AI-driven audits](/documentation/detection-response/audits).
</Note>

## Where to go next

<CardGroup cols={2}>
  <Card title="Security Posture" icon="shield-halved" href="/documentation/security-posture/overview">
    The scored dashboard, KPIs, and findings table.
  </Card>

  <Card title="Remediation & risk acceptance" icon="wrench" href="/documentation/security-posture/remediation">
    Act on the findings a scan produces.
  </Card>
</CardGroup>