How compliance statuses are decided

Some controls are assessed automatically: from each connection's latest audit (Microsoft 365, AWS, GCP and others), the site appliance, backup monitoring, the vulnerability scanner and other Graften tools. Each of these is a source, and each keeps its own verdict for the control.

When several sources measure a control

The worst measured result applies, and the note names every source that measured it with the date of its own evidence. A source that couldn't measure the control never overrides one that did. EDR controls are the exception: they take the newest EDR reading.

If no source measured the control, it is not assessed, never passed. When a connection is disabled or removed, its verdicts stop counting; if nothing else measures the control, a status Graften set goes back to not assessed.

Your own verdicts

A status you set on a control stays, and Graften's measurement is shown under it. One exception: if a source measures a failure (gap) and your status is better, the measured gap applies, and the note keeps your status and evidence. Your status applies again once nothing measured is failing. A partial result never overrides you — automated evidence is often capped at partial because it covers only part of a control. Not applicable always stands.

To hand a control back to automation, set it to not assessed.

Patching (Essential Eight E8-1, E8-2 and ISO 27001 A.8.8)

Whenever endpoint patch data arrives (AWS Systems Manager, your RMM or the on-prem agent), Graften counts the registered endpoints that report no missing patches. An endpoint that could not report its patch state is left out and named, never counted as patched or unpatched. Intune is not a patch source: its compliance state does not say whether updates are installed. Below 85% is a gap; otherwise these controls are partial at most. Devices not seen for 30 days count as not patched. E8-1 and E8-2 show the same figure, because the data doesn't say whether a missing patch is for an application or the operating system, and neither shows whether patches were applied within ASD's timeframes. On A.8.8 the vulnerability scanner counts too, and the worst result applies.