Compliance is a moment. Assurance is a record.
AssurIQ evaluates reusable technical and administrative controls against real evidence, scores how much that evidence can be trusted, and keeps re-checking — so the answer to “are we still protected?” is always current and always backed by history.
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
AIQ-VND-002 Service providers assessed on schedule | Exception | 70 | Approved exception · expires in 41d |
AIQ-PCI-007 Cardholder data environment scoped | N/A | 100 | Scoping decision · documented |
Six states, because missing evidence is not the same as failure.
Most tools have red and green. AssurIQ distinguishes a failed safeguard from one it simply cannot see yet, and an approved exception from an unapproved gap. The difference is exactly what an assessor asks about.
The control is in place and current evidence proves it.
The control is in place for some of its scope — e.g. 38 of 41 endpoints.
Evidence shows the safeguard is not in place.
No current evidence either way. Not a failure — a proof that has not been collected yet.
Out of scope for this environment, with the scoping decision recorded.
A documented, approved, time-limited deviation with compensating measures.
Not all evidence is equal. Confidence says how much to trust the result.
A screenshot from six months ago and a collector check from forty minutes ago can both say “MFA enforced.” They should not carry the same weight. Assurance confidence is computed per control result and rolls up into the Assurance score — separately from Security Risk and Operational Health.
- Source — collector observation, API connector, manual upload, attestation
- Freshness — how recently the evidence was produced
- Coverage — how much of the control's scope the evidence covers
- Corroboration — whether independent sources agree
Evidence history is append-only. Change is shown, not hidden.
When a collector rediscovers a fact, AssurIQ updates the current state and preserves the previous one. A control that dipped to PARTIAL for three weeks and returned to PASS tells a truthful story — and shows the remediation that fixed it.
- Prior evidence is never overwritten by new discovery
- State transitions are timestamped with the evidence that caused them
- Assessors can see the PARTIAL period and what closed it
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
Continuous, not annual.
Universal controls
Automated re-verification
Confidence-weighted scoring
Exceptions with expiry
Point-in-time snapshots
Separate from risk
Different audiences, same evidence base.
Run assurance across the portfolio, spot evidence gaps early, and prepare customers for assessments without a scramble.
A clear Assurance score, what changed, and what is still open — without needing to read a scanner report.
Scoped, time-limited, read-only access to controls, states, confidence and the underlying evidence.
- Universal controls with original AssurIQ summaries
- Framework packs mapped, versioned and extensible
- Evidence provenance on every record
- Auditor access that expires
AssurIQ provides continuous assurance, readiness, evidence, risk and remediation support. It does not certify an organization as compliant, a passing dashboard is not a legal determination, and AssurIQ does not make breach-notification decisions. Framework mappings use original AssurIQ summaries, not reproduced standard text.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.