Signed decisions
Approving a device, or marking it not approved, is a decision signed with your name and an authenticator code, and recorded in the audit log.
Decide · Weekly review
Once a week, every change decided and signed.
A Reviewer decides every device that changed and signs the week with one code. The sign-off records coverage, who signed and the roles they held.
The problem
Examiners expect a periodic, documented review of unauthorized devices, not decisions scattered across months of ad hoc clicks.
What you see
The review shows only what changed this week, each with a suggested decision and the reason for it. Choose for each device. Nothing is saved until you sign.
If the appliance was not monitoring the whole week, you acknowledge the gap before you can sign. Signed reviews move the related control to Met only when the evidence is there.
Shown in the new interface, which is in development.
A real screen from a test appliance that started 20 minutes earlier. Coverage reads 16.6% because the days before it count as not monitored, not as clean, and the week cannot be signed until someone acknowledges the gap. Signed once for the week, then recorded. Status changes only when the evidence is there.
How it works
- The review has a content hash covering exactly what was shown. If anything changed before you sign, it is refused and shown again.
- Every item needs a decision. Fill in suggestions preselects each suggested choice, but signs nothing.
- A device an impersonation alert holds cannot be approved in the week’s batch. The refusal names it and keeps your other choices.
- When one person holds both Admin and Reviewer, the sign-off says so, and so does every pack.
- After signing, a checkpoint is signed and sent to any off-box log copies you have set up.
What it proves
reviews.json in every pack lists each sign-off with the reviewer, how they signed in, their roles, the content hash and the period. The verifier checks each row against its log entry.
What it records
Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.
- review_signedThe week, a content hash, the decision entries, counts approved, refused and muted, coverage, whether the gap was acknowledged, the reviewer and their roles.
- decisionOne per device decided in the review.
Limits
What it does not do yet, stated plainly. The technical page lists every known gap.
- Weekly only on the current release. Two-weekly and monthly schedules are built in the new interface, which is in development.
- An after-hours section, asking for each closed-branch trip to be acknowledged, is planned.
Technical detail
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.