Skip to content

Commit aa6890e

Browse files
hardbytehardbyte
committed
docs: add compliance-reporting product page, link docs to netchecks site
Add a product/landing page for netchecks-compliance at /docs/compliance-reporting with pricing, frameworks, and quick start. Link from annotations and architecture docs to docs site pages instead of private GitHub repo.
1 parent baf13c4 commit aa6890e

4 files changed

Lines changed: 94 additions & 3 deletions

File tree

‎docs/src/components/Layout.jsx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ const navigation = [
2929
{title: 'Custom Validation Rules', href: '/docs/custom-validation-rules'},
3030
{title: 'External Data', href: '/docs/external-data'},
3131
{title: 'Alerting', href: '/docs/alerting'},
32+
{title: 'Compliance Reporting', href: '/docs/compliance-reporting'},
3233
{title: 'Compliance Annotations', href: '/docs/compliance-annotations'},
3334
],
3435
},

‎docs/src/pages/docs/architecture-guide.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ provide a convenient way to expose metrics, view the results, and generate notif
2727
## Compliance Reporting
2828

2929
For organizations that need to map active network test results to compliance framework controls,
30-
the **netchecks-compliance** add-on reads
30+
the [netchecks-compliance](/docs/compliance-reporting) add-on reads
3131
`PolicyReport` results and `NetworkAssertion` annotations to generate audit-ready compliance
3232
reports (PDF/HTML/JSON) for frameworks including PCI-DSS v4.0, SOC 2, and CIS Kubernetes Benchmark.
3333

‎docs/src/pages/docs/compliance-annotations.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ description: Annotate NetworkAssertions with compliance framework control IDs fo
77

88
Netchecks supports compliance annotations on `NetworkAssertion` resources. These annotations map
99
your active network tests to specific compliance framework controls, enabling automated generation
10-
of audit-ready compliance reports via the **netchecks-compliance** add-on.
10+
of audit-ready compliance reports via [netchecks-compliance](/docs/compliance-reporting).
1111

1212
## Supported Annotations
1313

@@ -76,7 +76,7 @@ Multiple NetworkAssertions can map to the same control — all results are aggre
7676

7777
## Generating Reports
7878

79-
Install the **netchecks-compliance** CLI:
79+
Install the [netchecks-compliance](/docs/compliance-reporting) CLI:
8080

8181
```bash
8282
pip install netchecks-compliance

‎docs/src/pages/docs/compliance-reporting.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
title: Compliance Reporting
3+
description: Generate audit-ready compliance reports from netchecks test results.
4+
---
5+
6+
# Compliance Reporting
7+
8+
**netchecks-compliance** is a paid add-on that takes netchecks `PolicyReport` results and produces
9+
compliance reports mapped to specific framework controls. The output is evidence an auditor can
10+
directly reference in a SOC 2 Type 2 report or PCI-DSS ROC.
11+
12+
## The Problem
13+
14+
Organizations running Kubernetes need to prove their network security controls actually work — not
15+
just that policies exist. Every KSPM tool checks whether `NetworkPolicy` objects exist and are
16+
correctly configured. None of them verify that traffic is actually blocked in practice.
17+
18+
Netchecks fills the testing gap — it actively sends traffic and validates results. **netchecks-compliance**
19+
bridges those test results to auditor-ready compliance evidence.
20+
21+
## Supported Frameworks
22+
23+
| Framework | Key Controls | Tier |
24+
|---|---|---|
25+
| **CIS Kubernetes Benchmark** | 5.3.1, 5.3.2 | Community (Free) |
26+
| **PCI-DSS v4.0** | 1.2.1, 1.3.2, 11.3.4, 11.3.4.1 | Pro |
27+
| **SOC 2 Type II** | CC6.6, CC6.7, CC7.1 | Pro |
28+
29+
## Output Formats
30+
31+
| Format | Use Case |
32+
|---|---|
33+
| **PDF** | Hand to auditor. Print-ready. Primary deliverable. |
34+
| **HTML** | Self-contained single-file. View in browser. Share internally. |
35+
| **JSON** | GRC platform integration (Vanta, Drata, Secureframe). |
36+
37+
## How It Works
38+
39+
1. **Annotate** your `NetworkAssertion` resources with [compliance annotations](/docs/compliance-annotations)
40+
to map tests to compliance framework controls.
41+
2. The netchecks operator runs the tests as usual, producing `PolicyReport` resources.
42+
3. **netchecks-compliance** reads both the `NetworkAssertion` annotations and `PolicyReport` results,
43+
maps them to framework controls, and generates a compliance report.
44+
45+
Reports include:
46+
- **Executive summary** — overall compliance posture (X/Y controls passing), critical findings
47+
- **Per-control detail** — control ID, description, status (PASS/FAIL/NOT_ASSESSED), evidence count,
48+
last tested timestamp, mapped NetworkAssertions, finding details
49+
- **Attestation footer** — tool version, SHA-256 integrity hash, automation statement
50+
51+
## Quick Start
52+
53+
```bash
54+
pip install netchecks-compliance
55+
56+
# Free CIS report (no license required)
57+
netchecks-compliance report \
58+
--framework cis-k8s \
59+
--format pdf \
60+
--output cis-report.pdf
61+
62+
# PCI-DSS report (requires Pro license)
63+
netchecks-compliance report \
64+
--framework pci-dss-v4 \
65+
--namespace payments \
66+
--format pdf \
67+
--output pci-report.pdf \
68+
--license license.jwt \
69+
--organization "Acme Corp" \
70+
--environment "Production"
71+
72+
# List available frameworks and controls
73+
netchecks-compliance frameworks
74+
```
75+
76+
## Pricing
77+
78+
| Tier | What's Included |
79+
|---|---|
80+
| **Community (Free)** | CIS Kubernetes Benchmark reports. JSON output. CLI generation. |
81+
| **Pro ($500/cluster/month)** | All frameworks. PDF + HTML + JSON. Up to 5 clusters. |
82+
| **Enterprise (custom)** | Unlimited clusters. Custom frameworks. OSCAL output. |
83+
84+
Contact [brian@hardbyte.nz](mailto:brian@hardbyte.nz) for Pro and Enterprise licenses.
85+
86+
## Next Steps
87+
88+
- [Compliance Annotations](/docs/compliance-annotations) — how to annotate your NetworkAssertions
89+
- [Example manifests](https://github.com/hardbyte/netchecks/tree/main/operator/examples/compliance) — PCI-DSS, SOC 2, and CIS example NetworkAssertions
90+
- [Architecture Guide](/docs/architecture-guide) — how netchecks works end-to-end

0 commit comments

Comments
 (0)