Bitdefender GravityZone Compliance Manager

Why do you need endpoint compliance management?

The auditor asks for evidence that a control works - not whether it was purchased. Policies say workstations have the firewall on, patches current and unnecessary services disabled; the evidence that this is true today on every one of several hundred machines is usually produced by hand: an export from one console, a spreadsheet from another, screenshots from a third. Again at every review.

Bitdefender GravityZone Compliance Manager is a module of the GravityZone console that assesses the state of technical controls on workstations and servers against a chosen standard - including NIS2, DORA and ISO 27001 - shows which controls fail and on which assets, and generates a report from it. Compliance covers far more than endpoints; this module closes its technical, endpoint part.

How does it work?

Control assessment against a standard

Compliance Manager uses the data the GravityZone agent and the Risk Management module already collect from endpoints: system configuration, protection status, applications and settings. Each standard is broken down into sections and controls; for every control the module checks whether the endpoint meets the required conditions and calculates a score for the whole organization. The score refreshes with each risk scan, so there is no separate inventory to run before a review.

The Compliance page: from score to asset

In the console, under the Risk Management menu, the Compliance page shows the standards that apply to the environment and the degree to which each is met. After selecting a standard you see the list of controls, the section they belong to, their score and the assets they affect; every control has a description of its purpose and requirements and, where the vendor provides them, guidance on how to meet it. The view can be narrowed to the standards and controls relevant to the organization.

Remediation and reporting

Detected gaps that can be closed by changing settings on the GravityZone side are closed from the same page with a single click. A PDF or XLSX report is generated for the selected standard and contains the dashboard data - the same document goes to the internal review and to the auditor.

Key features

Standards

• Basic standard for Windows endpoints available immediately on every licence with access to the module
• Advanced standards: NIS2, DORA, GDPR, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, CIS v8, CMMC 2.0, NIST CSF 2.0, Cyber Essentials and other national benchmarks
• The list of supported standards grows - the current set is visible in the console

Assessment and visibility

• Organization compliance score per standard, recalculated after every risk scan
• List of controls with the standard section, score and affected assets
• Description of each control with requirements and remediation guidance
• Standards outside your licence are marked in the console - you can see what the add-on unlocks

Remediation and evidence

• One-click closing of detected gaps from the Compliance page
• PDF and XLSX reports with full dashboard data for the selected standard
• One console for protection, risk and compliance - no exports between tools

Basic and Premium tiers - what you have and what you buy

Element	Basic (in the licence)	Premium (add-on)
Basic standard: Cyber Hygiene Baseline for Windows	✓	✓
Compliance score and list of controls	✓	✓
Exportable report	✓	✓
Preview of advanced standards	limited	full
Data and reports for NIS2, DORA, ISO 27001, GDPR, SOC 2, PCI DSS, CIS v8	-	✓

If you have Business Security Premium or Enterprise, you already have the Basic tier. The vendor makes Compliance Manager available automatically to every organization whose licence includes the Risk Management module:

• GravityZone Business Security Premium
• GravityZone Business Security Enterprise
• GravityZone EDR cloud
• Bitdefender MDR
• GravityZone Cloud MSP Security

The Premium tier is the Compliance Manager add-on licence (in the vendor’s documentation: “Compliance Manager add-on”), which unlocks the advanced standards. A report named “NIS2” therefore requires the add-on; the Basic tier on its own shows how far from it you are. For managed service providers the add-on sits on top of the core solution regardless of whether the licence is à la carte or bundled.

Scope and limitations

Monitored area: workstations and servers with the GravityZone agent - Compliance Manager does not assess networks, cloud or SaaS applications. Compliance of cloud environments is measured separately by GravityZone CSPM+.

Systems: the basic standard applies to Windows; the scope of the remaining standards per system is defined in the vendor’s documentation.

What it is not: the tool assesses technical controls. It does not assess policies, processes, supplier contracts or training - and the vendor itself states that the module does not guarantee passing an audit and recommends working with an accredited auditor.

Who is it for?

• Essential and important entities under the KSC Act - current evidence of the state of technical controls on endpoints instead of a spreadsheet updated before the review
• Financial institutions under DORA - the same module, a different standard in the filter
• Organizations with ISO 27001 or on the way to certification - Annex A controls concerning endpoints measured automatically
• Premium and Enterprise customers - the Basic tier is already in the console; worth switching on before the add-on decision is made
• Companies using nFlo compliance advisory - the module delivers endpoint data for the gap analysis, and the advisers close the organizational part

How does GravityZone Compliance Manager support NIS2 and the KSC Act?

In the NIS2/KSC Act map, Compliance Manager is the evidence module: it measures whether technical controls on endpoints are met and documents the state - two of the twelve areas of Article 21 of NIS2 and Article 8 of the Polish National Cybersecurity System Act (KSC Act) whose full mapping we describe in our article on how GravityZone supports NIS2 and the KSC Act:

• Risk management and control effectiveness assessment - assessment against the NIS2 standard shows which controls fail and on which endpoints; the report from the Compliance page documents the state on the review date and lets you compare it with the previous one. The tool assesses technical controls; it does not replace an ISMS, formal risk management or an audit.
• Cyber hygiene and attack surface reduction - the basic standard is a cyber hygiene baseline for Windows, and the advanced ones include CIS benchmarks; failed configuration controls are closed from the console, so the list of gaps turns into a list of completed hardening steps.

Which controls matter for your entity and how to translate the console score into ISMS documentation is what we establish in the NIS2 and DORA Compliance service.

Who is in scope, deadlines and penalties are covered in our NIS2 knowledge hub. GravityZone does not replace an ISMS, formal risk management, audits or the organization’s own accountability for NIS2 and KSC Act obligations - it supports their technical side.

Why deploy with nFlo?

• We check whether the Basic tier is already active in your console and switch it on before you decide on the add-on
• We match the standards to the entity’s obligations: NIS2, DORA, ISO 27001 - without paying for benchmarks nobody will read
• We translate the Compliance page score into audit language: which controls are covered technically and which need organizational action
• We combine the module with nFlo compliance advisory so that technical evidence and ISMS documentation say the same thing