Automatic Compliance Checks

Test your controls against live data Lavawall already collects, see exactly which accounts or devices fail, and keep a dated history an auditor can rely on.

Open Automatic Compliance Checks in your console

Where to find it
Compliance › Automatic Checks (from the compliance section's own navigation or the console search)
Who can use it
Anyone with a GRC role that can view compliance data; running checks and asking for exceptions needs edit rights; approving exceptions needs an approver
For
Everyone
Plan
GRC Compliance Platform (included in Complete). See pricing
Feature
GRC & compliance automation for over 85 frameworks

What the page is for

Automatic Compliance Checks is a page in the Lavawall® console, in the Compliance (GRC) area. Lavawall is the RMM, security, and compliance platform from ThreeShield, built and hosted in Canada. About this feature.

A control answered on a questionnaire is a claim. A control tested against live data, with the failing items listed, is evidence. Each automatic check asks one question, such as whether every account has a second factor, and answers it from data the console already gathers: Microsoft 365 and Entra, Google Workspace, Intune, the Lavawall agent on each computer, connected security tools such as Sophos and Huntress, vulnerability scans and the domain scanner. Nothing new is collected.

Each check shows its status, the controls it provides evidence for, its health over the last 30 and 90 days, and when it last ran. When a check fails you can see the failing items (a user name, a device name, a domain) and, where the failure is acceptable, ask for a time-limited exception. Exceptions only take effect once a second person approves them.

Checks also run on a schedule and record a daily history, so you can show that a control passed consistently, not just today.

What you see

The Automatic Compliance Checks page, with the run all checks, summary tiles, check health, "three things are not a pass" notice, and checks table numbered 1 to 5.
The Automatic Compliance Checks page. Numbers match the list below (1 to 5 are in this picture). Names and data are examples. Number 3 marks the Health column; the Check health summary appears once checks have a few days of history.
  1. Run all checks: runs every check now.
  2. Summary tiles: Passing, Failing, No data or unavailable, and Never run (with how many are not used here).
  3. Check health: the share of check-days passed in the last 30 days, how many checks have history, and how many are failing on their latest day.
  4. "Three things are not a pass" notice: explains No data, Not available and Not used here.
  5. Checks table: Status, Check (title, question and latest summary), Evidences (the controls it maps to), Health, Last run and Actions (failing items, history, run).
  6. Checks that do not apply here: a collapsible list of checks for products the company does not use.
  7. Exceptions: Check, Subject, Reason, Expires and Status, with Approve, Reject and Remove.

How to use Automatic Compliance Checks

How to run the checks

  1. Select Run all checks, or the play button on one check's row.
  2. Wait for the message to finish; the table and tiles update.

How to see what failed

  1. On a failing check, select the red button showing the number of failing items.
  2. The list shows each failing account, device or domain. Devices link to their device page.

How to see a check's history

  1. Select the history button on the row.
  2. A strip of coloured blocks shows each run, oldest on the left, with a line such as "58 of the last 60 runs passed".

How to ask for an exception

  1. Open the failing items and select Ask to accept next to the item.
  2. Enter why it is accepted and an end date (at most two years).
  3. Select Send for approval. It does not change the result until an approver accepts it.

How to approve or reject an exception

  1. In Exceptions, select Approve (tick) or Reject (cross) on a request marked Waiting for approval.
  2. Add a note (required when rejecting) and confirm.

AI security checks

These checks show how AI is used and exposed across your organization. They provide evidence for the AI controls that ISO/IEC 27090, ISO/IEC 42001, the OWASP Top 10 for LLM Applications, and the other AI frameworks share. Each one fails when:

  • AI apps that are not approved: an AI app is in use, found through SaaS discovery or connected to Microsoft 365 or Google Workspace, and it is not on your organization's approved list.
  • AI apps with access to mail or files: an AI app that is not approved can read mail, files, or your directory in Microsoft 365 or Google Workspace.
  • AI agent activity from untrusted locations: Microsoft 365 reported AI agent activity, or AI agents reaching your data, from an untrusted location, and nobody has reviewed it.
  • Copilot prompt attack detections not reviewed: Microsoft 365 Copilot flagged a jailbreak attempt or hidden instructions in content (cross-prompt injection) in the last 30 days, and nobody has reviewed it.
  • Copilot activity is not being recorded: Microsoft 365 Copilot is licensed, but no Copilot activity records have arrived in the last 14 days, so misuse could not be investigated.
  • Gemini activity is not being recorded: Gemini is licensed in Google Workspace, but no Gemini activity has arrived in the last 14 days.
  • Local AI model servers on computers: a computer runs a local AI model server, such as Ollama, LM Studio, GPT4All, Jan, LocalAI, or a llama.cpp server.
  • AI browser extensions that can read every site: a browser on a computer has an AI extension that can read every website the person visits.
  • Computers accepting connections on AI service ports: a computer accepts connections from other machines on a port that AI services use, rather than only from itself.
  • AI services exposed to the Internet: the domain scan found an AI service, such as a model server or a data science notebook, that anyone on the Internet can reach.
  • AI services open on the internal network: a network or vulnerability scan found an AI service open on the internal network.

Each check needs its source: Microsoft 365 or Google Workspace for the app, agent, and activity checks, SaaS discovery for apps found in use, the Lavawall agent for the computer checks, and the domain, network, or vulnerability scans for exposed services. A check never passes on a source that is not connected or not reporting. None of these checks read the text of prompts or responses.

Tips

  • Status badges: green Passing, red Failing, amber Partial, grey No data, outlined Not available, and dark Error.
  • No data is a finding: the source is connected but came back empty, so the sync may be broken.
  • The pass rate only counts days a check reached a verdict; days it could not run are not counted as passes.
  • A self-approved badge means the person who asked also approved it; this is only allowed if your company permits it and is shown to auditors.
  • Only approved, unexpired exceptions change a check result.

Troubleshooting

"Control mapping not configured yet"
in Evidences: The check is not yet linked to a control, so it does not credit one.
"In the catalogue but not yet implemented: it will never run."
: That check is planned but not available.
"No runs recorded yet."
: Run the check, or wait for the scheduled run.
"Say why this is accepted. An auditor will ask."
/ "Give the exception a real end date.": Exceptions need a reason and a future end date within two years.
"Somebody else decided it first. Reload the page."
: Another approver acted on the exception at the same time.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.