Enforcement reads every requirement in your approved policies and makes each one run — a scanner checks it against the values your own clause states, or a named person does it on schedule with the evidence gathered for them. A fix closes only when an independent rescan proves it held.
What changed
Twenty approved policies used to tell an auditor what you believed. Enforcement tells them whether anyone does what the policies say — on an ordinary Tuesday, when no audit is coming. Every requirement in your approved security policies now becomes a standard with an owner, a schedule and a test, graded against your own numbers rather than a vendor checklist.
Graded against your numbers
Every technical check reads the value in your own clause: 14-character passwords, 365-day log retention, phishing-resistant MFA for admins. Change the policy and the grades follow. A draft change waits until it's approved, so results never move ahead of the policy.
Process controls that run themselves
A quarterly access review opens on its own date, pulls fresh account lists from your connected systems and seals them, sends each account to its holder's manager to keep or revoke, routes revocations to IT, and closes on the owner's sign-off. The same mechanism runs backup restore tests, tabletop exercises and every other recurring process a policy describes.
No control left behind
The directory syncs from Okta, Entra ID, Google Workspace or BambooHR. Ownership invitations go out in Slack, Teams or email. A planned departure opens the handover before the person leaves; an unplanned one makes their named backup the acting owner the same day.
Done means a rescan passed
A fix is approved once. The service that applied it never gets to mark it done — a separate rescan does. If the change didn't hold, it is rolled back and the finding reopens with the reason, with the rollback on the trail.
Standards, versioned like policies
Each standard says how a clause is carried out, who owns it, who backs them up, how often it runs and how success is tested. AI can draft one from the clause in seconds, but a named person approves every version, and an author approving their own draft is labelled as such.
One list of fixes
Technical drift and missed process steps sit in the same place. Fixes that need an engineer go to Jira or Linear with the change attached, the right people hear about it in Slack or Teams, and marking the ticket done starts the rescan.
Proof an auditor can check
Every approval, export, decision and rescan is sealed as evidence and timestamped by an independent authority on the Evidence Graph. A third party can re-derive the record without taking vCISO Lite's word for it.
FIG. 1Enforcement → Posture. 86 requirements from your policies, technical on the left and process on the right, rising from written down to verified. Each row names its owner and the last rescan.
Why it matters
A policy nobody runs is a liability with a signature on it. Twenty approved policies can show an auditor that someone wrote them. Enforcement shows that someone follows them — graded against the clause itself, with proof of each cycle on the record. Tighten the clause and every check that reads it grades to the new value on the next scan.
A fix marked done isn’t a fix that worked. Making a rescan decide, and keeping the change and its rollback on the audit trail, turns every remediation into evidence instead of a claim. When ownership moves — because someone changed teams, took leave, or walked out the door — the control doesn’t stall waiting for the auditor to notice.
FIG. 2A fix from a failing scan result. Approved once, applied by remediation-service, then confirmed by a separate scanner-service rescan — not by the service that made the change. The approval, apply and rescan are each a sealed evidence record on the Evidence Graph.
Availability
Shipping today to Business plans and above. Open it in your tenant at Enforcement → Posture, Standards, Fixes. Fixes that apply themselves require Enterprise.
Enforcement launches alongside rebuilt Connections and Security Scanning. Customers need approved policies and a connected identity provider (Okta, Entra ID, Google Workspace or BambooHR) to start. The full press release is at vcisolite.com/press/enforcement-launch.
Known limitations
AI-drafted standards are first-pass only; every version waits on a named approver, and the approver is recorded on the standard. Author-approves-own is permitted but labelled.
Owner handovers follow the identity directory you've connected. Customers on platforms the directory doesn't sync from (e.g. a manual CSV import) see handovers triggered on the next sync rather than on the same day.
Self-applying fixes cover connections where a write grant is live (AWS, GitHub, Google Workspace, Microsoft Entra ID at launch). Every other connection fixes through guided steps or a pull request. Earned-autonomy thresholds (98% hold on at least 30 rescans by default) build toward auto-apply over the first weeks of use.
