October 22, 2026 · Technical Controls · Improvement

Your clauses are now graded only on the checks they ask for.

A scan result used to count toward any clause that shared a framework control with it. Now it counts only where it tests exactly what the clause commits to. Your coverage will likely go down. That’s the point: what’s left is what actually checks each clause.

What changed

Each scan check maps to framework controls, and so does each clause in your policies. Until today, a check counted toward a clause if the two shared a control at any level. SOC 2 CC6.1 alone reaches 28 other controls, so one Slack admin setting could end up grading a clause about encryption keys.

For SOC 2, a check now counts only when all three of these hold:

  • the clause maps a criterion, such as CC8.1,
  • it also maps one of that criterion’s points of focus, the specific characteristic it commits to, such as reviewed and approved changes, and
  • the check tests that same point of focus.

Two separate statements have to agree before anything grades. Points of focus are the AICPA’s own breakdown of each criterion, so every link that counts can say exactly why. For other frameworks, a check counts when it matches the clause’s exact requirement.

Everything else still shows on the clause as related, muted and ungraded. If a related check really does prove the clause, its owner can choose Count toward this clause. That takes a reason and is recorded.

What you’ll see

The first time you open Posture after the update, a note explains the change. See what changed lists every clause, with the checks that now count and the ones that are now related. A few examples from our own organization:

ClauseWas graded onChecks counting
Risk Management §9.2 · risk catalog kept current9 GitHub branch settings9 → 0
Privacy §11.2 · no production data in test9 GitHub branch and PR settings9 → 0
Cloud Security §7.1 · hardened baselinesGitHub settings and GCP Security Command Center12 → 0

Clauses that drop to no counting checks don’t fail. They show as not checkable yet, or as a process, like a review someone runs on a schedule. Either way, Posture shows what would cover them.

Separately, we stopped counting results from connections you’ve disconnected. If you had replaced a connection, its old results were still grading your clauses.

Why it matters

An auditor reading “Risk Management §9.2: passing” would ask what checked it. Until today the honest answer was “GitHub force-push settings”. A lower number you can defend beats a higher one you can’t.

Action required

None. If you think a related check should count, open the clause and use Count toward this clause. Every change in coverage is recorded on the audit trail with its before and after counts.