The Compliance Center is where you track and enforce compliance across your managed devices. It shows how your organization measures up against frameworks such as SOC 2, ISO 27001, HIPAA, NIST 800-53, NIS 2, and CIS Level 1 and 2, and helps you fix gaps. That includes fixing misconfigured policies in one step.

Swif evaluates your devices continuously, so your compliance status stays current and you stay ready for audits.

The Compliance Center has two tabs:

The Frameworks Snapshot shows your compliance status for each framework at a glance:

Supported frameworks:

Select a framework to see its details, or to generate a report. See Generate a framework report below.

Swif enforces compliance through controls. Each control is a device-level security requirement, mapped to one or more frameworks. For example, ENC-1 requires full-disk encryption.

Each control shows:

Swif supports CIS Benchmark Level 1 and Level 2. These controls focus on system hardening, access restrictions, logging, and reducing the attack surface, mainly on macOS.

CIS Level 1 or Level 2? Level 1 balances security with usability, and suits most organizations. Level 2 is stricter, for high-risk or regulated environments. Swif maps each control to the right level, so you can track both.

Swif monitors devices continuously and updates each status as devices change.

Controls are enforced with Swif policies and scripts. Swif's policy engine lets you:

When a policy isn't meeting a control's requirements, you can fix it from the Compliance Center in one step. You don't have to open the policy, find the wrong settings, and deploy it by hand. Select Fix Issue, review the changes, and apply them all at once.

Fixes apply only to the devices that need them. Fix Issue changes only the devices in the control that need the fix. The confirmation window lists the settings and devices that will change, so you can review everything before you apply it.

Each policy for that operating system is listed with its settings:

A Fix Issue button appears next to any policy that has at least one issue. Policies that are fully configured and deployed don't show the button.

A confirmation message shows what changed, for example Fix applied to Android Lock Screen Policy: Deployed policy to 2 devices. A few seconds later, the control's compliance data refreshes, and Device Coverage updates.

Examples

Swif sends fixes to devices as commands. Device Coverage updates once the devices receive the changes, and Swif recalculates compliance. That can take a little longer than the automatic refresh. If the numbers haven't changed yet, refresh the page.

Policy names in the Compliance Center are links. Selecting one opens the policy in a new tab, so you keep your place. You can also right-click a policy name and choose Open in new tab.

Create your own controls for internal security requirements, industry-specific rules, or configurations beyond the standard frameworks. Select Create Compliance Control to start. See Custom Compliance Controls in Swif.

Custom controls can count toward your framework scores, alongside Swif's built-in controls.

Selected categories appear as tags, which you can remove.

Map to several frameworks. One custom control can count toward several frameworks. For example, a custom encryption control could count toward SOC 2 under Data Protection, and ISO 27001 under Cryptography. Each framework has its own categories, and can be removed without affecting the others.

Remove a framework target. Select the trash icon on the framework's row. The control stops counting toward that framework, and the framework returns to the list.

In the Framework Snapshot, custom controls appear under their categories with a Custom badge in the Source column. Built-in controls show System Default. The columns are Control ID, Control Benchmark, Source, and Compliance.

OFF-1 (Offboarding) and LOG-1 (Audit logging) are manual controls. By default, they're informational and don't count toward framework scores.

You can make LOG-1 count by validating its script with Swif's AI script tool:

Once validated:

If you don't validate the script, LOG-1 stays informational. This makes sure only verified, automated evidence counts toward your scores.

Create a report of your compliance status for SOC 2, NIST, ISO 27001, HIPAA, NIS 2, or CIS Level 1 or 2. Reports capture a point-in-time snapshot for audits and internal reviews.

Choosing a different framework resets the filters.

Large reports can take a few moments to prepare.

Compliance is continuous, not a one-time effort. Swif:

That means less manual evidence collection, and simpler audits.

Swif sends fixes to devices as commands, and coverage updates once devices receive them and Swif recalculates compliance. Make sure the devices are online, then refresh the page.

The policy has no issues: its settings are correct, and it's deployed to all devices the control covers.

A policy is applied, but not every device meets the control yet. Check Device Coverage for each operating system, and use Fix Issue for policies with issues.

LOG-1 counts only after you validate its script. See Manual controls: OFF-1 and LOG-1 above.

Add a framework target to the control in Organization Settings > Compliance, and choose at least one category.