Audit packages

What an audit package is

• Point-in-time snapshots of a tenant's coverage against a single compliance framework.
• A branded PDF (via WeasyPrint) that you can hand to an auditor or attach to a client deliverable.
• Contain the same control-status data the live /compliance pages show, frozen at the moment of generation.
• Persist in the database with bytes inline, so you can re-download earlier versions for evidence-of-evidence traceability.

What the PDF contains

• Cover page: tenant, framework, version, coverage percentage, letter grade (A-F), met/gap/N/A/pending counts, period (if specified), generation timestamp.
• Executive summary paragraph: plain-English description of current state.
• Control-by-control evidence table: every control in the framework with status badge, gap count, last-assessed date, and inline lists of linked open findings + manual attestations.
• About this package: definitions of status values + framework source URL.

How to generate one

1. Open /compliance/packages.
2. Pick the framework from the dropdown (one PDF per framework). Optionally add a title and period range.
3. Click Generate. The API returns 202 + a pending package row. Generation runs in the background via FastAPI BackgroundTasks.
4. The package status flips through pending → generating → completed (usually within 10-30 sec).
5. Click Download PDF on the completed row.

How to read the output

• Coverage percentage = met controls / total controls. The letter grade is mechanical: A ≥90%, B ≥80%, C ≥70%, D ≥60%, F below.
• A "Met" control on automatic mapping means we don't see open posture findings linked to it. Not an attestation that the policy is documented — your auditor may still want a separate policy artifact.
• A "Gap" lists the specific open findings driving the gap, with severity and "open since" dates. Remediate or attest.
• An "N/A" control was operator-set and is preserved across reconciliations. Auditors typically accept N/A markings only when paired with a written rationale (use the attestation notes field).
• A "Pending" control has no signal yet — either a brand-new subscription that has not been reconciled, or a control with no posture-finding mapping for the current frameworks.

Limits

• Each package is per-framework. To package multiple frameworks for one audit, generate them separately and bundle the PDFs.
• Packages capture the state at generation time. To re-assess after remediation, generate a new package.
• PDF size grows with the number of open findings (each Gap shows linked findings inline). Typical M365 tenants land in the 50-200 KB range.
• Packages do not currently include the raw posture-scan CSV. That artifact is available separately on the posture scan detail page.