Installation guide

Running and Enforcing Compliance
10
Running and Enforcing Compliance
Compliance compares your virtual or physical machines running Linux, UNIX, Mac OS X, or Windows
operating systems against configuration standards that you download, or that you create, to determine if
the machines meet the standards. The results of the compliance run notify you which machines meet
configuration settings meet the standards and which ones do not meet the standards. In some cases, you
can enforce certain settings on the machines that are not in compliance, initiating the changes from VCM.
Preset rules and templates are available that enable you to begin monitoring system compliance to
regulatory (Sarbanes-Oxley, HIPAA, GLBA and FISMA) industry and Microsoft standards. You can create
and manage rules and rule groups based on Active Directory (AD) objects and configuration data, or on
machine data.
IMPORTANT Compliance does not query individual systems; it only queries the database. If a machine has
not been included in a Collection, or the necessary information has not been included in a Collection, or
the last Collection is outdated, the Compliance Monitor will measure incorrect or out-of-date data.
Therefore, for accurate Compliance monitoring, you must first collect the necessary data.
Running Machine Group Compliance
Compliance templates evaluate the data collected from virtual or physical machines in machine groups to
determine if the machines meet the rules in the templates. If the property values on a machine do not
meet the rule criteria, and if no exception is defined, then the machine is flagged as noncompliant. When a
machine is noncompliant, the template results provide the details of the settings or configurations that do
not match the rules. You can use this information to resolve the problem.
Compliance templates include the following components:
n
Rule Groups: A rule group comprises rules and filters.
n
Rules: The rules define the optimal configuration standards.
n
Filters: The filters limit the machines on which the template runs to only the machines that meet the
filter criteria. If filters are not defined, the rules are run against all machines in the machine group based
on the data types against which the rules run.
n
Exceptions: The exceptions are optional permanent or temporary exceptions to the template results.
The defined exception indicates that a specific result is compliant or noncompliant, even though it does
not match the requirements of the rules.
After you configure your compliance templates, you can optimize how VCM monitors the compliance of
machines in your environment using alerts and scheduling regular compliance template runs on your
collected machine group data.
VMware, Inc.
181