Compoly is an open source tool to analyse policy compliance for IT systems such as MS Windows, UNIX versions or Cisco IOS. Best for an Information Security assessment, Sarbanes-Oxley 404 or NIST compliance testing and to support internal/external IT audits. Download the latest off-line version and start to use it.

Because each organization has it's own policies and standards, a set of industry "best practices" were used to compile general policies and standards. However, the tool contains policies in a editable XML Knowledge Base. So, it is easy to adjust standards to specific requirements. See Documentation for details.

Step 1: Download a collection script for your system. Run it on the system with high (root or administrator) privileges. No installation is required. All scripts are text base. So verify them for your peace of mind.

Step 2: Upload the generated XML file or a Cisco IOS configuration file to the web site over SSL encrypted connection. We provide a free service. So, the certificate is a self-signed and is not from vendors like Verisign. Specify your email address as an optional parameter. It is used to store your configuration preferences or special standards to analyse against.

Step 3: Select analysis and report parameters. Then push the button and generate the report.

Similar project with standards (benchmarks) and tools - Center for Internet Security, Nessus.

NIST and SANS are good source of standards and guidelines.