From 94c02eb86dd4b1ad83e3b14f4bceaf7c82db761f Mon Sep 17 00:00:00 2001 From: Kerry Carmichael Date: Wed, 4 Dec 2024 14:16:44 -0500 Subject: [PATCH] Add note about compliance operator --- operating/compliance-operator-rhacs.adoc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/operating/compliance-operator-rhacs.adoc b/operating/compliance-operator-rhacs.adoc index 578404e4e802..d7bd70b993b3 100644 --- a/operating/compliance-operator-rhacs.adoc +++ b/operating/compliance-operator-rhacs.adoc @@ -8,12 +8,16 @@ toc::[] [role="_abstract"] You can configure {product-title-short} to use the Compliance Operator for compliance reporting and remediation with {ocp} clusters. Results from the Compliance Operator are reported in the {product-title-short} Compliance Dashboard. +[NOTE] +==== +You must install the Compliance Operator on the cluster where Central is installed and on each secured cluster that you want reviewed for compliance. +==== -The Compliance Operator automates the review of numerous technical implementations and compares them with certain aspects of industry standards, benchmarks, and baselines. +The Compliance Operator automates the review of numerous technical implementations and compares them with certain aspects of industry standards, benchmarks, and baselines. The Compliance Operator is not an auditor. To comply or certify to these various standards, you must engage an authorized auditor such as a Qualified Security Assessor (QSA), Joint Authorization Board (JAB), or other industry-recognized regulatory authority to assess your environment. -The Compliance Operator makes recommendations based on generally available information and practices that relate to such standards and can assist with remediation, but actual compliance is your responsibility. You are required to work with an authorized auditor to achieve compliance with a standard. +The Compliance Operator makes recommendations based on generally available information and practices that relate to such standards and can assist with remediation, but actual compliance is your responsibility. You are required to work with an authorized auditor to achieve compliance with a standard. For the latest updates, see the link:https://access.redhat.com/documentation/en-us/openshift_container_platform/{ocp-latest-version}/html/security_and_compliance/compliance-operator#compliance-operator-release-notes[Compliance Operator release notes]. @@ -33,7 +37,7 @@ include::modules/compliance-operator-install.adoc[leveloffset=+1] //Configuring the ScanSettingBinding object include::modules/compliance-operator-configure-scanning.adoc[leveloffset=+1] -// See https://docs.openshift.com/container-platform/4.12/security/compliance_operator/compliance-scans.html#running-compliance-scans_compliance-operator-scans. +// See https://docs.openshift.com/container-platform/4.12/security/compliance_operator/compliance-scans.html#running-compliance-scans_compliance-operator-scans. [role="_additional-resources"] .Additional resources