Most engineers think…
Most people lump Policy Compliance and SCA together as 'just scanning for misconfigs' — and then struggle when an interviewer or auditor asks them to explain how exceptions work or why a CIS Benchmark differs from a DISA STIG.
Qualys PC is a full-scale, policy-driven compliance engine: it checks every configuration control on every asset, records a Pass/Fail/Error per control, rolls results up into a compliance score, and generates audit-ready reports. SCA is a lighter, CIS-focused add-on that uses the agent for near-real-time assessment of cloud and on-prem workloads. Understanding both — and knowing when to grant a time-boxed exception vs. accept risk — is what separates a junior sysadmin from a compliance engineer.
① Policy Compliance vs SCA — same goal, different reach
Qualys ships two overlapping but distinct modules for configuration compliance. Policy Compliance (PC) is the mature, full-featured engine: it supports scanner-based and agent-based data collection, a rich library of pre-built policies (CIS, DISA STIG, PCI DSS, HIPAA, ISO 27001, Cyber Essentials, SOX and custom), and generates detailed audit reports with trend history. It is licenced separately from VMDR and is the tool you use for formal regulatory audits.
Security Configuration Assessment (SCA) is a lighter module bundled inside VMDR that focuses specifically on CIS Benchmarks via the Qualys Cloud Agent. It is designed for fast, continuous assessment of cloud instances and on-prem servers without requiring network-based scanner access. The result: SCA is great for cloud-native teams who already deploy agents everywhere; PC is required when your auditor needs formal reports against DISA STIGs, PCI DSS or a custom mandate.
A cloud-native team already deploys the Qualys Cloud Agent on every EC2 instance and needs a quick CIS Benchmark posture view inside their VMDR licence. Which module fits best?
② How controls are structured, collected and evaluated
A Qualys control is the atomic unit of policy compliance — it maps one expected configuration value (e.g. 'SSH PermitRootLogin must be no') to one technology (Linux/RHEL 9). Each control has a control ID, a technology tag, a data collection method, an expected value and a criticality rating. Controls are grouped into policies, which are snapshots of a mandate or benchmark applied to an asset group.
Collection methods
Qualys gathers configuration data in two ways: scanner-based (authenticated scan using SSH or WMI — the scanner logs in and reads registry keys, file settings, and command output) and agent-based (the Qualys Cloud Agent collects continuously and pushes compliance data to the platform). Agent-based collection gives more frequent data; scanner-based is needed for legacy systems that cannot run an agent. Findings are evaluated as Pass (actual value matches expected), Fail (mismatch), or Error (data could not be collected — missing credential, agent offline, or unsupported technology).
The atomic compliance check — one expected configuration value for one technology. Evaluated as Pass, Fail or Error against actual settings collected by scanner or agent.
A group of controls applied to an asset group. Policies snapshot a mandate (CIS, DISA, PCI) or a custom configuration baseline.
CIS Benchmarks (Level 1/Level 2) are community guidelines; DISA STIGs are US DoD standards. CIS STIG benchmarks (added 2026) are CIS-formatted but DoD-equivalent — same controls, different presentation.
A dated, justified waiver for a failing control. Types: Mitigating Control, Risk Acceptance, or False Positive. Expires automatically — never silently removes a failure from the audit trail.
In an interview, always distinguish Error from Fail. A Fail means you found the setting and it is wrong. An Error means you never got the data — fix your credential or agent first, or you will chase phantom compliance gaps and report inflated Fail counts.
A control evaluation returns 'Error'. What does this most likely mean?
③ Benchmarks and mandates — the Qualys policy library
Qualys maintains a continuously updated policy library with hundreds of out-of-the-box policies covering every major mandate. The four families you must be able to name: CIS Benchmarks (Level 1 and Level 2 controls for OS, cloud, containers, databases and applications — also available in CIS STIG flavour, which aligns CIS controls to DISA STIG identifiers); DISA STIGs (Security Technical Implementation Guides for US DoD — the authoritative source for federal hardening); PCI DSS (configuration requirements for cardholder data environments, updated through PCI DSS 4.0); and ISO 27001 / custom mandates (you can build a custom policy by picking controls from any technology library and defining your own expected values and criticality weights).
In April 2026 Qualys introduced CIS STIG labels inside the Policy Audit library, letting teams surface CIS-released STIG-aligned benchmarks directly alongside native DISA STIGs — useful when a customer needs CIS formatting but DoD equivalence. CIS STIG vs DISA STIG differ only in presentation, not in the underlying control intent.
CIS Benchmarks and DISA STIGs cover similar ground but are NOT interchangeable in a federal audit. DISA STIGs are the authoritative DoD requirement; CIS STIG benchmarks (added to Qualys in April 2026) are CIS-formatted equivalents. If your customer is a US agency or contractor under CMMC, confirm CIS STIG acceptance before using it as the primary evidence artefact.
▶ Watch a CIS Benchmark control get evaluated and remediated
How one failing SSH control moves from detection to exception to remediation. Press Play for the healthy path, then Break it to see the classic data-collection failure.
A US federal agency customer needs Qualys to assess Linux servers against DoD hardening standards. Which policy family should you select?
④ Reporting, dashboards and the exception workflow
Qualys PC produces three kinds of output. Compliance dashboards show the real-time posture score (percentage of controls passing) per asset group, policy, and technology — with drill-down to individual failing controls and the raw evidence that caused the failure. Trend reports compare posture over time (weekly, monthly, quarter-over-quarter) so you can show auditors that the score is improving. Policy report PDFs are the formal audit artefact — they list every control, its result and the evidence, with a digital signature timestamp.
Managing exceptions
When a control fails but the risk is accepted (or a compensating control exists), you raise an exception: assign it to an owner, add a business justification, select a type (Mitigating Control, Risk Acceptance or False Positive) and set an expiry date. Approved exceptions are excluded from the score and flagged clearly in reports so auditors see them — not hidden. Expired exceptions auto-revert to Fail, so nothing silently falls off the radar. The golden rule: never delete a failing control — raise a dated exception instead so there is an evidence trail.
Kavitha at a Chennai-based fintech faces this
The weekly Qualys PC report shows overall compliance score at 61% — well below the PCI DSS 4.0 target of 95%. The auditor is arriving in three weeks.
Legacy Windows 2016 servers have 140 failing controls — mostly around audit log settings and SMBv1 — that were never remediated after the initial scan.
Open PC ▸ Policies ▸ PCI DSS ▸ Failing Controls. Filter by criticality = High. Most failures cluster on audit policy (Event Log size, success/failure flags) and network protocol (SMBv1 enabled) — easy wins.
PC ▸ Policies ▸ Compliance Report ▸ Failing Controls (grouped by technology)Remediate audit log settings via GPO (fast, no vendor constraint). For SMBv1: raise a Risk Acceptance exception for the three systems with vendor-locked constraints, justifying that network segmentation compensates. Score jumps from 61% to 93% within a week.
Re-run the Qualys PC report after the next scan cycle. Dashboard shows 93% Pass. The three SMBv1 exceptions appear with justifications and expiry dates — the auditor accepts them as documented compensating controls.
A compliance score of 98% can drop to 75% overnight when batch exceptions expire. Before every audit, run PC ▸ Exceptions ▸ Expiring Soon and renew or escalate each one. Surprises in audit reports almost always trace back to an expired exception nobody renewed.
A CIS Level 2 control fails because the application vendor prohibits the required SSH setting. The correct Qualys PC action is:
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the difference between a Qualys PC 'Fail' result and an 'Error' result, and why does it matter? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Policy Compliance (PC)
- Qualys module that checks configuration controls against mandate-based policies (CIS, DISA, PCI, ISO, custom) using scanner and/or agent collection, producing formal audit reports.
- Security Configuration Assessment (SCA)
- Lightweight, CIS Benchmark-focused module bundled inside VMDR — agent-only, designed for fast cloud and on-prem posture checks.
- PC Control
- The atomic compliance check — one expected configuration value for one technology. Evaluated as Pass, Fail or Error.
- CIS Benchmark
- Community-developed secure configuration guidelines (Level 1 = minimum, Level 2 = defence-in-depth) covering OS, cloud, containers, databases and applications.
- DISA STIG
- Security Technical Implementation Guide — the US DoD authoritative configuration hardening standard; CIS STIG benchmarks are CIS-formatted equivalents added to the Qualys library in April 2026.
- Compliance Score
- The percentage of controls in a policy that evaluate to Pass for a given asset or asset group — the primary number auditors and management use to measure posture.
- Exception
- A dated, typed, justified waiver for a failing control in Qualys PC — types are Mitigating Control, Risk Acceptance, or False Positive. Auto-reverts to Fail on expiry.
- Error (control result)
- A data-collection failure — the platform could not retrieve the configuration. Not a compliance verdict; fix credentials or agent before drawing conclusions.
📚 Sources
- Qualys — Security Configuration Assessment (SCA) product page. qualys.com/apps/security-configuration-assessment
- Qualys Docs — SCA get started & CIS policy setup guide. docs.qualys.com/en/vm/latest/module_sca
- Qualys Notifications — Policy Compliance library updates, April 2026 (CIS STIG labels introduced). notifications.qualys.com/policy-library/2026/04/30
- Qualys Notifications — Policy Compliance library updates, May 2026. notifications.qualys.com/policy-library/2026/05/29
- Qualys — Policy Compliance data sheet — controls, mandates and audit reporting. cdn2.qualys.com/docs/mktg/policy-compliance-datasheet.pdf
- Qualys Blog — Cyber Essentials Plus 2026: strengthened controls & compliance insight. blog.qualys.com/product-tech/2026/03/02/cyber-essentials-plus-2026-compliance
What's next?
Got Policy Compliance? Next, go deep on Qualys Patch Management and how auto-remediation closes the loop between a failed control and a fixed asset — without ever leaving the VMDR platform.