Assessments

Security assessments are structured evaluations of your organization's security posture. Claw GRC supports both automated scanning and manual assessment workflows, with all findings tracked from discovery through remediation.

Assessment Types

Type	Method	Description
Vulnerability Scan	Automated	Scan systems and applications for known vulnerabilities
Configuration Review	Automated/Manual	Review system configurations against security baselines
Penetration Test	Manual	Simulated attack to test security controls
Code Review	Automated/Manual	Analysis of source code for security issues
Compliance Audit	Manual	Assessment of compliance control implementation

Creating an Assessment

1. Navigate to Assessments in the sidebar
2. Click New Assessment
3. Configure the assessment:
   • Type -- Select the assessment type
   • Scope -- Define what systems, applications, or controls are included
   • Configuration -- Set assessment-specific parameters
4. Start the assessment

Automated Scans

For automated assessments, Claw GRC includes built-in scanners:

• Dependency Scanner -- Checks package dependencies for known vulnerabilities (CVEs)
• Configuration Scanner -- Validates system configurations against security baselines
• Secrets Scanner -- Detects leaked credentials, API keys, and secrets in code

Scans run inline when triggered and produce findings automatically.

# Trigger a scan via the API
curl -X POST https://api.clawgrc.com/api/v1/scans \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "target": "https://github.com/your-org/your-repo",
    "scan_type": "dast"
  }'

Findings

When an assessment discovers an issue, it creates a finding. Each finding includes:

Field	Description
Title	Concise description of the vulnerability
Severity	critical, high, medium, low, or info
Description	Detailed explanation of the issue
CWE ID	Common Weakness Enumeration identifier
CVSS Score	CVSS v3.1 base score (0.0-10.0)
Status	open, in_progress, resolved, accepted, false_positive
Remediation	Recommended steps to fix the issue
Affected Resource	The system, application, or component affected
Control Mapping	Unified controls affected by this finding

Finding Lifecycle

Severity Guidelines

Severity	CVSS Range	Response Time	Example
Critical	9.0-10.0	24 hours	Remote code execution, auth bypass
High	7.0-8.9	72 hours	SQL injection, privilege escalation
Medium	4.0-6.9	30 days	XSS, CSRF, information disclosure
Low	0.1-3.9	90 days	Missing headers, verbose errors
Info	0.0	Best effort	Optimization suggestions, best practices

Impact on Compliance

Open findings directly impact your compliance score:

• Critical or high findings on a control mark that control as non-compliant
• Medium findings trigger a warning but do not fully invalidate the control
• Low and info findings are tracked but do not affect the compliance score

When a finding is resolved or accepted, the associated control's compliance status is recalculated.

API Endpoints

Method	Endpoint	Description
GET	/api/v1/assessments	List assessments
POST	/api/v1/assessments	Create an assessment
GET	/api/v1/assessments/:id	Get assessment details
GET	/api/v1/findings	List findings
POST	/api/v1/findings	Create a finding
GET	/api/v1/findings/:id	Get finding details
PUT	/api/v1/findings/:id	Update a finding
POST	/api/v1/scans	Trigger a security scan

See Assessments API, Findings API, and Scans API for full documentation.

Tips and Best Practices

• Scan regularly -- Run automated scans weekly at minimum, and after every significant deployment.
• Triage promptly -- Review new findings within 48 hours. Classify false positives quickly to keep your finding backlog accurate.
• Create tickets for remediation -- Link findings to tickets to track remediation work through completion.
• Map findings to controls -- Always map findings to the unified controls they affect. This gives auditors a clear view of how vulnerabilities relate to compliance requirements.
• Track remediation SLAs -- Define response time targets per severity and track adherence. Most frameworks require documented vulnerability management processes.