Stay compliant and audit ready
See your control gaps on the power layer at all times, be ready for any audit, and keep the evidence that shows how your BMCs, firmware and power path are secured: for auditors, regulators and the customers renting your capacity.
Know your control coverage and prove it
PWX maps what it reads on the power layer to the frameworks you report against, and keeps the evidence behind each control: signed, chained and ready to export, every day of the year rather than the week before the audit.
| Framework | Pass | Gap | N/A | |
|---|---|---|---|---|
| NIS2Art. 21(2) | 5 | 1 | 1 | |
| IEC 624433-3 · 4-2 · 2-3 | 11 | 2 | 3 | |
| DORAArt. 9 · 10 | 4 | 1 | 1 | |
| NIST CSF 2.0PR · DE · ID | 9 | 2 | 2 | |
| NIST SP 800-53Rev. 5 | 11 | 2 | 3 | |
| ISO 27001Annex A | 10 | 2 | 2 |
Know your control coverage
See which controls are passing, where the gaps are and what was not assessed, across NIS2, IEC 62443, DORA, NIST CSF 2.0, NIST SP 800-53 and ISO 27001. Every check PWX runs on the power layer is mapped to the clauses it speaks to, so one finding is evidence for every framework you answer to.
- 47 checks plus every firmware CVE, mapped to 70 clauses
- A pass names the checks behind it; a gap names the finding
- Not assessed says why, and what would let it run
Prove the power layer is hardened
Show that every BMC, its firmware and the hosts behind it are set up the way your policy says: who holds BMC access, which management protocols are open, whether Secure Boot holds, whether firmware is current against a signed CVE bundle, and which node has drifted from the golden configuration of its fleet.
- Read-only, agentless, re-checked on every scan
- Drift between scans raised as it happens
- Firmware currency from NVD, CISA KEV and FIRST EPSS, with dates
- ✓BMC accounts unchanged for the whole leaseno account added, enabled or re-roled
- ✓No firmware or BIOS change inside the sessionrule N03 quiet, versions read at start and end
- ✓No power-cycle or power-cap change without a ticketrules N07 and N08 quiet
- ✓Node idle after releaseno draw on a node with no tenant (N05)
- ✓Host posture matches the handover baselineSecure Boot, boot override, virtual media, protocols
Prove a clean handover between tenants
When a node moves from one customer to the next, show that the BMC, the firmware and the power path were left as they should be: no new BMC account, no firmware change inside the session, no power action without a ticket, and a node that went quiet when the lease ended.
- A per-tenant report over the lease, from the scheduler's own record
- Handover checked against the baseline you keep per model
- Exported as HTML, CSV or JSON for the customer
Stay ready between audits
Evidence is collected as the fleet runs instead of assembled under a deadline. Every report is signed and chained to the one before it, every alert sits in a hash-chained ledger, and anything can be exported the moment an auditor or a customer asks.
- Signed, tamper-evident reports with a verify command
- Hash-chained alert ledger per site
- Exports for auditors, GRC tools and SIEMs
From our research
Know the moment the power layer changes
Detection and response · PWX MonitorThe cross-layer rules whose findings become the evidence on this page, from the BMC down to the rail.
ReadBMC firmware CVEs, checked daily
NVD, CISA KEV, FIRST EPSSThe public catalog behind firmware currency, and the signed bundle the scanner reads, with the date of every score.
ReadWhat we have measured, and on what
Bench evidenceThe runs behind our figures: what was measured, on what hardware, and what the bench does not prove yet.
ReadSecure your AI data center
Start with a free, agentless scan of your BMCs. Then a pilot on PWX Monitor, with success criteria agreed in advance.