Solutions for checks, evidence and customer control
SigXOS supports companies and IT service providers wherever configurations of network and security systems need to be checked, risks assessed and results backed up with traceable evidence.
PrototypeAvailable in the prototype. Sections marked “Planned” describe the target architecture.
Security checks
Check configurations repeatably
PrototypeThe challenge
Security checks and their documentation are often manual, spread across several tools and dependent on expert knowledge. Many systems, platforms and versions make consistent checks laborious.
With SigXOS
- Collect configurations and inventory data strictly read-only
- Check configurations against defined security requirements
- One clear result per check: deviation or passed
- F002Password obfuscation enabledDeviation
- F004SSH version 2 enforcedPassed
- F005Telnet disabled on VTY linesPassed
- F007Access list on VTY linesDeviation
2 deviations, 2 passed
Risk assessment in context
Assess risks in the network and operational context
PlannedThe challenge
Whether a setting is appropriate depends on the role and configuration of the system in question. The same setting can be appropriate in one place and a risk in another.
With SigXOS
- Take system role, network environment and available dependencies into account
- Prioritise risks in the network and operational context
- Network and system overview with inventory, dependencies and operational relevance
- core-01Production network, reachable from the office networkHigh
- lab-01Isolated lab networkMedium
Same deviation, different risk
Technical evidence
Prove findings instead of describing them
PrototypeThe challenge
A documented target state does not prove the current actual state. Audits need evidence that refers to the actual configuration.
With SigXOS
- Every finding points to the configuration it refers to
- Back up check results and map them to the relevant requirements
- Check report and audit trail for follow-up
Evidence
No access-class configuration in the running-config
Recommended action
Restrict access to VTY lines to trusted hosts using access-class.
AI assistance
AI-assisted remediation proposals
PlannedThe challenge
Assessing findings and preparing suitable measures requires specialist knowledge. At the same time, credentials and confidential configurations must not be shared without control.
With SigXOS
- Explain findings in plain language and prepare measures
- Local AI models in the customer network; approved external models only according to customer requirements
- Data filter before external transfer; credentials and keys stay outside the AI
- AI does not replace authorisation to execute
Explanation
Without access-class, management access is open from every network that can reach the device.
Prepared measure
line vty 0 4 · access-class MGMT-ACL in
Before approval
Review impact, tests and rollback procedure.
Customer control
Changes only after explicit approval
PlannedThe challenge
Changes to production network and security systems need clear responsibilities, traceable approval and a prepared way back.
With SigXOS
- Review measures, impact, tests and rollback procedures
- Approval of plan version, target systems and time window by authorised customer owners or an authorised service provider
- Back up the initial state, execute the approved plan, check and document result and operation
- Deviation or missing approval: stop execution
- 4 · Technical reviewDone
Measures, impact, tests and rollback procedure
- 5 · ApprovalGranted
Plan version, target systems and time window
- 6 · Controlled executionDone
Initial state backed up, approved plan executed
- 7 · VerificationDocumented
Result and operation checked
Re-check
Check again after implementation
PrototypeThe challenge
Configurations change constantly. A state that was checked once is no longer proven after the next change.
With SigXOS
- Customers implement changes themselves; SigXOS checks again and documents the result
- Keep the history of check results traceable
- Check run before the changeDeviation
13
no service password-encryption - Re-check after the changePassed
13
service password-encryption
Security requirements
Security requirements & recommendations
Legal requirements, standards, security guidelines and internal policies form the basis of the checks. SigXOS maintains and validates the corresponding check packages; the checks in the prototype are oriented on the CIS Benchmarks.
CIS Benchmarks & Controls
Hardening recommendations. In the prototype: CIS-oriented checks for Cisco IOS/IOS-XE with CIS reference and severity.
NIS-2
EU Directive (EU) 2022/2555 on cybersecurity risk management and reporting
PlannedBSIG
Implementation of the NIS-2 Directive in Germany
PlannedDORA
EU Regulation (EU) 2022/2554 on digital operational resilience in the financial sector
PlannedBSI IT-Grundschutz
Methodology and compendium of the German Federal Office for Information Security (BSI)
PlannedISO/IEC 27001
Standard for information security management systems (ISMS)
PlannedPCI DSS
Security standard for card payments
PlannedNIST CSF 2.0
NIST Cybersecurity Framework (USA)
PlannedInternal policies
Customer-specific security requirements as dedicated checks
Planned
Technical evidence supports audits and assessments but does not guarantee full regulatory compliance. Organisational measures, legal assessment and certification are outside the scope of the checks.
Who it is for
For companies and IT service providers
Companies with their own IT infrastructure
Security and network teams who need to check configurations regularly, assess risks and prove results in a traceable way. The enterprise standard applies to smaller companies too.
IT service providers and system integrators
Partners who manage customer environments and want to offer checks and evidence as a service of their own.
Planned
Is SigXOS a fit for your environment?
You need to check and prove configurations regularly? Let’s find out in 30 minutes whether a pilot makes sense – directly for Cisco IOS/IOS-XE, for further technologies and platforms based on customer demand.