.png)
Getting Started with AuditBadger
Scaleway Setup Guide
How to connect a Scaleway project to AuditBadger with a dedicated read-only IAM application API key. Takes about 10 minutes. 1. Create the IAM application 1. In the Scaleway console, open IAM → Applications. 2. Create an application named auditbadger-compliance-reader. Do not use a personal (user-owned) API key — application keys are not tied to a human account and survive offboarding. 2. Create the read-only policy Open IAM → Policies, create a policy named auditbadger-compliance-read-only attached to the application, with two rule groups: - Organization scope: - OrganizationReadOnly - ProjectReadOnly - IAMReadOnly (lets AuditBadger verify the key stays read-only) - AuditTrailReadOnly (optional — only if you want Audit Trail evidence) - Project scope, limited to the project(s) you want monitored: - InstancesReadOnly - BlockStorageReadOnly - ObjectStorageBucketsRead - RelationalDatabasesReadOnly - SecretManagerReadOnly - Project scope, optional — grant only the products you actually use: - KubernetesReadOnly (cluster posture; AuditBadger never downloads kubeconfig files) - LoadBalancersReadOnly (TLS and certificate posture) - ContainerRegistryReadOnly (namespace visibility; images are never pulled) - VPCReadOnly and PrivateNetworksReadOnly (network segmentation inventory) Never grant FullAccess, Manager, Write, or Delete permission sets — AuditBadger detects them and blocks automated collection until they are removed. AllProductsReadOnly works but grants more read access than needed; AuditBadger will show a warning. 3. Generate the API key 1. Open IAM → API keys → Generate API key. 2. Select the auditbadger-compliance-reader application as the bearer. 3. Prefer no expiration so evidence collection is not interrupted; rotate the key manually instead. If you do set an expiration, AuditBadger shows the date and warns before the key expires. 4. Copy the access key and the secret key — Scaleway shows the secret key only once. 4. Connect in AuditBadger 1. Go to Account Settings → Integrations → Scaleway. 2. Fill in: label (e.g. "production"), organization ID, project ID, access key, secret key, and default region. 3. Save. AuditBadger validates the connection in the background, checks each product API, and verifies the read-only permission posture. 4. Once healthy, install evidence sources on your compliance controls (individually from a control, or in bulk via "Install evidence sources"). Key rotation 1. Generate a new API key for the same IAM application in Scaleway. 2. On the integration page, open Configuration, paste the new access key and secret key, and save. Evidence sources and collected evidence are kept. 3. After AuditBadger re-validates, delete the old API key in Scaleway. Troubleshooting - "Write-capable permissions detected" - the key's policy grants a write/full-access permission set. Replace the policy with the read-only sets above; collection stays blocked until fixed. - "Unrecognized permission set" - Scaleway added a permission set AuditBadger doesn't know yet. Collection is blocked as a precaution; contact support. - "Permission verification incomplete" - the key lacks IAMReadOnly, so AuditBadger cannot verify the policy. Collection still works, but the read-only posture is unverified. - A product shows "Permission denied" - the project-scope rule is missing that product's read-only permission set, or the policy is scoped to a different project. - Audit Trail source shows "setup required" - enable "Collect Audit Trail evidence" in the integration settings and grant AuditTrailReadOnly.
How Compliance Progress Is Calculated
Overview Every compliance project shows a single overall progress percentage, backed by eight section scores. The overall number is a weighted average — each section is scored from 0 to 100 on its own, then contributes a fixed share of the total. Progress measures how much of the work is recorded in the platform, not whether an auditor will accept it. A project at 100% is one where every document, control, and piece of evidence has reached its final state in AuditBadger. The Eight Sections And Their Weights - Documents — 20% - Controls — 20% - Evidence — 10% - Risks — 10% - Business Continuity — 10% - Vendors — 10% - Assets — 10% - Assessments — 10% Each section is the plain average of the items inside it. Ten controls scoring 100, 50, and 0 average out the same way you would expect — no item is weighted more heavily than another within its section. How Each Section Is Scored Documents (20%) Each policy document in the project scores: - 10% — someone has edited it at least once - 30% — published, when acknowledgements are required - 90% — acknowledgement assignments have been sent - 100% — published with no acknowledgement required, or every assigned person has responded A document reaches 100% as soon as everyone assigned has either accepted or rejected the acknowledgement. Rejections still count as a response — the score reflects that the acknowledgement round is finished, not that everyone agreed. Controls (20%) Each control in scope scores: - 10% — it has a description - 50% — a policy document or a piece of evidence is linked to it - 90% — implementation notes have been filled in - 100% — marked as implemented, not applicable, or accepted as an exception A control you deliberately rule out counts as complete. Marking something not applicable is a valid answer, and the score treats it that way. Evidence (10%) Each measured control scores by the furthest state any of its evidence has reached: - 0% — no evidence attached - 25% — evidence attached, still a draft - 50% — evidence submitted for review - 100% — evidence verified, or an automated check is passing Automated checks that pass with exceptions count as fully covered, the same as a clean pass. See "Which Controls Are Measured For Evidence" below — this is the section people most often expect to be higher than it is. Risks (10%) Each risk in your account scores 100% once it has been assessed, and keeps that score through treatment planning, treatment, acceptance, and closure. Risks still in draft or merely identified score 0%. In other words: identifying a risk does not move the number. Assessing it does. Business Continuity (10%) Each active business continuity process scores: - 0% — no exercises have been created for its plans - 50% — an exercise exists but has not been completed - 100% — at least one exercise has been completed Archived processes are ignored entirely. Vendors (10%) Each vendor scores by its review posture: - 100% — assessed, assurance reviewed, or recorded as an assurance exception - 50% — an assessment is in progress, or known-vendor data is available but not yet reviewed - 0% — never reviewed, review due, or action required Assets (10%) This section is all-or-nothing: 100% if your account has at least one infrastructure asset recorded, 0% if the inventory is empty. Assessments (10%) Each assessment attached to the project scores 50% while it is open and 100% once completed. Three Rules That Surprise People Empty sections count as zero, not "not applicable" A section with nothing in it scores 0% and still carries its full weight. An account with no risks recorded loses the entire 10% risk weighting — the section is not skipped and the remaining weights are not redistributed. This is the most common reason a project that "feels done" sits in the seventies. Before chasing individual items, check whether an entire section is empty. Four sections are account-wide, not project-specific Risks, Business Continuity, Vendors, and Assets are scored across your whole account, not per project. If you run a SOC 2 project and an ISO 27001 project side by side, both show the same score for those four sections, and work recorded in one immediately moves the number in the other. Documents, Controls, Evidence, and Assessments are specific to the project. Out-of-scope sections are excluded Controls belonging to a framework section you have marked as skipped are left out of both the Controls and Evidence sections — they are not counted as incomplete. Narrowing scope raises your percentage legitimately. Which Controls Are Measured For Evidence The Evidence section does not measure every control. A control is included when it is applicable and not a linked copy of another control, and then when either of the following is true: - it is expected to hold evidence directly — it has no structural sub-controls beneath it, and it is not a criteria-level heading such as a SOC 2 Trust Services Criterion - it actually has evidence attached, whatever its position in the hierarchy Two consequences are worth understanding: Parent controls with structural sub-controls are not measured directly. Their sub-controls are measured instead. Attaching evidence to the parent of a broken-down control does not raise the score — attach it to the sub-controls that need it. In ISO 27001, a control with attached supporting sub-controls can still hold its own evidence, and that evidence is counted. Attaching a shared sub-control to a control does not stop the control itself from carrying evidence. If it has its own evidence, it is scored on its own; if it has none, it stays out of the calculation and its sub-controls carry the coverage. Controls marked not applicable or accepted as an exception are excluded from the Evidence section entirely. They do not need evidence, so counting them as uncovered would understate your position. When The Number Updates Progress is recalculated in the background whenever meaningful work is recorded, including: - editing, publishing, or assigning a policy document, and completing an acknowledgement round - generating a control description, linking a policy, adding implementation notes, or marking a control implemented - adding evidence to a control, and any change to that evidence's state — submitted, verified, rejected, or expired - an automated evidence check returning a new result - assessing or treating a risk - creating or completing a business continuity exercise - preparing or finishing a vendor assessment - adding an asset - starting or finishing an assessment There is no nightly recalculation. The number is event-driven, so it updates within moments of the action rather than on a schedule. Recalculation runs in the background — if a percentage looks stale immediately after a bulk change, refresh the page after a few seconds. Raising Your Percentage In rough order of return on effort: 1. Look for empty sections first. Recording a handful of vendors or a single infrastructure asset can move the overall number several points, because each section carries a fixed 10-20% share. 2. Finish acknowledgement rounds. A published document sits at 30% until assignments go out and people respond. Chasing the last few acknowledgements converts 30% into 100% for that document. 3. Verify evidence rather than leaving it submitted. Submitted evidence scores 50%; verified scores 100%. For automated sources, a passing check gets you to 100% without manual review. 4. Mark genuinely irrelevant controls as not applicable. This scores them as complete in the Controls section and removes them from the Evidence section. 5. Assess risks you have already identified. An identified-but-unassessed risk scores zero; assessing it scores full. 6. Complete a business continuity exercise. A planned exercise is worth 50%, a completed one 100%. Troubleshooting "My evidence percentage is lower than I expected, but my sub-controls all have evidence." Check whether evidence is attached to parent controls that have structural sub-controls beneath them. Those parents are not measured; their sub-controls are. Also check for sub-controls with no evidence at all — a single uncovered control scores zero and pulls the average down more than a partially covered one. "I marked controls as not applicable and nothing changed." Not-applicable controls score 100% in the Controls section and are removed from the Evidence section. If neither number moved, confirm the status saved and that the controls belong to a section that is in scope. "Two of my projects show the same score for risks and vendors." That is expected. Those sections are account-wide. See "Three Rules That Surprise People" above. "The number did not change after I did the work." Recalculation is queued in the background rather than run on the spot. Give it a few seconds and reload. If it still has not moved, the item you changed may not affect a scored state — for example, editing the description of an already-implemented control does not change its score, because it is already at 100%.