Answering audit findings with Iris compliance narration

Answering audit findings with Iris compliance narration

An auditor asks why a device failed a control. The compliance result in rConfig has the answer, but in rule syntax and pass/fail markers. Iris’s compliance narration explains the result in plain English: what each failed rule checks, why the device failed it, why it matters, and what would fix it. That’s most of an audit response, drafted in seconds.

rconfig.comrConfig GenAI: AI config analysis in plain languageThe product overview of the in-app AI capabilities, including the compliance explanations this page turns into audit responses, with your own model and keys or a local one.Read the GenAI overview

What it reads

Narration sends the device name, policy name, overall result, the reason, and the per-rule results. It never sends configuration text, which makes it suitable even where configs may not leave your network: the provider sees rule outcomes, not the config.

The output has four sections:

From narration to audit response

1. Narrate the result. Open the device’s compliance result and click Narrate with AI.
2. Check every explanation against the rule. The model explains what the rule checks from its description and result. Open the policy definition and confirm.
3. Add what the narration can’t know: when the result was evaluated, whether remediation is planned, the ticket reference, the owner and the target date.
4. Adjust the wording (below), then paste it into your response.

An illustrative response, after review:

Finding: core-sw-03 failed "SSH hardening" (evaluated 2026-11-06 02:10).

The device allows SSH version 1, which has known cryptographic weaknesses,
and its VTY lines accept Telnet as well as SSH. Both expose management
credentials to interception.

Remediation: restrict SSH to version 2 and VTY transport to SSH only.
Change CHG0034877, scheduled 2026-11-12. Owner: network operations.

Wording that holds up

• Evidence, not certification. rConfig policies provide evidence towards controls. Say a rule “maps to” a CIS or NIST control; never claim the device or network “is compliant with” a framework.
• Date it. Every result was evaluated against a specific backup. Auditors ask “as of when?”
• Keep the model’s tone out. Remove absolutes (“this is a critical vulnerability”) unless your own risk assessment agrees.

Related reference

• Policy & Compliance Narration: narrate a compliance result
• Compliance overview
• Policy Compliance Results
• Policy Definitions
• What data each capability sends
• Policy Library frameworks
• Audit evidence pack