What changed, and when? Daily snapshots for devices and servers

Passing Cyber Essentials Plus proves the estate was in a good state on the day of the test. It says nothing about the day after. A local administrator added to fix a printer, a firewall profile switched off during troubleshooting, a policy change that quietly re-enables AutoPlay: each one is reasonable at the time, and each one is the kind of change an assessor will find months later.

Configuration Drift: the device view

Configuration Drift takes a daily snapshot of 48 security-relevant settings on every device, each mapped to one of the five Cyber Essentials Plus controls: firewalls, secure configuration, user access control, malware protection and security update management. The server, not the device, works out what changed, so the record does not depend on a device reporting its own mistakes.

• A drift feed of changes since the last snapshot, with the regressions that matter for CE+ at the top.
• Acknowledge with a note and set a fix-by date, so an accepted change is recorded as a decision.
• Position by control, so you can see which of the five themes is moving.
• Fresh, stale or silent. A device that has stopped reporting is shown as silent, so silence is never mistaken for compliance.
• A per-device timeline and a printable PDF report.

Servers: the history of every Windows Server

Servers change less often than laptops, but when they do it matters more, and the question is usually asked after something has broken: what changed on this server, and when? Servers keeps dated snapshots of each Windows Server, daily and on demand, covering installed applications, firewall rules, the hosts file, listening ports, local accounts, shares, certificates, updates, services, scheduled tasks, IIS, SQL Server, Java and Tomcat.

• Show the server as at any date you have a snapshot for.
• Compare any two dates side by side, with what was added and what was removed.
• Secrets are redacted on the server before anything is sent, so they never leave it.
• A report with an executive summary and prioritised observations, and a CSV export.

Using the history well

1. Review the drift feed each morning, or let Proactive AI raise the regressions that affect your CE+ position.
2. Acknowledge expected changes with a note, so the next review only shows what is new.
3. Before a change window, take an on-demand server snapshot. After it, compare the two.
4. Keep the PDF reports with your assessment evidence. They show the estate was watched continuously, not only on assessment day.