---
title: "complyform assess"
description: "Map resources to framework controls and produce compliance findings."
---

Map scanned resources to framework controls and produce compliance findings.

## Usage

```bash
complyform assess [options]
```

## Options

| Flag | Type | Default | Description |
|---|---|---|---|
| `--frameworks` | string | — | Comma-separated framework IDs to assess against |
| `--format` | `json\|terminal\|html\|sarif` | `terminal` | Output format. SARIF = v2.1.0 (all tiers). HTML requires Pro+. |
| `--severity` | `critical\|high\|all` | `all` | Filter findings by minimum severity |
| `--attest` | bool | `false` | Produce in-toto v1 attestation. Unsigned at all tiers. Ed25519-signed at Team+ (SPEC-017). |
| `--attest-output` | path | `./attestation.json` | Attestation output path |
| `--cross-validate` | bool | `false` | Cross-validate against cloud-native CSPM tools (SCC, Security Hub, Defender). Team+. |
| `--iam-analysis` | bool | `false` | Include IAM least-privilege analysis. Team+. |
| `--estimate-cost` | bool | `false` | Include compliance cost impact estimation. Team+. |
| `--explain` | bool | `false` | Append deterministic explanations for FAIL findings. Add `--ai` for AI-enhanced (Pro+). (SPEC-003) |
| `--no-upgrade-hints` | bool | `false` | Suppress framework overlap upsell section (SPEC-004) |

## Examples

Assess against SOC 2:

```bash
complyform assess --frameworks=soc2
```

JSON output for CI pipelines:

```bash
complyform assess --frameworks=soc2 --format=json
```

SARIF for GitHub Code Scanning:

```bash
complyform assess --frameworks=soc2 --format=sarif
```

Multi-framework assessment:

```bash
complyform assess --frameworks=soc2,hipaa,iso27001
```

Full cloud intelligence stack (Team+):

```bash
complyform assess --frameworks=soc2 --cross-validate --iam-analysis --estimate-cost
```

## Related Commands

- [`scan`](/cli-reference/scan/) — Discover resources before assessment
- [`remediate`](/cli-reference/remediate/) — Generate patches for failing controls
- [`report`](/cli-reference/report/) — Generate compliance reports
- [`export`](/cli-reference/export/) — Export results to GRC platforms
