Score your cluster against the frameworks you answer to, and close each gap.

Reads the policies you run

It does not tell you to fix what you already fixed.

• A control already refused by one of your Kyverno policies is marked as guarded, with the policy named.
• A policy in Audit mode is not counted as protection. It watches; it does not refuse.
• A rule AuthFI cannot read is named as untranslated, never quietly assumed to cover you.
• Your Kyverno rules appear on the Policy page beside every other rule in force.

Writes the ones you are missing

Copy a complete policy, ready to apply.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privilege-escalation
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: disallow-privilege-escalation
      match:
        any:
          - resources:
              kinds: [Pod]
      validate:
        message: Containers must not allow privilege escalation
        pattern:
          spec:
            =(containers):
              - securityContext:
                  allowPrivilegeEscalation: "false"

Exported policies are set to Audit, so nothing breaks until you choose to enforce.