Repository: aquasecurity/starboard
Pull request #1009 (2022-03-09 09:30:57)

Feat/compilace report severity support
- Add severity field and data to the compliance crd (spec and status)
- Add severity field and data to the compliance detail report 

codecov[bot]: # [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) Report
> Merging [#1009](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (e8e1fc6) into [main](https://codecov.io/gh/aquasecurity/starboard/commit/0f837424d9505036015389e4815e08fa60a6d8b9?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) (0f83742) will **decrease** coverage by `16.73%`.
> The diff coverage is `100.00%`.

> :exclamation: Current head e8e1fc6 differs from pull request most recent head 6050275. Consider uploading reports for the commit 6050275 to get more accurate results

[![Impacted file tree graph](https://codecov.io/gh/aquasecurity/starboard/pull/1009/graphs/tree.svg?width=650&height=150&src=pr&token=qqTGKAJ0Wb&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)

```diff
@@             Coverage Diff             @@
##             main    #1009       +/-   ##
===========================================
- Coverage   57.98%   41.25%   -16.74%     
===========================================
  Files          70       53       -17     
  Lines        9095     7880     -1215     
===========================================
- Hits         5274     3251     -2023     
- Misses       3296     4434     +1138     
+ Partials      525      195      -330     
```


| [Impacted Files](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | Coverage Δ | |
|---|---|---|
| [pkg/compliance/io.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbXBsaWFuY2UvaW8uZ28=) | `86.90% <100.00%> (ø)` | |
| [pkg/plugin/factory.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3BsdWdpbi9mYWN0b3J5Lmdv) | `0.00% <0.00%> (-81.49%)` | :arrow_down: |
| [pkg/kubehunter/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-74.49%)` | :arrow_down: |
| [pkg/kube/runnable\_job.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmUvcnVubmFibGVfam9iLmdv) | `0.00% <0.00%> (-63.73%)` | :arrow_down: |
| [pkg/kubehunter/model.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2t1YmVodW50ZXIvbW9kZWwuZ28=) | `0.00% <0.00%> (-62.86%)` | :arrow_down: |
| [pkg/configauditreport/controller.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L2NvbnRyb2xsZXIuZ28=) | `0.00% <0.00%> (-60.78%)` | :arrow_down: |
| [pkg/vulnerabilityreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL3Z1bG5lcmFiaWxpdHlyZXBvcnQvc2Nhbm5lci5nbw==) | `0.00% <0.00%> (-59.44%)` | :arrow_down: |
| [pkg/operator/controller/vulnerabilityreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvdnVsbmVyYWJpbGl0eXJlcG9ydC5nbw==) | `0.00% <0.00%> (-58.85%)` | :arrow_down: |
| [pkg/configauditreport/scanner.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL2NvbmZpZ2F1ZGl0cmVwb3J0L3NjYW5uZXIuZ28=) | `0.00% <0.00%> (-55.56%)` | :arrow_down: |
| [pkg/operator/controller/ciskubebenchreport.go](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity#diff-cGtnL29wZXJhdG9yL2NvbnRyb2xsZXIvY2lza3ViZWJlbmNocmVwb3J0Lmdv) | `0.00% <0.00%> (-54.59%)` | :arrow_down: |
| ... and [32 more](https://codecov.io/gh/aquasecurity/starboard/pull/1009/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Last update [b1fd2cb...6050275](https://codecov.io/gh/aquasecurity/starboard/pull/1009?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aquasecurity).


Patch:
diff --git a/deploy/crd/clustercompliancereports.crd.yaml b/deploy/crd/clustercompliancereports.crd.yaml
index ebcbd8e..21bf48b 100644
--- a/deploy/crd/clustercompliancereports.crd.yaml
+++ b/deploy/crd/clustercompliancereports.crd.yaml
@@ -78,6 +78,7 @@ spec:
                       - id
                       - kinds
                       - mapping
+                      - severity
                     properties:
                       name:
                         type: string
@@ -111,6 +112,15 @@ spec:
                                 id:
                                   type: string
                                   description: 'id define the check id as produced by scanner'
+                      severity:
+                        type: string
+                        description: 'define the severity of the control'
+                        enum:
+                          - CRITICAL
+                          - HIGH
+                          - MEDIUM
+                          - LOW
+                          - UNKNOWN
             status:
               x-kubernetes-preserve-unknown-fields: true
               type: object
diff --git a/deploy/helm/templates/specs/nsa-1.0.yaml b/deploy/helm/templates/specs/nsa-1.0.yaml
index b116559..50279f7 100644
--- a/deploy/helm/templates/specs/nsa-1.0.yaml
+++ b/deploy/helm/templates/specs/nsa-1.0.yaml
@@ -19,6 +19,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV012
+      severity: 'MEDIUM'
     - name: Immutable container file systems
       description: 'Check that container root file system is immutable'
       id: '1.1'
@@ -28,6 +29,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV014
+      severity: 'LOW'
     - name: Preventing privileged containers
       description: 'Controls whether Pods can run privileged containers'
       id: '1.2'
@@ -37,6 +39,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV017
+      severity: 'HIGH'
     - name: Share containers process namespaces
       description: 'Controls whether containers can share process namespaces'
       id: '1.3'
@@ -46,6 +49,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV008
+      severity: 'HIGH'
     - name: Share host process namespaces.
       description: 'Controls whether share host process namespaces'
       id: '1.4'
@@ -55,6 +59,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV009
+      severity: 'HIGH'
     - name: use the host network
       description: 'Controls whether containers can use the host network'
       id: '1.5'
@@ -64,6 +69,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV010
+      severity: 'HIGH'
     - name:  Run with root privileges or with root group membership
       description: 'Controls whether container applications can run with root privileges or with root group membership'
       id: '1.6'
@@ -73,6 +79,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV029
+      severity: 'LOW'
     - name: Restricts escalation to root privileges
       description: 'Control check restrictions escalation to root privileges'
       id: '1.7'
@@ -82,6 +89,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV001
+      severity: 'MEDIUM'
     - name: Sets the SELinux context of the container
       description: 'Control checks if pod sets the SELinux context of the container'
       id: '1.8'
@@ -91,6 +99,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV002
+      severity: 'MEDIUM'
     - name: Restrict a container's access to resources with AppArmor
       description: 'Control checks the restriction of containers access to resources with AppArmor'
       id: '1.9'
@@ -100,6 +109,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV030
+      severity: 'MEDIUM'
     - name: Sets the seccomp profile used to sandbox containers.
       description: 'Control checks the sets the seccomp profile used to sandbox containers'
       id: '1.10'
@@ -108,7 +118,8 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV036
+          - id: KSV030
+      severity: 'LOW'
     - name: Protecting Pod service account tokens
       description: 'Control check whether disable secret token been mount ,automountServiceAccountToken: false'
       id: '1.11'
@@ -117,7 +128,8 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV037
+          - id: KSV036
+      severity: 'MEDIUM'
     - name: Namespace kube-system should not be used by users
       description: 'Control check whether Namespace kube-system is not be used by users'
       id: '1.12'
@@ -126,9 +138,10 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV038
-    - name: Pod and/or namespace Selectors usage / deny all ingress and egress policies are define
-      description: 'Control check validate pod and/or namespace Selectors usage / deny all ingress and egress policies are define'
+          - id: KSV037
+      severity: 'MEDIUM'
+    - name: Pod and/or namespace Selectors usage
+      description: 'Control check validate the pod and/or namespace Selectors usage'
       id: '2.0'
       kinds:
         - Workload
@@ -136,6 +149,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV038
+      severity: 'MEDIUM'
     - name: Use CNI plugin that supports NetworkPolicy API
       description: 'Control check whether check cni plugin installed	'
       id: '3.0'
@@ -145,6 +159,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 5.3.1
+      severity: 'CRITICAL'
     - name: Use ResourceQuota policies to limit resources
       description: 'Control check the use of ResourceQuota policies to limit resources'
       id: '4.0'
@@ -154,6 +169,7 @@ spec:
         scanner: config-audit
         checks:
           - id: "<check need to be added>"
+      severity: 'CRITICAL'
     - name: Control plan disable insecure port
       description: 'Control check whether control plan disable insecure port'
       id: '5.0'
@@ -163,6 +179,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.19
+      severity: 'CRITICAL'
     - name: Encrypt etcd communication
       description: 'Control check whether etcd communication is encrypted'
       id: '5.1'
@@ -172,6 +189,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: '2.1'
+      severity: 'CRITICAL'
     - name: Ensure kube config file permission
       description: 'Control check whether kube config file permissions'
       id: '6.0'
@@ -182,6 +200,7 @@ spec:
         checks:
           - id: 4.1.3
           - id: 4.1.4
+      severity: 'CRITICAL'
     - name: Check that encryption resource has been set
       description: 'Control checks whether encryption resource has been set'
       id: '6.1'
@@ -190,8 +209,9 @@ spec:
       mapping:
         scanner: kube-bench
         checks:
-          - id: 1.2.31"
-          - id: 1.2.32"
+          - id: 1.2.31
+          - id: 1.2.32
+      severity: 'CRITICAL'
     - name: Check encryption provider
       description: 'Control checks whether encryption provider has been set'
       id: '6.2'
@@ -201,6 +221,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.3
+      severity: 'CRITICAL'
     - name: Make sure anonymous-auth is unset
       description: 'Control checks whether anonymous-auth is unset'
       id: '7.0'
@@ -210,6 +231,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.1
+      severity: 'CRITICAL'
     - name: Make sure -authorization-mode=RBAC
       description: 'Control check whether RBAC permission is in use'
       id: '7.1'
@@ -220,6 +242,7 @@ spec:
         checks:
           - id: 1.2.7
           - id: 1.2.8
+      severity: 'CRITICAL'
     - name: Audit policy is configure
       description: 'Control check whether audit policy is configure'
       id: '8.0'
@@ -229,6 +252,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 3.2.1
+      severity: 'HIGH'
     - name: Audit log path is configure
       description: 'Control check whether audit log path is configure'
       id: '8.1'
@@ -238,6 +262,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.22
+      severity: 'MEDIUM'
     - name: Audit log aging
       description: 'Control check whether audit log aging is configure'
       id: '8.2'
@@ -247,6 +272,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.23
+      severity: 'MEDIUM'
     - name: Service mesh is configure
       description: 'Control check whether service mesh is used in cluster'
       id: '9.0'
@@ -255,4 +281,5 @@ spec:
       mapping:
         scanner: kube-bench
         checks:
-          - id: "<check need to be added>"
\ No newline at end of file
+          - id: "<check need to be added>"
+      severity: 'MEDIUM'
diff --git a/deploy/static/starboard.yaml b/deploy/static/starboard.yaml
index ddf4861..da7cb82 100644
--- a/deploy/static/starboard.yaml
+++ b/deploy/static/starboard.yaml
@@ -486,6 +486,7 @@ spec:
                       - id
                       - kinds
                       - mapping
+                      - severity
                     properties:
                       name:
                         type: string
@@ -519,6 +520,15 @@ spec:
                                 id:
                                   type: string
                                   description: 'id define the check id as produced by scanner'
+                      severity:
+                        type: string
+                        description: 'define the severity of the control'
+                        enum:
+                          - CRITICAL
+                          - HIGH
+                          - MEDIUM
+                          - LOW
+                          - UNKNOWN
             status:
               x-kubernetes-preserve-unknown-fields: true
               type: object
@@ -1969,7 +1979,6 @@ spec:
             readOnlyRootFilesystem: true
       securityContext:
         {}
-
 ---
 apiVersion: aquasecurity.github.io/v1alpha1
 kind: ClusterComplianceReport
@@ -1991,6 +2000,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV012
+      severity: 'MEDIUM'
     - name: Immutable container file systems
       description: 'Check that container root file system is immutable'
       id: '1.1'
@@ -2000,6 +2010,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV014
+      severity: 'LOW'
     - name: Preventing privileged containers
       description: 'Controls whether Pods can run privileged containers'
       id: '1.2'
@@ -2009,6 +2020,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV017
+      severity: 'HIGH'
     - name: Share containers process namespaces
       description: 'Controls whether containers can share process namespaces'
       id: '1.3'
@@ -2018,6 +2030,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV008
+      severity: 'HIGH'
     - name: Share host process namespaces.
       description: 'Controls whether share host process namespaces'
       id: '1.4'
@@ -2027,6 +2040,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV009
+      severity: 'HIGH'
     - name: use the host network
       description: 'Controls whether containers can use the host network'
       id: '1.5'
@@ -2036,6 +2050,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV010
+      severity: 'HIGH'
     - name:  Run with root privileges or with root group membership
       description: 'Controls whether container applications can run with root privileges or with root group membership'
       id: '1.6'
@@ -2045,6 +2060,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV029
+      severity: 'LOW'
     - name: Restricts escalation to root privileges
       description: 'Control check restrictions escalation to root privileges'
       id: '1.7'
@@ -2054,6 +2070,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV001
+      severity: 'MEDIUM'
     - name: Sets the SELinux context of the container
       description: 'Control checks if pod sets the SELinux context of the container'
       id: '1.8'
@@ -2063,6 +2080,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV002
+      severity: 'MEDIUM'
     - name: Restrict a container's access to resources with AppArmor
       description: 'Control checks the restriction of containers access to resources with AppArmor'
       id: '1.9'
@@ -2072,6 +2090,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV030
+      severity: 'MEDIUM'
     - name: Sets the seccomp profile used to sandbox containers.
       description: 'Control checks the sets the seccomp profile used to sandbox containers'
       id: '1.10'
@@ -2080,7 +2099,8 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV036
+          - id: KSV030
+      severity: 'LOW'
     - name: Protecting Pod service account tokens
       description: 'Control check whether disable secret token been mount ,automountServiceAccountToken: false'
       id: '1.11'
@@ -2089,7 +2109,8 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV037
+          - id: KSV036
+      severity: 'MEDIUM'
     - name: Namespace kube-system should not be used by users
       description: 'Control check whether Namespace kube-system is not be used by users'
       id: '1.12'
@@ -2098,9 +2119,10 @@ spec:
       mapping:
         scanner: config-audit
         checks:
-          - id: KSV038
-    - name: Pod and/or namespace Selectors usage / deny all ingress and egress policies are define
-      description: 'Control check validate pod and/or namespace Selectors usage / deny all ingress and egress policies are define'
+          - id: KSV037
+      severity: 'MEDIUM'
+    - name: Pod and/or namespace Selectors usage
+      description: 'Control check validate the pod and/or namespace Selectors usage'
       id: '2.0'
       kinds:
         - Workload
@@ -2108,6 +2130,7 @@ spec:
         scanner: config-audit
         checks:
           - id: KSV038
+      severity: 'MEDIUM'
     - name: Use CNI plugin that supports NetworkPolicy API
       description: 'Control check whether check cni plugin installed	'
       id: '3.0'
@@ -2117,6 +2140,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 5.3.1
+      severity: 'CRITICAL'
     - name: Use ResourceQuota policies to limit resources
       description: 'Control check the use of ResourceQuota policies to limit resources'
       id: '4.0'
@@ -2126,6 +2150,7 @@ spec:
         scanner: config-audit
         checks:
           - id: "<check need to be added>"
+      severity: 'CRITICAL'
     - name: Control plan disable insecure port
       description: 'Control check whether control plan disable insecure port'
       id: '5.0'
@@ -2135,6 +2160,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.19
+      severity: 'CRITICAL'
     - name: Encrypt etcd communication
       description: 'Control check whether etcd communication is encrypted'
       id: '5.1'
@@ -2144,6 +2170,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: '2.1'
+      severity: 'CRITICAL'
     - name: Ensure kube config file permission
       description: 'Control check whether kube config file permissions'
       id: '6.0'
@@ -2154,6 +2181,7 @@ spec:
         checks:
           - id: 4.1.3
           - id: 4.1.4
+      severity: 'CRITICAL'
     - name: Check that encryption resource has been set
       description: 'Control checks whether encryption resource has been set'
       id: '6.1'
@@ -2162,8 +2190,9 @@ spec:
       mapping:
         scanner: kube-bench
         checks:
-          - id: 1.2.31"
-          - id: 1.2.32"
+          - id: 1.2.31
+          - id: 1.2.32
+      severity: 'CRITICAL'
     - name: Check encryption provider
       description: 'Control checks whether encryption provider has been set'
       id: '6.2'
@@ -2173,6 +2202,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.3
+      severity: 'CRITICAL'
     - name: Make sure anonymous-auth is unset
       description: 'Control checks whether anonymous-auth is unset'
       id: '7.0'
@@ -2182,6 +2212,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.1
+      severity: 'CRITICAL'
     - name: Make sure -authorization-mode=RBAC
       description: 'Control check whether RBAC permission is in use'
       id: '7.1'
@@ -2192,6 +2223,7 @@ spec:
         checks:
           - id: 1.2.7
           - id: 1.2.8
+      severity: 'CRITICAL'
     - name: Audit policy is configure
       description: 'Control check whether audit policy is configure'
       id: '8.0'
@@ -2201,6 +2233,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 3.2.1
+      severity: 'HIGH'
     - name: Audit log path is configure
       description: 'Control check whether audit log path is configure'
       id: '8.1'
@@ -2210,6 +2243,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.22
+      severity: 'MEDIUM'
     - name: Audit log aging
       description: 'Control check whether audit log aging is configure'
       id: '8.2'
@@ -2219,6 +2253,7 @@ spec:
         scanner: kube-bench
         checks:
           - id: 1.2.23
+      severity: 'MEDIUM'
     - name: Service mesh is configure
       description: 'Control check whether service mesh is used in cluster'
       id: '9.0'
@@ -2227,4 +2262,5 @@ spec:
       mapping:
         scanner: kube-bench
         checks:
-          - id: "<check need to be added>"
\ No newline at end of file
+          - id: "<check need to be added>"
+      severity: 'MEDIUM'
\ No newline at end of file
diff --git a/pkg/apis/aquasecurity/v1alpha1/compliance_types.go b/pkg/apis/aquasecurity/v1alpha1/compliance_types.go
index 9bedf80..9bf4184 100644
--- a/pkg/apis/aquasecurity/v1alpha1/compliance_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/compliance_types.go
@@ -37,6 +37,7 @@ type Control struct {
 	Description string   `json:"description,,omitempty"`
 	Kinds       []string `json:"kinds"`
 	Mapping     Mapping  `json:"mapping"`
+	Severity    Severity `json:"severity"`
 }
 
 //SpecCheck represent the scanner who perform the control check
@@ -67,10 +68,10 @@ type ReportStatus struct {
 
 // ControlCheck provides the result of conducting a single audit step.
 type ControlCheck struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	Description string `json:"description,omitempty"`
-	PassTotal   int    `json:"passTotal"`
-	FailTotal   int    `json:"failTotal"`
-	Severity    string `json:"severity"`
+	ID          string   `json:"id"`
+	Name        string   `json:"name"`
+	Description string   `json:"description,omitempty"`
+	PassTotal   int      `json:"passTotal"`
+	FailTotal   int      `json:"failTotal"`
+	Severity    Severity `json:"severity"`
 }
diff --git a/pkg/apis/aquasecurity/v1alpha1/compliancedetail_types.go b/pkg/apis/aquasecurity/v1alpha1/compliancedetail_types.go
index 5671e62..8032edf 100644
--- a/pkg/apis/aquasecurity/v1alpha1/compliancedetail_types.go
+++ b/pkg/apis/aquasecurity/v1alpha1/compliancedetail_types.go
@@ -40,6 +40,7 @@ type ControlCheckDetails struct {
 	ID                 string               `json:"id"`
 	Name               string               `json:"name"`
 	Description        string               `json:"description,omitempty"`
+	Severity           Severity             `json:"severity"`
 	ScannerCheckResult []ScannerCheckResult `json:"checkResults"`
 }
 
diff --git a/pkg/compliance/io.go b/pkg/compliance/io.go
index 1ee3a21..2846000 100644
--- a/pkg/compliance/io.go
+++ b/pkg/compliance/io.go
@@ -162,7 +162,12 @@ func (w *cm) controlChecksByScannerChecks(smd *specDataMapping, checkIdsToResult
 		}
 		control, ok := smd.controlIDControlObject[controlID]
 		if ok {
-			controlChecks = append(controlChecks, v1alpha1.ControlCheck{ID: controlID, Name: control.Name, Description: control.Description, PassTotal: passTotal, FailTotal: failTotal})
+			controlChecks = append(controlChecks, v1alpha1.ControlCheck{ID: controlID,
+				Name:        control.Name,
+				Description: control.Description,
+				Severity:    control.Severity,
+				PassTotal:   passTotal,
+				FailTotal:   failTotal})
 		}
 	}
 	return controlChecks
@@ -187,7 +192,11 @@ func (w *cm) controlChecksDetailsByScannerChecks(smd *specDataMapping, checkIdsT
 						ctt = v1alpha1.ScannerCheckResult{ID: checkResult.ID, ObjectType: checkResult.ObjectType, Remediation: checkResult.Remediation, Details: rds}
 						ctta = append(ctta, ctt)
 					}
-					controlChecks = append(controlChecks, v1alpha1.ControlCheckDetails{ID: controlID, Name: control.Name, Description: control.Description, ScannerCheckResult: ctta})
+					controlChecks = append(controlChecks, v1alpha1.ControlCheckDetails{ID: controlID,
+						Name:               control.Name,
+						Description:        control.Description,
+						Severity:           control.Severity,
+						ScannerCheckResult: ctta})
 				}
 			}
 		}


Test patch:
diff --git a/pkg/compliance/io_test.go b/pkg/compliance/io_test.go
index 3e97cdd..333c5ae 100644
--- a/pkg/compliance/io_test.go
+++ b/pkg/compliance/io_test.go
@@ -29,10 +29,10 @@ func TestPopulateSpecDataToMaps(t *testing.T) {
 			scannerResourceListNames: map[string]*hashset.Set{"config-audit": hashset.New("Job", "Pod", "ReplicationController", "ReplicaSet", "StatefulSet", "DaemonSet", "CronJob"),
 				"kube-bench": hashset.New("Node")},
 			controlIDControlObject: map[string]v1alpha1.Control{"1.0": {ID: "1.0", Name: "Non-root containers",
-				Kinds:   []string{"Job", "Pod", "ReplicationController", "ReplicaSet", "StatefulSet", "DaemonSet", "CronJob"},
+				Kinds: []string{"Job", "Pod", "ReplicationController", "ReplicaSet", "StatefulSet", "DaemonSet", "CronJob"}, Severity: "MEDIUM",
 				Mapping: v1alpha1.Mapping{Scanner: "config-audit", Checks: []v1alpha1.SpecCheck{{ID: "KSV012"}}}}, "8.1": {ID: "8.1", Name: "Audit log path is configure",
 				Kinds:   []string{"Node"},
-				Mapping: v1alpha1.Mapping{Scanner: "kube-bench", Checks: []v1alpha1.SpecCheck{{ID: "1.2.22"}}}}},
+				Mapping: v1alpha1.Mapping{Scanner: "kube-bench", Checks: []v1alpha1.SpecCheck{{ID: "1.2.22"}}}, Severity: "MEDIUM"}},
 			controlCheckIds: map[string][]string{"1.0": {"KSV012"}, "8.1": {"1.2.22"}}}},
 		{name: "spec file with no controls", specPath: "./testdata/fixture/nsa-1.0_no_controls.yaml"}}
 
@@ -77,7 +77,7 @@ func TestControlChecksByScannerChecks(t *testing.T) {
 		mapScannerResult map[string][]*ScannerCheckResult
 		want             []v1alpha1.ControlCheck
 	}{
-		{name: " control checks by scanner checks", specPath: "./testdata/fixture/nsa-1.0.yaml", want: []v1alpha1.ControlCheck{{ID: "1.0", Name: "Non-root containers", PassTotal: 1, FailTotal: 0}, {ID: "8.1", Name: "Audit log path is configure", PassTotal: 0, FailTotal: 1}},
+		{name: " control checks by scanner checks", specPath: "./testdata/fixture/nsa-1.0.yaml", want: []v1alpha1.ControlCheck{{ID: "1.0", Name: "Non-root containers", PassTotal: 1, FailTotal: 0, Severity: "MEDIUM"}, {ID: "8.1", Name: "Audit log path is configure", PassTotal: 0, FailTotal: 1, Severity: "MEDIUM"}},
 			mapScannerResult: map[string][]*ScannerCheckResult{
 				"KSV012": {{ID: "1.0", Remediation: "aaa", Details: []ResultDetails{{Status: "pass"}}}},
 				"1.2.22": {{ID: "2.0", Remediation: "bbb", Details: []ResultDetails{{Status: "fail"}}}},
@@ -85,21 +85,25 @@ func TestControlChecksByScannerChecks(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			specData, err := ioutil.ReadFile(tt.specPath)
-			if err != nil {
-				t.Errorf(err.Error())
-			}
+			assert.NoError(t, err)
 			var spec v1alpha1.ReportSpec
 			err = yaml.Unmarshal(specData, &spec)
-			if err != nil {
-				t.Errorf(err.Error())
-			}
+			assert.NoError(t, err)
 			sm := mgr.populateSpecDataToMaps(spec)
 			controlChecks := mgr.controlChecksByScannerChecks(sm, tt.mapScannerResult)
+			sort.Sort(scannerCheckSort(controlChecks))
+			sort.Sort(scannerCheckSort(tt.want))
 			assert.True(t, reflect.DeepEqual(controlChecks, tt.want))
 		})
 	}
 }
 
+type scannerCheckSort []v1alpha1.ControlCheck
+
+func (a scannerCheckSort) Len() int           { return len(a) }
+func (a scannerCheckSort) Less(i, j int) bool { return a[i].ID < a[j].ID }
+func (a scannerCheckSort) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+
 func TestGetTotals(t *testing.T) {
 	mgr := cm{}
 	tests := []struct {
diff --git a/pkg/compliance/testdata/fixture/clusterComplianceDetailReport.json b/pkg/compliance/testdata/fixture/clusterComplianceDetailReport.json
index 37b1aef..34753d3 100644
--- a/pkg/compliance/testdata/fixture/clusterComplianceDetailReport.json
+++ b/pkg/compliance/testdata/fixture/clusterComplianceDetailReport.json
@@ -7,7 +7,7 @@
     "creationTimestamp": null
   },
   "report": {
-    "updateTimestamp": "2022-02-26T14:05:29Z",
+    "updateTimestamp": "2022-03-09T08:47:03Z",
     "type": {
       "specKind": "compliance",
       "name": "nsa-details",
@@ -22,6 +22,8 @@
       {
         "id": "1.1",
         "name": "Immutable container file systems",
+        "description": "Check that container root file system is immutable",
+        "severity": "LOW",
         "checkResults": [
           {
             "objectType": "Pod",
@@ -60,6 +62,8 @@
       {
         "id": "3.0",
         "name": "Use CNI plugin that supports NetworkPolicy API",
+        "description": "Control check whether check cni plugin installed\t",
+        "severity": "CRITICAL",
         "checkResults": [
           {
             "objectType": "Node",
@@ -79,6 +83,8 @@
       {
         "id": "6.0",
         "name": "Ensure kube config file permission",
+        "description": "Control check whether kube config file permissions",
+        "severity": "CRITICAL",
         "checkResults": [
           {
             "objectType": "Node",
@@ -98,6 +104,8 @@
       {
         "id": "6.0",
         "name": "Ensure kube config file permission",
+        "description": "Control check whether kube config file permissions",
+        "severity": "CRITICAL",
         "checkResults": [
           {
             "objectType": "Node",
diff --git a/pkg/compliance/testdata/fixture/clusterComplianceReport.json b/pkg/compliance/testdata/fixture/clusterComplianceReport.json
index ec691dd..0314ebb 100644
--- a/pkg/compliance/testdata/fixture/clusterComplianceReport.json
+++ b/pkg/compliance/testdata/fixture/clusterComplianceReport.json
@@ -16,7 +16,7 @@
       {
         "id": "1.0",
         "name": "Non-root containers",
-        "description": "",
+        "description": "Check that container is not running as root",
         "kinds": [
           "Workload"
         ],
@@ -27,12 +27,13 @@
               "id": "KSV012"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "1.1",
         "name": "Immutable container file systems",
-        "description": "",
+        "description": "Check that container root file system is immutable",
         "kinds": [
           "Workload"
         ],
@@ -43,12 +44,13 @@
               "id": "KSV014"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
         "id": "1.2",
         "name": "Preventing privileged containers",
-        "description": "",
+        "description": "Controls whether Pods can run privileged containers",
         "kinds": [
           "Workload"
         ],
@@ -59,12 +61,13 @@
               "id": "KSV017"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "id": "1.3",
-        "name": "share host process namespaces",
-        "description": "",
+        "name": "Share containers process namespaces",
+        "description": "Controls whether containers can share process namespaces",
         "kinds": [
           "Workload"
         ],
@@ -75,12 +78,13 @@
               "id": "KSV008"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "id": "1.4",
-        "name": "share host process namespaces.",
-        "description": "",
+        "name": "Share host process namespaces.",
+        "description": "Controls whether share host process namespaces",
         "kinds": [
           "Workload"
         ],
@@ -91,12 +95,13 @@
               "id": "KSV009"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "id": "1.5",
         "name": "use the host network",
-        "description": "",
+        "description": "Controls whether containers can use the host network",
         "kinds": [
           "Workload"
         ],
@@ -107,12 +112,13 @@
               "id": "KSV010"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "id": "1.6",
-        "name": "applications can run with root privileges or with root group membership",
-        "description": "",
+        "name": "Run with root privileges or with root group membership",
+        "description": "Controls whether container applications can run with root privileges or with root group membership",
         "kinds": [
           "Workload"
         ],
@@ -123,12 +129,13 @@
               "id": "KSV029"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
         "id": "1.7",
-        "name": "Restricts escalation to root privileges.",
-        "description": "",
+        "name": "Restricts escalation to root privileges",
+        "description": "Control check restrictions escalation to root privileges",
         "kinds": [
           "Workload"
         ],
@@ -139,12 +146,13 @@
               "id": "KSV001"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "1.8",
-        "name": "Sets the SELinux context of the container.",
-        "description": "",
+        "name": "Sets the SELinux context of the container",
+        "description": "Control checks if pod sets the SELinux context of the container",
         "kinds": [
           "Workload"
         ],
@@ -155,12 +163,13 @@
               "id": "KSV002"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "1.9",
         "name": "Restrict a container's access to resources with AppArmor",
-        "description": "",
+        "description": "Control checks the restriction of containers access to resources with AppArmor",
         "kinds": [
           "Workload"
         ],
@@ -171,12 +180,13 @@
               "id": "KSV030"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "1.10",
         "name": "Sets the seccomp profile used to sandbox containers.",
-        "description": "",
+        "description": "Control checks the sets the seccomp profile used to sandbox containers",
         "kinds": [
           "Workload"
         ],
@@ -184,15 +194,16 @@
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV036"
+              "id": "KSV030"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
         "id": "1.11",
         "name": "Protecting Pod service account tokens",
-        "description": "",
+        "description": "Control check whether disable secret token been mount ,automountServiceAccountToken: false",
         "kinds": [
           "Workload"
         ],
@@ -200,31 +211,33 @@
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV037"
+              "id": "KSV036"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "1.12",
-        "name": "Namespace kube-system should should not be used by users",
-        "description": "",
+        "name": "Namespace kube-system should not be used by users",
+        "description": "Control check whether Namespace kube-system is not being used by users",
         "kinds": [
-          "Workload"
+          "NetworkPolicy"
         ],
         "mapping": {
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV038"
+              "id": "KSV037"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "2.0",
-        "name": "pod and/or namespace Selectors usage",
-        "description": "",
+        "name": "Pod and/or namespace Selectors usage",
+        "description": "Control check validate pod and/or namespace Selectors usage",
         "kinds": [
           "Workload"
         ],
@@ -235,12 +248,13 @@
               "id": "KSV038"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "3.0",
         "name": "Use CNI plugin that supports NetworkPolicy API",
-        "description": "",
+        "description": "Control check whether check cni plugin installed\t",
         "kinds": [
           "Node"
         ],
@@ -251,44 +265,30 @@
               "id": "5.3.1"
             }
           ]
-        }
-      },
-      {
-        "id": "3.1",
-        "name": "Use a default policy to deny all ingress and egress traffic",
-        "description": "",
-        "kinds": [
-          "NetworkPolicy"
-        ],
-        "mapping": {
-          "scanner": "kube-bench",
-          "checks": [
-            {
-              "id": "<check need to be added>"
-            }
-          ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "4.0",
-        "name": "Use LimitRange and ResourceQuota policies to limit resources",
-        "description": "",
+        "name": "Use ResourceQuota policies to limit resources",
+        "description": "Control check the use of ResourceQuota policies to limit resources",
         "kinds": [
-          "LimitRange"
+          "ResourceQuota"
         ],
         "mapping": {
-          "scanner": "kube-bench",
+          "scanner": "config-audit",
           "checks": [
             {
               "id": "<check need to be added>"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "5.0",
         "name": "Control plan disable insecure port",
-        "description": "",
+        "description": "Control check whether control plan disable insecure port",
         "kinds": [
           "Node"
         ],
@@ -299,12 +299,13 @@
               "id": "1.2.19"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "5.1",
         "name": "Encrypt etcd communication",
-        "description": "",
+        "description": "Control check whether etcd communication is encrypted",
         "kinds": [
           "Node"
         ],
@@ -315,12 +316,13 @@
               "id": "2.1"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "6.0",
         "name": "Ensure kube config file permission",
-        "description": "",
+        "description": "Control check whether kube config file permissions",
         "kinds": [
           "Node"
         ],
@@ -334,28 +336,33 @@
               "id": "4.1.4"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "6.1",
         "name": "Check that encryption resource has been set",
-        "description": "",
+        "description": "Control checks whether encryption resource has been set",
         "kinds": [
-          "EncryptionConfiguration"
+          "Node"
         ],
         "mapping": {
           "scanner": "kube-bench",
           "checks": [
             {
-              "id": "<check need to be added>"
+              "id": "1.2.31"
+            },
+            {
+              "id": "1.2.32"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "6.2",
         "name": "Check encryption provider",
-        "description": "",
+        "description": "Control checks whether encryption provider has been set",
         "kinds": [
           "Node"
         ],
@@ -366,12 +373,13 @@
               "id": "1.2.3"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "7.0",
         "name": "Make sure anonymous-auth is unset",
-        "description": "",
+        "description": "Control checks whether anonymous-auth is unset",
         "kinds": [
           "Node"
         ],
@@ -382,12 +390,13 @@
               "id": "1.2.1"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "7.1",
         "name": "Make sure -authorization-mode=RBAC",
-        "description": "",
+        "description": "Control check whether RBAC permission is in use",
         "kinds": [
           "Node"
         ],
@@ -401,12 +410,13 @@
               "id": "1.2.8"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "id": "8.0",
         "name": "Audit policy is configure",
-        "description": "",
+        "description": "Control check whether audit policy is configure",
         "kinds": [
           "Node"
         ],
@@ -417,12 +427,13 @@
               "id": "3.2.1"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "id": "8.1",
         "name": "Audit log path is configure",
-        "description": "",
+        "description": "Control check whether audit log path is configured",
         "kinds": [
           "Node"
         ],
@@ -433,12 +444,13 @@
               "id": "1.2.22"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "8.2",
         "name": "Audit log aging",
-        "description": "",
+        "description": "Control check whether audit log aging is configure",
         "kinds": [
           "Node"
         ],
@@ -449,12 +461,13 @@
               "id": "1.2.23"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "id": "9.0",
-        "name": "service mesh is configure",
-        "description": "",
+        "name": "Service mesh is configure",
+        "description": "Control check whether service mesh is used in cluster",
         "kinds": [
           "Node"
         ],
@@ -465,212 +478,233 @@
               "id": "<check need to be added>"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       }
     ]
   },
   "status": {
-    "updateTimestamp": "2022-02-26T14:11:39Z",
+    "updateTimestamp": "2022-03-09T08:52:44Z",
     "summary": {
       "passCount": 3,
       "failCount": 3
     },
     "controlCheck": [
       {
-        "id": "1.0",
-        "name": "Non-root containers",
-        "passTotal": 0,
-        "failTotal": 0,
-        "severity": ""
-      },
-      {
-        "id": "1.1",
-        "name": "Immutable container file systems",
-        "passTotal": 0,
-        "failTotal": 3,
-        "severity": ""
-      },
-      {
-        "id": "1.10",
-        "name": "Sets the seccomp profile used to sandbox containers.",
+        "id": "1.3",
+        "name": "Share containers process namespaces",
+        "description": "Controls whether containers can share process namespaces",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "HIGH"
       },
       {
-        "id": "1.11",
-        "name": "Protecting Pod service account tokens",
+        "id": "1.4",
+        "name": "Share host process namespaces.",
+        "description": "Controls whether share host process namespaces",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "HIGH"
       },
       {
         "id": "1.12",
-        "name": "Namespace kube-system should should not be used by users",
+        "name": "Namespace kube-system should not be used by users",
+        "description": "Control check whether Namespace kube-system is not being used by users",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "1.2",
-        "name": "Preventing privileged containers",
+        "id": "8.0",
+        "name": "Audit policy is configure",
+        "description": "Control check whether audit policy is configure",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "HIGH"
       },
       {
-        "id": "1.3",
-        "name": "share host process namespaces",
+        "id": "9.0",
+        "name": "Service mesh is configure",
+        "description": "Control check whether service mesh is used in cluster",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "1.4",
-        "name": "share host process namespaces.",
+        "id": "1.0",
+        "name": "Non-root containers",
+        "description": "Check that container is not running as root",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "1.5",
-        "name": "use the host network",
-        "passTotal": 0,
+        "id": "3.0",
+        "name": "Use CNI plugin that supports NetworkPolicy API",
+        "description": "Control check whether check cni plugin installed\t",
+        "passTotal": 1,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "1.6",
-        "name": "applications can run with root privileges or with root group membership",
+        "id": "7.0",
+        "name": "Make sure anonymous-auth is unset",
+        "description": "Control checks whether anonymous-auth is unset",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "1.7",
-        "name": "Restricts escalation to root privileges.",
+        "id": "1.8",
+        "name": "Sets the SELinux context of the container",
+        "description": "Control checks if pod sets the SELinux context of the container",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "1.8",
-        "name": "Sets the SELinux context of the container.",
+        "id": "1.10",
+        "name": "Sets the seccomp profile used to sandbox containers.",
+        "description": "Control checks the sets the seccomp profile used to sandbox containers",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "LOW"
       },
       {
-        "id": "1.9",
-        "name": "Restrict a container's access to resources with AppArmor",
+        "id": "8.1",
+        "name": "Audit log path is configure",
+        "description": "Control check whether audit log path is configured",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "2.0",
-        "name": "pod and/or namespace Selectors usage",
+        "id": "1.6",
+        "name": "Run with root privileges or with root group membership",
+        "description": "Controls whether container applications can run with root privileges or with root group membership",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "LOW"
       },
       {
-        "id": "3.0",
-        "name": "Use CNI plugin that supports NetworkPolicy API",
-        "passTotal": 1,
+        "id": "1.11",
+        "name": "Protecting Pod service account tokens",
+        "description": "Control check whether disable secret token been mount ,automountServiceAccountToken: false",
+        "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "3.1",
-        "name": "Use a default policy to deny all ingress and egress traffic",
+        "id": "1.5",
+        "name": "use the host network",
+        "description": "Controls whether containers can use the host network",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "HIGH"
       },
       {
-        "id": "4.0",
-        "name": "Use LimitRange and ResourceQuota policies to limit resources",
+        "id": "2.0",
+        "name": "Pod and/or namespace Selectors usage",
+        "description": "Control check validate the pod and/or namespace Selectors usage",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
         "id": "5.0",
         "name": "Control plan disable insecure port",
+        "description": "Control check whether control plan disable insecure port",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "5.1",
-        "name": "Encrypt etcd communication",
+        "id": "7.1",
+        "name": "Make sure -authorization-mode=RBAC",
+        "description": "Control check whether RBAC permission is in use",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "6.0",
-        "name": "Ensure kube config file permission",
-        "passTotal": 2,
+        "id": "1.7",
+        "name": "Restricts escalation to root privileges",
+        "description": "Control check restrictions escalation to root privileges",
+        "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "6.1",
-        "name": "Check that encryption resource has been set",
+        "id": "1.2",
+        "name": "Preventing privileged containers",
+        "description": "Controls whether Pods can run privileged containers",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "HIGH"
       },
       {
-        "id": "6.2",
-        "name": "Check encryption provider",
+        "id": "4.0",
+        "name": "Use ResourceQuota policies to limit resources",
+        "description": "Control check the use of ResourceQuota policies to limit resources",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "7.0",
-        "name": "Make sure anonymous-auth is unset",
+        "id": "8.2",
+        "name": "Audit log aging",
+        "description": "Control check whether audit log aging is configure",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       },
       {
-        "id": "7.1",
-        "name": "Make sure -authorization-mode=RBAC",
+        "id": "1.1",
+        "name": "Immutable container file systems",
+        "description": "Check that container root file system is immutable",
         "passTotal": 0,
+        "failTotal": 3,
+        "severity": "LOW"
+      },
+      {
+        "id": "6.0",
+        "name": "Ensure kube config file permission",
+        "description": "Control check whether kube config file permissions",
+        "passTotal": 2,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "8.0",
-        "name": "Audit policy is configure",
+        "id": "6.1",
+        "name": "Check that encryption resource has been set",
+        "description": "Control checks whether encryption resource has been set",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "8.1",
-        "name": "Audit log path is configure",
+        "id": "6.2",
+        "name": "Check encryption provider",
+        "description": "Control checks whether encryption provider has been set",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "8.2",
-        "name": "Audit log aging",
+        "id": "5.1",
+        "name": "Encrypt etcd communication",
+        "description": "Control check whether etcd communication is encrypted",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "CRITICAL"
       },
       {
-        "id": "9.0",
-        "name": "service mesh is configure",
+        "id": "1.9",
+        "name": "Restrict a container's access to resources with AppArmor",
+        "description": "Control checks the restriction of containers access to resources with AppArmor",
         "passTotal": 0,
         "failTotal": 0,
-        "severity": ""
+        "severity": "MEDIUM"
       }
     ]
   }
diff --git a/pkg/compliance/testdata/fixture/clusterComplianceSpec.json b/pkg/compliance/testdata/fixture/clusterComplianceSpec.json
index c4bec35..5c1b676 100644
--- a/pkg/compliance/testdata/fixture/clusterComplianceSpec.json
+++ b/pkg/compliance/testdata/fixture/clusterComplianceSpec.json
@@ -13,7 +13,7 @@
     "controls": [
       {
         "name": "Non-root containers",
-        "description": "",
+        "description": "Check that container is not running as root",
         "id": "1.0",
         "kinds": [
           "Workload"
@@ -25,11 +25,12 @@
               "id": "KSV012"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "name": "Immutable container file systems",
-        "description": "",
+        "description": "Check that container root file system is immutable",
         "id": "1.1",
         "kinds": [
           "Workload"
@@ -41,11 +42,12 @@
               "id": "KSV014"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
         "name": "Preventing privileged containers",
-        "description": "",
+        "description": "Controls whether Pods can run privileged containers",
         "id": "1.2",
         "kinds": [
           "Workload"
@@ -57,11 +59,12 @@
               "id": "KSV017"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
-        "name": "share host process namespaces",
-        "description": "",
+        "name": "Share containers process namespaces",
+        "description": "Controls whether containers can share process namespaces",
         "id": "1.3",
         "kinds": [
           "Workload"
@@ -73,11 +76,12 @@
               "id": "KSV008"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
-        "name": "share host process namespaces.",
-        "description": "",
+        "name": "Share host process namespaces.",
+        "description": "Controls whether share host process namespaces",
         "id": "1.4",
         "kinds": [
           "Workload"
@@ -89,10 +93,12 @@
               "id": "KSV009"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "name": "use the host network",
+        "description": "Controls whether containers can use the host network",
         "id": "1.5",
         "kinds": [
           "Workload"
@@ -104,11 +110,12 @@
               "id": "KSV010"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
-        "name": "applications can run with root privileges or with root group membership",
-        "description": "",
+        "name": "Run with root privileges or with root group membership",
+        "description": "Controls whether container applications can run with root privileges or with root group membership",
         "id": "1.6",
         "kinds": [
           "Workload"
@@ -120,11 +127,12 @@
               "id": "KSV029"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
-        "name": "Restricts escalation to root privileges.",
-        "description": "",
+        "name": "Restricts escalation to root privileges",
+        "description": "Control check restrictions escalation to root privileges",
         "id": "1.7",
         "kinds": [
           "Workload"
@@ -136,11 +144,12 @@
               "id": "KSV001"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
-        "name": "Sets the SELinux context of the container.",
-        "description": "",
+        "name": "Sets the SELinux context of the container",
+        "description": "Control checks if pod sets the SELinux context of the container",
         "id": "1.8",
         "kinds": [
           "Workload"
@@ -152,11 +161,12 @@
               "id": "KSV002"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "name": "Restrict a container's access to resources with AppArmor",
-        "description": "",
+        "description": "Control checks the restriction of containers access to resources with AppArmor",
         "id": "1.9",
         "kinds": [
           "Workload"
@@ -168,11 +178,12 @@
               "id": "KSV030"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "name": "Sets the seccomp profile used to sandbox containers.",
-        "description": "",
+        "description": "Control checks the sets the seccomp profile used to sandbox containers",
         "id": "1.10",
         "kinds": [
           "Workload"
@@ -181,14 +192,15 @@
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV036"
+              "id": "KSV030"
             }
           ]
-        }
+        },
+        "severity": "LOW"
       },
       {
         "name": "Protecting Pod service account tokens",
-        "description": "",
+        "description": "Control check whether disable secret token been mount ,automountServiceAccountToken: false",
         "id": "1.11",
         "kinds": [
           "Workload"
@@ -197,30 +209,32 @@
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV037"
+              "id": "KSV036"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
-        "name": "Namespace kube-system should should not be used by users",
-        "description": "",
+        "name": "Namespace kube-system should not be used by users",
+        "description": "Control check whether Namespace kube-system is not being used by users",
         "id": "1.12",
         "kinds": [
-          "Workload"
+          "NetworkPolicy"
         ],
         "mapping": {
           "scanner": "config-audit",
           "checks": [
             {
-              "id": "KSV038"
+              "id": "KSV037"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
-        "name": "pod and/or namespace Selectors usage",
-        "description": "",
+        "name": "Pod and/or namespace Selectors usage",
+        "description": "Control check validate the pod and/or namespace Selectors usage",
         "id": "2.0",
         "kinds": [
           "Workload"
@@ -232,11 +246,12 @@
               "id": "KSV038"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "name": "Use CNI plugin that supports NetworkPolicy API",
-        "description": "",
+        "description": "Control check whether check cni plugin installed\t",
         "id": "3.0",
         "kinds": [
           "Node"
@@ -248,43 +263,29 @@
               "id": "5.3.1"
             }
           ]
-        }
-      },
-      {
-        "name": "Use a default policy to deny all ingress and egress traffic",
-        "description": "",
-        "id": "3.1",
-        "kinds": [
-          "NetworkPolicy"
-        ],
-        "mapping": {
-          "scanner": "kube-bench",
-          "checks": [
-            {
-              "id": "<check need to be added>"
-            }
-          ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
-        "name": "Use LimitRange and ResourceQuota policies to limit resources",
-        "description": "",
+        "name": "Use ResourceQuota policies to limit resources",
+        "description": "Control check the use of ResourceQuota policies to limit resources",
         "id": "4.0",
         "kinds": [
-          "LimitRange"
+          "ResourceQuota"
         ],
         "mapping": {
-          "scanner": "kube-bench",
+          "scanner": "config-audit",
           "checks": [
             {
               "id": "<check need to be added>"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Control plan disable insecure port",
-        "description": "",
+        "description": "Control check whether control plan disable insecure port",
         "id": "5.0",
         "kinds": [
           "Node"
@@ -296,11 +297,12 @@
               "id": "1.2.19"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Encrypt etcd communication",
-        "description": "",
+        "description": "Control check whether etcd communication is encrypted",
         "id": "5.1",
         "kinds": [
           "Node"
@@ -312,11 +314,12 @@
               "id": "2.1"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Ensure kube config file permission",
-        "description": "",
+        "description": "Control check whether kube config file permissions",
         "id": "6.0",
         "kinds": [
           "Node"
@@ -331,27 +334,32 @@
               "id": "4.1.4"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Check that encryption resource has been set",
-        "description": "",
+        "description": "Control checks whether encryption resource has been set",
         "id": "6.1",
         "kinds": [
-          "EncryptionConfiguration"
+          "Node"
         ],
         "mapping": {
           "scanner": "kube-bench",
           "checks": [
             {
-              "id": "<check need to be added>"
+              "id": "1.2.31"
+            },
+            {
+              "id": "1.2.32"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Check encryption provider",
-        "description": "",
+        "description": "Control checks whether encryption provider has been set",
         "id": "6.2",
         "kinds": [
           "Node"
@@ -363,11 +371,12 @@
               "id": "1.2.3"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Make sure anonymous-auth is unset",
-        "description": "",
+        "description": "Control checks whether anonymous-auth is unset",
         "id": "7.0",
         "kinds": [
           "Node"
@@ -379,11 +388,12 @@
               "id": "1.2.1"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Make sure -authorization-mode=RBAC",
-        "description": "",
+        "description": "Control check whether RBAC permission is in use",
         "id": "7.1",
         "kinds": [
           "Node"
@@ -398,11 +408,12 @@
               "id": "1.2.8"
             }
           ]
-        }
+        },
+        "severity": "CRITICAL"
       },
       {
         "name": "Audit policy is configure",
-        "description": "",
+        "description": "Control check whether audit policy is configure",
         "id": "8.0",
         "kinds": [
           "Node"
@@ -414,11 +425,12 @@
               "id": "3.2.1"
             }
           ]
-        }
+        },
+        "severity": "HIGH"
       },
       {
         "name": "Audit log path is configure",
-        "description": "",
+        "description": "Control check whether audit log path is configured",
         "id": "8.1",
         "kinds": [
           "Node"
@@ -430,11 +442,12 @@
               "id": "1.2.22"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
         "name": "Audit log aging",
-        "description": "",
+        "description": "Control check whether audit log aging is configure",
         "id": "8.2",
         "kinds": [
           "Node"
@@ -446,11 +459,12 @@
               "id": "1.2.23"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       },
       {
-        "name": "service mesh is configure",
-        "description": "",
+        "name": "Service mesh is configure",
+        "description": "Control check whether service mesh is used in cluster",
         "id": "9.0",
         "kinds": [
           "Node"
@@ -462,7 +476,8 @@
               "id": "<check need to be added>"
             }
           ]
-        }
+        },
+        "severity": "MEDIUM"
       }
     ]
   }
diff --git a/pkg/compliance/testdata/fixture/nsa-1.0.yaml b/pkg/compliance/testdata/fixture/nsa-1.0.yaml
index d0a999e..3d3515b 100644
--- a/pkg/compliance/testdata/fixture/nsa-1.0.yaml
+++ b/pkg/compliance/testdata/fixture/nsa-1.0.yaml
@@ -14,6 +14,7 @@ controls:
       scanner: config-audit
       checks:
         - id: KSV012
+    severity: 'MEDIUM'
   - name: Audit log path is configure
     description: ''
     id: '8.1'
@@ -23,3 +24,4 @@ controls:
       scanner: kube-bench
       checks:
         - id: 1.2.22
+    severity: 'MEDIUM'