1. A method performed by a computer system for causing an analyzed computer system to comply with a security policy, comprising: receiving a compliance document, the compliance document indicating a compliance criterion and a remediation action, the remediation action indicating an action that the analyzed computer system is to undertake when the analyzed computer system does not comply with the compliance criterion; determining whether the compliance criterion is satisfied; and when the compliance criterion is not satisfied, causing the computer system to undertake the remediation action so that the computer system complies with the security policy.