A method and apparatus for evaluating one or more assets for compliance to at least one network security policy are disclosed. For example, the method receives a request for evaluating at least one asset for compliance to at least one security policy. The method then performs an evaluation of compliance on the at least one asset to determine compliance of the at least one asset to the at least one security policy. The method then records a result of the evaluation of compliance into a database. Finally, the method tracks the at least one asset that has been deemed to be non-compliant to the at least one security policy over a period of time.