Docs / Knowledge Base / What Graften assesses automatically
What Graften assesses automatically
Risk & Compliance
Every control Graften assesses automatically, what it measures, and the rule. "Best" is the highest status the automation can give; partial means the rest of the control needs a person's evidence. Where a control has more than one source, the worse measured result counts, and a status a person sets is kept unless a source measures a gap. Anything not listed here is assessed by a person.
APRA CPS 234 — Information Security
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| ASSET-1 Information Asset Identification | Site appliance | the appliance's scheduled network discovery of the approved ranges | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: CPS 234 asks for assets to be identified and classified by criticality and sensitivity. A scan finds devices; it cannot classify them or find third-party-managed assets. | partial |
| CAP-2 Controls Managed by Third Parties | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant: contracts are not read. | partial |
| CTRL-1 Implementation of Controls | Microsoft 365, Entra ID, Google Cloud audit | MFA enforcement, as for E8-3, and EDR coverage of enrolled devices and active threats | As E8-3, capped at partial: MFA is one part of implementing controls. EDR: a gap below 60% coverage or with active threats. The worse of the two counts. | partial |
| CTRL-1 Implementation of Controls | AWS audit | MFA on the AWS root account and on IAM users with console access, and EDR coverage of enrolled devices and active threats | A gap when the root account or any IAM user with console access has no MFA; otherwise partial at most. EDR: a gap below 60% coverage or with active threats. The worse of the two counts. | partial |
| CTRL-1 Implementation of Controls | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches; otherwise partial at most. | partial |
| CTRL-2 Identity and Access Management | Site appliance | the Active Directory default password and lockout policy and the state of its administrator accounts | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are password, lockout and administrator-account settings in one Active Directory domain. MFA, regular access reviews, privileged access management, service account inventory and cloud identities still need a person. The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. | partial |
| CTRL-2 Identity and Access Management | Microsoft 365, Entra ID audit | Global Administrator count against Microsoft's fewer-than-five benchmark, and apps holding privilege-escalating permissions | A gap at 5 or more Global Administrators or with any app holding permissions that can lead to Global Administrator; otherwise partial at most. | partial |
| CTRL-2 Identity and Access Management | AWS audit | active access keys on the AWS root account | A gap when the root account has active access keys; otherwise partial at most. | partial |
| CTRL-2 Identity and Access Management | Google Cloud audit | owner or editor roles granted at project level | A gap when any user holds owner or editor at project level; otherwise partial at most. | partial |
| CTRL-2 Identity and Access Management | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered; otherwise partial at most. | partial |
| CTRL-4 Cryptographic Controls | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, as of the device's last sync with Intune | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This covers encryption at rest on Windows devices that Intune manages, as Intune reports it. Other systems, data in transit and key management still need a person. | partial |
| CTRL-4 Cryptographic Controls | Site appliance | encryption of the system drive on each reachable Windows host (BitLocker) or Linux host (root volume), and the protocol versions and certificate of each listed TLS endpoint | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This covers disk encryption at rest on Windows hosts and, for the TLS endpoints that were listed, that old protocol versions are refused and the certificate is in date and strong. Other systems, endpoints that were not listed, who issued the certificates and key management still need a person. | partial |
| CTRL-4 Cryptographic Controls | Microsoft 365, Entra ID, AWS, Google Cloud audit | S3 bucket encryption and KMS key rotation | AWS: a gap when any S3 bucket has no default encryption or any customer managed KMS key does not rotate; otherwise partial at most. | partial |
| CTRL-5 Operational Controls and Monitoring | Site appliance | Windows audit policy, remote logging and syslog arrival, and the date each reachable Windows host last installed an update (within 30 days) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Audit policy on, logs sent to a remote destination and arriving, and each Windows host updated within 30 days (ASD's one month; CPS 234 sets no number), are parts of operational controls. Log review, the vulnerability management process and the patch SLA still need a person. | partial |
| CTRL-5 Operational Controls and Monitoring | Microsoft 365, Entra ID, AWS, Google Cloud audit | CloudTrail and GCP audit log settings | AWS: a gap when no CloudTrail trail is logging, otherwise partial at most. GCP: partial at most. Microsoft 365: not assessed. | partial |
| CTRL-5 Operational Controls and Monitoring | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| CTRL-5 Operational Controls and Monitoring | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches; otherwise partial at most. | partial |
| INC-1 Incident Detection Capability | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage and active threats, and whether GuardDuty or Security Command Center is on | A gap below 60% EDR coverage, with active threats, or when GuardDuty is off in any enabled AWS region; otherwise partial at most, because detection coverage and response times are not visible. | partial |
| INC-2 IS Incident Response | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as the recovery part of incident response | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant. | partial |
| TEST-1 Control Testing Programme | Vulnerability Scanner | a completed vulnerability scan of the client's domains (rescanned every 30 days) | Partial when a scan has completed; not assessed until one has. Never compliant: the independent penetration test is not covered. | partial |
ASD Essential Eight
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| E8-1 Patch applications | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because patch timeliness is not measured. | partial |
| E8-2 Patch operating systems | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because patch timeliness is not measured. | partial |
| E8-3 Multi-factor authentication | Microsoft 365, Entra ID, Google Cloud audit | MFA enforced for all users and all cloud apps by Conditional Access or Security Defaults, and MFA registration coverage | Compliant when Conditional Access or Security Defaults requires MFA for all users and all cloud apps and at least 95% of enabled users have registered MFA (#991: under Security Defaults too); partial when MFA is required but registration is below 95% or unmeasured; a gap when MFA is not required for everyone. | compliant |
| E8-3 Multi-factor authentication | AWS audit | MFA on the AWS root account and on IAM users with console access | A gap when the root account or any IAM user with console access has no MFA; otherwise partial at most. | partial |
| E8-4 Restrict administrative privileges | Microsoft 365, Entra ID audit | Global Administrator count (including role-assignable groups and PIM-eligible) and apps holding privilege-escalating permissions | A gap above 3 Global Administrators or with any app holding permissions that can lead to Global Administrator; not assessed when the count may be incomplete; otherwise partial at most. | partial |
| E8-4 Restrict administrative privileges | AWS audit | active access keys on the AWS root account | A gap when the root account has active access keys; otherwise partial at most. | partial |
| E8-4 Restrict administrative privileges | Google Cloud audit | owner or editor roles granted at project level | A gap when any user holds owner or editor at project level; otherwise partial at most. | partial |
ASD Information Security Manual — IRAP Readiness
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| 0101 Security Monitoring and Response | Microsoft 365, Entra ID, AWS, Google Cloud audit | whether GuardDuty or Security Command Center is on, and EDR coverage of enrolled devices and active threats | A gap when GuardDuty is off in any enabled AWS region, or EDR coverage is below 60%; otherwise partial at most, because alert response times are not visible. The worse of the two counts. | partial |
| 0271 Security Awareness Training | Phishing Simulator | phishing simulation results, as a proxy for training | The SMB1001 S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| 0380 Disable Unnecessary Services | Site appliance | SMBv1 on each reachable Windows host, the SNMP default community and Telnet on each listed network device, and hosts accepting clear-text service connections | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are specific services: SMBv1 on Windows hosts, the SNMP default community and Telnet on listed network devices, and, where the exposure scan is on, hosts accepting Telnet, FTP or remote-shell connections. A hardening standard based on ASD's guidance, and every other service and feature, still need a person. | partial |
| 0430 Account and Credential Management | Site appliance | the Active Directory default password policy (minimum length 14 or more, reversible storage off), no enabled account allowed an empty password, and no administrator password that never expires | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. The service account inventory, removal of default credentials on devices, and credential rotation still need a person. | partial |
| 0430 Account and Credential Management | AWS audit | active access keys on the AWS root account | A gap when the root account has active access keys; otherwise partial at most. | partial |
| 0457 Encryption at Rest — AES-256 | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, as of the device's last sync with Intune | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Intune reports whether each Windows device it manages is encrypted. Devices Intune does not manage, servers, databases and storage still need a person. | partial |
| 0457 Encryption at Rest — AES-256 | Site appliance | encryption of the system drive on each reachable Windows host (BitLocker) or Linux host (root volume) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is the system drive of each reachable Windows (BitLocker) or Linux host. Data drives, databases, storage and devices the appliance cannot reach still need a person. | partial |
| 0457 Encryption at Rest — AES-256 | Microsoft 365, Entra ID, AWS, Google Cloud audit | S3 bucket encryption and KMS key rotation | AWS: a gap when any S3 bucket has no default encryption or any customer managed KMS key does not rotate; otherwise partial at most. | partial |
| 0520 Network Segmentation | Site appliance | each listed boundary firewall's configuration read through its read-only API (management closed to the internet, administrators limited to trusted hosts, no allow-everything inbound rule) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are three settings on each listed boundary firewall. Segmentation between internal networks, VLANs and the rule review still need a person. | partial |
| 0520 Network Segmentation | Microsoft 365, Entra ID, AWS, Google Cloud audit | security groups and firewall rules open to the internet | AWS: a gap when a security group opens a remote-administration, database or file-sharing port to the whole internet. GCP: a gap when a firewall rule allows RDP or SSH from anywhere. Otherwise partial at most, because segmentation itself is not measured. | partial |
| 0988 Security Event Logging | Site appliance | Windows audit policy on each reachable Windows host, whether each listed firewall or Linux host sends its logs to a remote destination, and whether syslog from each listed source reached the appliance in the last window | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Audit policy on, devices set to send logs elsewhere, and listed sources' messages arriving, are not centralised and tamper-protected logging. The SIEM, log integrity and validation still need a person. | partial |
| 0988 Security Event Logging | Microsoft 365, Entra ID, AWS, Google Cloud audit | CloudTrail and GCP audit log settings | AWS: a gap when no CloudTrail trail is logging, otherwise partial at most. GCP: partial at most. Microsoft 365: not assessed. Never compliant: log centralisation, tamper protection and integrity are not checked. | partial |
| 1015 Business Continuity Management | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as one part of business continuity | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant: backups are one part of a continuity plan. | partial |
| 1016 Backup and Recovery | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score from connected backup sources (job recency, failures, encryption, offsite copy, restore test within 90 days) | Compliant at a score of 80 or more, partial at 40 to 79, a gap below 40; not assessed with no backup source connected. | compliant |
| 1139 Encryption in Transit — TLS 1.2+ | Site appliance | the protocol versions and certificate of each listed TLS endpoint | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This covers the TLS endpoints that were listed: TLS 1.0 and 1.1 refused, certificate in date, key and signature strong. Endpoints not listed, cipher suites and certificate management still need a person. | partial |
| 1143 Patch Management — High Risk (2 weeks) | Vulnerability Scanner | critical and high findings in the latest vulnerability scan | A gap with any critical or high finding; otherwise partial at most, because the two-week window is not measured. | partial |
| 1143 Patch Management — High Risk (2 weeks) | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most. | partial |
| 1144 Patch Management — Extreme Risk (48h) | Vulnerability Scanner | critical findings in the latest vulnerability scan | A gap with any critical finding; otherwise partial at most, because the 48-hour window is not measured. | partial |
| 1163 Vulnerability Assessment — Quarterly | Vulnerability Scanner | a completed vulnerability scan of the client's domains (rescanned every 30 days) | Partial when a scan has completed; not assessed until one has. Never compliant: the annual internal assessment is not covered. | partial |
| 1173 Multi-Factor Authentication | Microsoft 365, Entra ID, Google Cloud audit | MFA enforcement and registration, as for E8-3 | A gap when MFA is not required for everyone; otherwise partial at most, because whether Conditional Access requires phishing-resistant methods is not read. | partial |
| 1173 Multi-Factor Authentication | AWS audit | MFA on the AWS root account and on IAM users with console access | A gap when the root account or any IAM user with console access has no MFA; otherwise partial at most. | partial |
| 1173 Multi-Factor Authentication | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered; otherwise partial at most. | partial |
| 1175 Least Privilege Access | Site appliance | enabled Active Directory administrator accounts (none unused for the stale period, none with a password that never expires) and Linux accounts with user id 0 | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This counts enabled accounts in Active Directory's administrator groups and Linux user-id-0 accounts. Need-to-have allocation, quarterly access reviews and cloud administrator roles still need a person. | partial |
| 1175 Least Privilege Access | Microsoft 365, Entra ID audit | Global Administrator count against Microsoft's fewer-than-five benchmark, and apps holding privilege-escalating permissions | A gap at 5 or more Global Administrators or with any app holding permissions that can lead to Global Administrator; not assessed when the count may be incomplete; otherwise partial at most. | partial |
| 1175 Least Privilege Access | AWS audit | active access keys on the AWS root account | A gap when the root account has active access keys; otherwise partial at most. | partial |
| 1175 Least Privilege Access | Google Cloud audit | owner or editor roles granted at project level | A gap when any user holds owner or editor at project level; otherwise partial at most. | partial |
| 1386 Email Filtering and DMARC | Email authentication DNS check (DMARC, SPF, DKIM) | DMARC policy and SPF record of each of the client's domains, read from public DNS (DKIM at the common Microsoft 365 and Google selectors) | A gap when any domain has no DMARC record, a DMARC policy of none, or no SPF record; otherwise partial at most, because the email gateway's filtering is not checked; not assessed with no domain on file or when DNS could not be read. | partial |
| 1406 Application Control | Site appliance | AppLocker and Windows Defender Application Control policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows an AppLocker or WDAC policy is enforced on each reachable Windows host. Whether the rules allowlist, and coverage of servers and devices the appliance cannot reach, still need a person. | partial |
| 1490 Microsoft Office Macro Controls | Site appliance | Office macro policy applied by group policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This reads the machine-level group policy that blocks macros in files from the internet. Allowing only signed macros from trusted publishers, and settings applied per user, still need a person. | partial |
| 1493 Patch Management — Standard (1 month) | Site appliance | the date each reachable Windows host last installed an update (within 30 days) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: More than 30 days since a Windows host installed any update is outside the ISM's one month. A recent update does not mean nothing is missing; Linux hosts, applications and end-of-life software still need a person. | partial |
| 1493 Patch Management — Standard (1 month) | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because end-of-life software is not checked. | partial |
Cyber Essentials / CE+
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| AccessControl User Access Control | Site appliance | the Active Directory default password policy (minimum length 8 or more; 12 without MFA or a deny-list) and enabled administrator accounts in use with expiring passwords | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Below 8 characters fails Cyber Essentials outright. It accepts 12 characters, or 8 to 11 only with MFA or a deny-list of common passwords, and the appliance can see neither, so 8 to 11 is shown as partial and needs your evidence. The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. The account approval process and separate admin accounts still need a person. | partial |
| AccessControl User Access Control | Microsoft 365, Entra ID audit | MFA enforcement and registration, and the Global Administrator count and privilege-escalating apps | A gap when MFA is not required for everyone (an automatic failure under v3.3 where a cloud service offers MFA), at 5 or more Global Administrators, or with any app that can lead to Global Administrator; otherwise partial at most. | partial |
| AccessControl User Access Control | AWS audit | MFA on the AWS root account and console users, and active root access keys | A gap when the root account or any console user has no MFA, or the root account has active access keys; otherwise partial at most. | partial |
| AccessControl User Access Control | Google Cloud audit | MFA enforcement, and owner or editor roles granted at project level | A gap when MFA is not enforced or any user holds owner or editor at project level; otherwise partial at most. | partial |
| Firewalls Boundary Firewalls and Internet Gateways | Site appliance | the host firewall on each reachable Windows or Linux host, and each listed boundary firewall's configuration read through its read-only API | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are the host firewall on reachable Windows and Linux hosts and the configuration of listed boundary firewalls. Home and mobile devices the appliance cannot reach, and the rule justification Cyber Essentials asks for, still need a person. | partial |
| Firewalls Boundary Firewalls and Internet Gateways | Microsoft 365, Entra ID, AWS, Google Cloud audit | security groups and firewall rules open to the internet | AWS: a gap when a security group opens a remote-administration, database or file-sharing port to the whole internet. GCP: a gap when a firewall rule allows RDP or SSH from anywhere. Otherwise partial at most. | partial |
| MalwareProtection Malware Protection | Microsoft Intune | Microsoft Defender's malware protection and signature updates on each Intune-managed Windows device where Defender's real-time protection is on, as Defender last reported them | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is Microsoft Defender's state on Intune-managed Windows devices where Defender's real-time protection is on. Devices protected by another product, devices Intune does not manage and website blocking still need a person. | partial |
| MalwareProtection Malware Protection | Site appliance | AppLocker and Windows Defender Application Control policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows an AppLocker or WDAC policy is enforced on each reachable Windows host; Cyber Essentials accepts application allow-listing as malware protection. Anti-malware on every in-scope device and website blocking still need a person. | partial |
| MalwareProtection Malware Protection | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage of enrolled devices and active threats | A gap below 60% EDR coverage or with active threats; otherwise partial at most. | partial |
| PatchManagement Patch Management — 14 Days | Site appliance | the date each reachable Windows host last installed an update (within 14 days) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows each reachable Windows host installed an update within the last 14 days (Cyber Essentials' own number). Whether every critical and high-risk update was installed within 14 days of its release, firmware, applications and unsupported software still need a person. | partial |
| PatchManagement Patch Management — 14 Days | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches; otherwise partial at most, because Cyber Essentials fails any critical or high-risk update not installed within 14 days. | partial |
| PatchManagement Patch Management — 14 Days | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| SecureConfig Secure Configuration | Site appliance | SMBv1 on reachable Windows hosts, the SNMP default community and Telnet on listed network devices, Active Directory accounts allowed an empty password, and the Office macro policy | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are particular settings: SMBv1 off, no default SNMP community, Telnet closed, no account allowed an empty password and internet macros blocked. Removal of unneeded software and accounts, auto-run and device locking still need a person. | partial |
Cybersecurity Maturity Model Certification 2.0
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| SI System & Information Integrity | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage of enrolled devices and active threats (Defender for Endpoint, CrowdStrike, SentinelOne) | Compliant at 90% or more coverage with no active threats; partial at 60% or more; a gap below 60%. | compliant |
EU AI Act — Regulation (EU) 2024/1689
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| Art.6 Risk Classification of AI Systems | AI Inventory | AI tools recorded in the AI Inventory | Partial with at least one AI tool recorded (scan suggestions count once confirmed); not assessed with none. | partial |
HIPAA Security Rule — Protected Health Information
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| §164.308(a)(1) Security Management Process | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| §164.308(a)(1) Security Management Process | Risk Register | the client's Risk Register: entries on file and open critical or high risks | A gap with an open critical risk; partial with entries on file otherwise; not assessed with none on file. | partial |
| §164.308(a)(5) Security Awareness Training | Phishing Simulator | phishing simulation results, as a proxy for training | The SMB1001 S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| §164.308(a)(7) Contingency Plan | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, for the data backup and disaster recovery plans | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant. | partial |
| §164.308(a)(8) Evaluation | Vulnerability Scanner | a completed vulnerability scan of the client's domains (rescanned every 30 days) | Partial when a scan has completed; not assessed until one has. Never compliant. | partial |
| §164.312(a)(1) Access Control | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, as of the device's last sync with Intune | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Intune reports whether each Windows device it manages is encrypted (the encryption and decryption specification). Devices Intune does not manage, servers and databases holding ePHI, and the rest of access control still need a person. | partial |
| §164.312(a)(1) Access Control | Site appliance | system drive encryption on each reachable Windows or Linux host, and enabled Active Directory administrator accounts (none unused for the stale period, none with a password that never expires) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Disk encryption on reachable hosts (the encryption and decryption specification) and the state of administrator accounts are parts of access control. Unique user identification, emergency access and automatic logoff still need a person. | partial |
| §164.312(a)(1) Access Control | Microsoft 365, Entra ID audit | Global Administrator count against Microsoft's fewer-than-five benchmark, and apps holding privilege-escalating permissions | A gap at 5 or more Global Administrators or with any app holding permissions that can lead to Global Administrator; otherwise partial at most. | partial |
| §164.312(a)(1) Access Control | AWS audit | active access keys on the AWS root account, and S3 bucket encryption and KMS key rotation | A gap when the root account has active access keys, any S3 bucket has no default encryption, or any customer managed KMS key does not rotate; otherwise partial at most. | partial |
| §164.312(a)(1) Access Control | Google Cloud audit | owner or editor roles granted at project level | A gap when any user holds owner or editor at project level; otherwise partial at most. | partial |
| §164.312(b) Audit Controls | Site appliance | Windows audit policy on each reachable Windows host, whether each listed firewall or Linux host sends its logs to a remote destination, and whether syslog from each listed source reached the appliance in the last window | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These show activity is recorded and logs leave the device. Recording on every system holding ePHI, and reviewing the records, still need a person. | partial |
| §164.312(b) Audit Controls | Microsoft 365, Entra ID, AWS, Google Cloud audit | CloudTrail and GCP audit log settings | AWS: a gap when no CloudTrail trail is logging, otherwise partial at most. GCP: partial at most. Microsoft 365: not assessed. | partial |
| §164.312(d) Person or Entity Authentication | Site appliance | the Active Directory default password policy (minimum length 14 or more) and no enabled account allowed an empty password | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. MFA, service account authentication and authentication to systems outside the domain still need a person. | partial |
| §164.312(d) Person or Entity Authentication | Microsoft 365, Entra ID audit | MFA enforcement and registration | A gap when MFA is not required for everyone (stricter than the Security Rule, which does not name MFA); otherwise partial at most. | partial |
| §164.312(d) Person or Entity Authentication | AWS audit | MFA on the AWS root account and on IAM users with console access | A gap when the root account or any console user has no MFA (stricter than the Security Rule, which does not name MFA); otherwise partial at most. | partial |
| §164.312(d) Person or Entity Authentication | Google Cloud audit | MFA enforcement | A gap when MFA is not enforced (stricter than the Security Rule, which does not name MFA); otherwise partial at most. | partial |
| §164.312(d) Person or Entity Authentication | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered (stricter than the Security Rule); otherwise partial at most. | partial |
| §164.312(e)(1) Transmission Security | Site appliance | the protocol versions and certificate of each listed TLS endpoint (TLS 1.0 and 1.1 refused, certificate in date, key and signature strong) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are three properties of the TLS endpoints that were listed. Integrity controls, email and other transmissions of ePHI, and endpoints not listed still need a person. | partial |
ISO 27001:2022 — Information Security Management
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| A.5.7 Threat intelligence | Dark Web Monitoring | a completed dark-web monitoring scan of the client's domains | Partial once a scan has completed; one of several kinds of threat intelligence the control asks for. | partial |
| A.5.9 Inventory of information and other associated assets | Site appliance | the appliance's scheduled network discovery of the approved ranges | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: A network scan finds devices that answer on common ports. It is not an asset register: ownership, classification and devices that were off or out of range still need a person. | partial |
| A.5.14 Information transfer | Email authentication DNS check (DMARC, SPF, DKIM) | DMARC policy and SPF record of each of the client's domains, read from public DNS (DKIM at the common Microsoft 365 and Google selectors) | A gap when any domain has no DMARC record, a DMARC policy of none, more than one DMARC or SPF record, or no SPF record (ISO 27001 sets no rule; as for the ISM); otherwise partial at most; not assessed with no domain on file or when DNS could not be read. | partial |
| A.5.15 Access control | Site appliance | the Active Directory account lockout threshold (accounts lock after 1 to 10 failed attempts) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Account lockout is one access control rule in one directory. The access control policy itself, who is allowed what, and systems outside Active Directory still need a person. The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. | partial |
| A.5.17 Authentication information | Site appliance | the Active Directory default password policy (minimum length 14 or more, reversible storage off) and no enabled account allowed an empty password | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. How passwords and other secrets are issued, MFA, service and shared account secrets, and cloud identities still need a person. | partial |
| A.5.19 Information security in supplier relationships | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant. | partial |
| A.5.22 Monitoring, review and change management of supplier services | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months, as the regular review (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant. | partial |
| A.5.30 ICT readiness for business continuity | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as ICT recovery capability | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant. | partial |
| A.6.3 Information security awareness, education and training | Phishing Simulator | phishing simulation results, as a proxy for training | The SMB1001 S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| A.8.1 User end point devices | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, and Microsoft Defender's malware protection and signature updates where Defender's real-time protection is on | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Intune reports encryption on each Windows device it manages, and Microsoft Defender's state where its real-time protection is on. Devices Intune does not manage, personal devices, the endpoint device policy and other device settings still need a person. | partial |
| A.8.1 User end point devices | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage of enrolled devices and active threats | A gap below 60% EDR coverage or with active threats; otherwise partial at most. | partial |
| A.8.2 Privileged access rights | Microsoft 365, Entra ID audit | Global Administrator count against Microsoft's fewer-than-five benchmark (including role-assignable groups and PIM-eligible) and apps holding privilege-escalating permissions | A gap at 5 or more Global Administrators (Microsoft's and the CIS benchmark's fewer-than-five; ISO 27001 sets no number) or with any app holding permissions that can lead to Global Administrator; not assessed when the count may be incomplete; otherwise partial at most. | partial |
| A.8.2 Privileged access rights | Site appliance | enabled Active Directory administrator accounts: none unused for the stale period and none with a password that never expires | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: On Linux hosts this checks only that root is the single local account with user id 0; sudo rights are not read. In Active Directory this counts enabled accounts in Domain Admins, Enterprise Admins, Schema Admins and Administrators. Other powerful groups, delegated rights, whether administrators use a separate account, how privileged access is approved and reviewed, and cloud administrator roles still need a person. | partial |
| A.8.3 Information access restriction | Microsoft 365, Entra ID, AWS, Google Cloud audit | S3 Block Public Access and public buckets | AWS: a gap when any S3 bucket lacks all four Block Public Access settings; otherwise partial at most. | partial |
| A.8.5 Secure authentication | Microsoft 365, Entra ID, AWS, Google Cloud audit | MFA enforcement and coverage, and whether legacy authentication is blocked | As E8-3 (Microsoft 365) or the root and console-user MFA check (AWS), and partial at most when Conditional Access does not block legacy authentication. | compliant |
| A.8.5 Secure authentication | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered; otherwise partial at most. | partial |
| A.8.7 Protection against malware | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage of enrolled devices and active threats | Compliant at 90% or more coverage with no active threats; partial at 60% or more; a gap below 60%. | compliant |
| A.8.7 Protection against malware | Microsoft Intune | Microsoft Defender's malware protection and signature updates on each Intune-managed Windows device where Defender's real-time protection is on, as Defender last reported them | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is Microsoft Defender's state on Intune-managed Windows devices where Defender's real-time protection is on. Devices protected by another antivirus product, devices Intune does not manage, user awareness and malware incident response still need a person. | partial |
| A.8.8 Management of technical vulnerabilities | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because patch timeliness is not measured. | partial |
| A.8.8 Management of technical vulnerabilities | Vulnerability Scanner | the latest vulnerability scan's critical and high findings (TLS and headers, CVEs in audited software) | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| A.8.8 Management of technical vulnerabilities | Site appliance | the date each reachable Windows host last installed an update | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: More than 65 days since a Windows host installed any update means at least one monthly release waited more than 30 days. A recent update does not mean nothing is missing, and Linux hosts, applications, vulnerability scanning and the patch SLA still need a person. | partial |
| A.8.9 Configuration management | Site appliance | SMBv1 on each reachable Windows host, and the host firewall on each reachable Windows or Linux host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are two settings from a baseline. The documented baseline, change control and the settings on devices the appliance cannot reach still need a person. | partial |
| A.8.13 Information backup | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score from connected backup sources (job recency, failures, encryption, offsite copy, restore tests) | Compliant at a score of 80 or more, partial at 40 to 79, a gap below 40; not assessed with no backup source connected. | compliant |
| A.8.15 Logging | Microsoft 365, Entra ID, AWS, Google Cloud audit | CloudTrail and GCP audit log settings | AWS: a gap when no CloudTrail trail is logging, otherwise partial at most. GCP: partial at most, naming the Data Access log and sink settings. Microsoft 365: not assessed, because Microsoft Graph does not expose the unified audit log setting. | partial |
| A.8.15 Logging | Site appliance | Windows audit policy on each reachable Windows host, whether each listed firewall or Linux host is set to send its logs to a remote destination, and whether syslog from each listed source reached the appliance in the last window | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Audit policy being on, a device being set to send its logs elsewhere, and a listed source's messages arriving at the appliance, are not log retention, protection or review. The appliance does not look at what the messages say and does not see the site's own log server. What is collected centrally, how long it is kept and who reviews it still need a person. | partial |
| A.8.16 Monitoring activities | Microsoft 365, Entra ID, AWS, Google Cloud audit | whether GuardDuty is enabled, and EDR coverage of enrolled devices and active threats | AWS: a gap when GuardDuty is off in any enabled region, otherwise partial at most. GCP: partial at most when Security Command Center is active and readable. EDR: a gap below 60% coverage or with active threats. The worse of the two counts, partial at most. | partial |
| A.8.17 Clock synchronization | Site appliance | whether each listed time server, and each listed Linux host, reports that its clock is synchronised | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is each listed time server's own statement that it is synchronised to a source, and each listed Linux host's report that its clock is synchronised. The appliance does not compare anyone's time with anything, does not check which source a host uses, and does not read Windows hosts' or network devices' clocks. | partial |
| A.8.19 Installation of software on operational systems | Site appliance | AppLocker and Windows Defender Application Control policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows an AppLocker or WDAC policy is enforced on each reachable Windows host, which restricts what software can run. Whether the rules allowlist, who may install software, and servers and devices the appliance cannot reach still need a person. | partial |
| A.8.20 Networks security | Microsoft 365, Entra ID, AWS, Google Cloud audit | security groups open to the internet, and SSH or RDP exposed | AWS: a gap when a security group opens a remote-administration, database or file-sharing port to the whole internet. GCP: a gap when a firewall rule allows RDP or SSH from anywhere. Otherwise partial at most. | partial |
| A.8.20 Networks security | Site appliance | tests of each listed network device's SNMP default community, Telnet and SSH service, each listed firewall's configuration read through its read-only API, and, where switched on, a count of hosts accepting connections on clear-text service ports | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are specific checks on the devices that were listed, not a review of the network. For network devices: the SNMP default community "public" was ignored (another community string would still answer), Telnet did not accept a connection from the appliance, and SSH offered neither protocol 1 nor a short list of broken algorithms. For firewalls: the configuration shows no administration from the internet-facing side, no Telnet or plain HTTP administration, every administrator limited to trusted addresses, and no rule allowing everything in from the internet. The firewall checks rely on how interfaces are labelled on the device and do not read every kind of rule. Whether the rule set is appropriate, segmentation, VPN and remote access, firmware currency, and devices that were not listed still need a person. Where the internal exposure scan is switched on, it counts hosts in the approved ranges that accepted a connection from the appliance on the Telnet, FTP and remote-shell ports. That is a statement about ports, as seen from where the appliance sits: it does not identify the software answering, and a service blocked between the appliance and a host is not seen. Remote desktop, file sharing, VNC and database ports are counted for review and are not judged. | partial |
| A.8.21 Security of network services | Site appliance | a test of whether each listed DNS server gives a zone transfer to an unauthorised address, and, where switched on, a count of hosts accepting connections on clear-text service ports | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows each listed DNS server refused to hand its zone to the appliance, which has no right to it. It is one property of one network service, as seen from the appliance's address. Service agreements, other network services and the rest of DNS security still need a person. Where the internal exposure scan is switched on, it counts hosts in the approved ranges that accepted a connection from the appliance on the Telnet, FTP and remote-shell ports. That is a statement about ports, as seen from where the appliance sits: it does not identify the software answering, and a service blocked between the appliance and a host is not seen. Remote desktop, file sharing, VNC and database ports are counted for review and are not judged. | partial |
| A.8.24 Use of cryptography | Microsoft 365, Entra ID, AWS, Google Cloud audit | S3 bucket encryption and KMS key rotation | AWS: a gap when any S3 bucket has no default encryption or any customer managed KMS key does not rotate; otherwise partial at most. | partial |
| A.8.24 Use of cryptography | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, as of the device's last sync with Intune | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Intune reports whether each Windows device it manages is encrypted; it does not say which drives or how. Devices Intune does not manage, TLS, the cryptography policy and key management still need a person. | partial |
| A.8.24 Use of cryptography | Site appliance | encryption of the system drive on each reachable Windows host (BitLocker) or Linux host (root volume), and the protocol versions and certificate of each listed TLS endpoint | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Disk encryption on Windows hosts, and three properties of the TLS endpoints that were listed (TLS 1.0 and 1.1 refused, certificate in date, certificate key and signature strong), are particular uses of cryptography. The appliance does not check who issued a certificate or whether its name matches, does not grade cipher suites, and cannot see endpoints that were not listed. The cryptography policy and key management still need a person. | partial |
ISO/IEC 42001:2023 — Artificial Intelligence Management System
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| A.4.2 Documentation of Resources | AI Inventory | AI tools recorded in the AI Inventory | Partial with at least one AI tool recorded (scan suggestions count once confirmed); not assessed with none. | partial |
| A.10.3 Suppliers of AI Components | AI Inventory | AI tools recorded in the AI Inventory | Partial with at least one AI tool recorded (scan suggestions count once confirmed); not assessed with none. | partial |
NIST AI Risk Management Framework 1.0
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| MAP 3 AI Capabilities, Usage, and Third-Party AI Documented | AI Inventory | AI tools recorded in the AI Inventory | Partial with at least one AI tool recorded (scan suggestions count once confirmed); not assessed with none. | partial |
NIST Cybersecurity Framework 2.0
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| DE.CM Continuous Monitoring | Site appliance | whether each listed firewall or Linux host sends its logs to a remote destination, and whether syslog from each listed source reached the appliance in the last window | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Logs being sent off the device and arriving are what monitoring depends on. Whether anyone or anything watches them, and monitoring of people and external providers, still need a person. | partial |
| DE.CM Continuous Monitoring | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage and active threats, and whether GuardDuty or Security Command Center is on | A gap below 60% EDR coverage, with active threats, or when GuardDuty is off in any enabled AWS region; otherwise partial at most. | partial |
| GV.SC Cybersecurity Supply Chain Risk Management | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant. | partial |
| ID.AM Asset Management | Site appliance | the appliance's scheduled network discovery of the approved ranges | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: A network scan finds devices that answer on common ports. Software, data, services, cloud assets, ownership and importance still need a person. | partial |
| ID.RA Risk Assessment | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| ID.RA Risk Assessment | Risk Register | the client's Risk Register: entries on file and open critical or high risks | A gap with an open critical risk; partial with entries on file otherwise; not assessed with none on file. | partial |
| PR.AA Identity Management, Authentication, and Access Control | Site appliance | the Active Directory default password policy and no empty passwords, and enabled administrator accounts in use with expiring passwords | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. Identity proofing, entitlement reviews, physical access and cloud identities still need a person. | partial |
| PR.AA Identity Management, Authentication, and Access Control | Microsoft 365, Entra ID audit | MFA enforcement and registration, and the Global Administrator count and privilege-escalating apps | A gap when MFA is not required for everyone, at 5 or more Global Administrators, or with any app that can lead to Global Administrator; otherwise partial at most. The worse result counts. | partial |
| PR.AA Identity Management, Authentication, and Access Control | AWS audit | MFA on the AWS root account and console users, and active root access keys | A gap when the root account or any console user has no MFA, or the root account has active access keys; otherwise partial at most. | partial |
| PR.AA Identity Management, Authentication, and Access Control | Google Cloud audit | MFA enforcement, and owner or editor roles granted at project level | A gap when MFA is not enforced or any user holds owner or editor at project level; otherwise partial at most. | partial |
| PR.AA Identity Management, Authentication, and Access Control | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered; otherwise partial at most. | partial |
| PR.AT Awareness and Training | Phishing Simulator | phishing simulation results, as a proxy for training | The SMB1001 S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| PR.DS Data Security | Microsoft Intune | whether Intune reports each managed Windows device as encrypted, as of the device's last sync with Intune | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Intune reports whether each Windows device it manages is encrypted. Devices Intune does not manage, servers and data in transit still need a person. | partial |
| PR.DS Data Security | Site appliance | system drive encryption on each reachable Windows or Linux host, and the protocol versions and certificate of each listed TLS endpoint | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Disk encryption on reachable hosts and TLS on listed endpoints are parts of protecting data at rest and in transit. Data classification, data loss prevention and data in use still need a person. | partial |
| PR.DS Data Security | Microsoft 365, Entra ID, AWS, Google Cloud audit | S3 bucket encryption and KMS key rotation | AWS: a gap when any S3 bucket has no default encryption or any customer managed KMS key does not rotate; otherwise partial at most. | partial |
| PR.DS Data Security | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, for backups | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. | partial |
| PR.IR Technology Infrastructure Resilience | Site appliance | each listed boundary firewall's configuration read through its read-only API, and Telnet and the SNMP default community on each listed network device | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are settings on listed firewalls and network devices. Network segmentation, capacity, redundancy and the rule review still need a person. | partial |
| PR.IR Technology Infrastructure Resilience | Microsoft 365, Entra ID, AWS, Google Cloud audit | security groups and firewall rules open to the internet | AWS: a gap when a security group opens a remote-administration, database or file-sharing port to the whole internet. GCP: a gap when a firewall rule allows RDP or SSH from anywhere. Otherwise partial at most. | partial |
| PR.IR Technology Infrastructure Resilience | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, for resilience | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. | partial |
| PR.PS Platform Security | Site appliance | the date each reachable Windows host last installed an update (within 30 days), application control, Office macro policy, SMBv1 and audit policy | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are particular platform settings on reachable Windows hosts: an update within 30 days (CSF sets no number; one month, as for the ISM), application control enforced, internet macros blocked, SMBv1 off and audit policy on. Configuration baselines, firmware and unmanaged devices still need a person. | partial |
| PR.PS Platform Security | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches; otherwise partial at most. | partial |
| PR.PS Platform Security | Microsoft 365, Entra ID, AWS, Google Cloud audit | CloudTrail and GCP audit log settings (log records are generated) | AWS: a gap when no CloudTrail trail is logging, otherwise partial at most. GCP: partial at most. Microsoft 365: not assessed. | partial |
| RC.RP Incident Recovery Plan Execution | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as recovery capability | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant. | partial |
SMB1001
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| B-1 Multi-factor authentication | Microsoft 365 audit | MFA registration coverage of enabled users, from the latest audit that measured it | Compliant at 90% or more, partial at 50% or more, a gap below 50%; not assessed when no recent audit measured it. | compliant |
| B-2 Patch Management — Applications | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because patch timeliness is not measured. | partial |
| B-3 Patch Management — OS | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches (an endpoint not seen for 30 days counts as not patched); otherwise partial at most, because patch timeliness is not measured. | partial |
| B-3 Patch Management — OS | Site appliance | the date each reachable Windows host last installed an update | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: More than 65 days since a Windows host installed any update means at least one monthly release waited more than 30 days. A recent update does not mean nothing is missing, and Linux hosts and the 30-day evidence for critical patches still need a person. | partial |
| B-4 Regular backups | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score from connected backup sources | Compliant at a score of 80 or more, partial at 40 to 79, a gap below 40; not assessed with no backup source connected. | compliant |
| B-5 Malware Protection | EDR collector (Defender for Endpoint, CrowdStrike, SentinelOne) | EDR device coverage and active threats, from the latest measurement | Compliant at 90% or more coverage with no active threats; partial at 60% or more; a gap below 60%. | compliant |
| B-5 Malware Protection | Microsoft Intune | Microsoft Defender's malware protection and signature updates on each Intune-managed Windows device where Defender's real-time protection is on, as Defender last reported them | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is Microsoft Defender's state on Intune-managed Windows devices where Defender's real-time protection is on. Devices protected by another antivirus product and devices Intune does not manage still need a person. | partial |
| G-1 Application control | Site appliance | AppLocker and Windows Defender Application Control policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows an application control policy (AppLocker or WDAC) is enforced on the host. Whether the rules actually allowlist, and that it covers workstations, still needs a person. | partial |
| G-2 Office Macro Configuration | Site appliance | Office macro policy applied by group policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This reads machine-level policy only. Settings applied per user, and trusted locations, are not visible without the user's session. | partial |
| G-4 Risk Register | Risk Register | the client's Risk Register: entries on file and open critical or high risks | Compliant with entries on file and no open critical or high risk; partial with an open high risk; a gap with an open critical risk; not assessed with none on file. | compliant |
| G-5 Third-Party Risk Management | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant: contracts are not read. | partial |
| G-6 Phishing-Resistant MFA (Admin) | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered (all users on audits before #985) | A gap when any admin account has no passkey or FIDO2 security key or Windows Hello for Business registered; otherwise partial at most (registered is not required at sign-in); not assessed when no admin is flagged. Audits before 13 Nov 2026 use all users: partial at 50% or more. | partial |
| G-8 Immutable Backups | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score (no separate immutability check) | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant: immutability is not checked on its own. | partial |
| P-5 Business Continuity Plan | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as one part of a continuity plan | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant: backups are one part of a continuity plan. | partial |
| P-6 Zero Trust Architecture | Microsoft 365 audit | whether Conditional Access or Security Defaults requires MFA | Partial when Conditional Access or Security Defaults requires MFA; otherwise a gap. | partial |
| P-8 Role-Based Security Training | Phishing Simulator | phishing simulation results, as a proxy for training | The S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| S-2 Privileged Access Management | Site appliance | enabled Active Directory administrator accounts: none unused for the stale period and none with a password that never expires | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows the on-premises administrator accounts are in use and their passwords expire. It does not show that administrators have a separate account from their everyday one, which is what this control asks, and it does not cover Entra ID roles. | partial |
| S-3 Security Awareness Training | Phishing Simulator | phishing simulation results, as a proxy for training | The S-8 score, capped at partial: a click rate is not a record of completed training. | partial |
| S-4 Secure Configuration | Site appliance | SMBv1 and User Account Control on each reachable Windows host, and the host firewall on each reachable Windows or Linux host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are three settings, not a hardening baseline. Whether a baseline such as CIS is defined and applied to every device and application still needs a person. | partial |
| S-6 Asset Inventory | Site appliance | the appliance's scheduled network discovery of the approved ranges | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: A network scan finds devices that answer on common ports. It does not cover software and cloud assets, devices that were off or out of range, or whether the register is maintained. | partial |
| S-7 Firewall Configuration | Site appliance | the host firewall on each reachable Windows or Linux host, and each listed boundary firewall's configuration read through its read-only API | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This reads the Windows host firewall and four settings on each listed boundary firewall. Whether the boundary rule set is appropriate, and whether the rules are documented, still need a person. | partial |
| S-8 Phishing Simulation | Phishing Simulator | completed phishing simulations in the last 12 months: click and report rates | Compliant at a score of 90 or more, partial at 60 or more, a gap below 60, where the score is the share who did not click plus a tenth of the share who reported (at most 100); not assessed with no campaign in 12 months. | compliant |
SOC 2 — Service Organisation Control 2 (Type II Readiness)
| Control | Source | Measures | Rule | Best |
|---|---|---|---|---|
| CC2.2 Internal Communication | Phishing Simulator | phishing simulation results, as a proxy for security awareness training | The SMB1001 S-8 score, capped at partial: a click rate is not a record of completed training or communicated responsibilities. | partial |
| CC3.2 Risk Identification | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| CC3.2 Risk Identification | Risk Register | the client's Risk Register: entries on file and open critical or high risks | A gap with an open critical risk; partial with entries on file otherwise; not assessed with none on file. | partial |
| CC6.1 Logical Access Security Measures | Site appliance | the Active Directory default password policy and no empty passwords, and enabled administrator accounts in use with expiring passwords | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: The appliance reads the default domain password policy only: fine-grained password policies, which can be weaker for some groups, are not visible to it. Access authorisation, role-based allocation and cloud identities still need a person. | partial |
| CC6.1 Logical Access Security Measures | Microsoft 365, Entra ID audit | MFA enforcement and registration, and the Global Administrator count and privilege-escalating apps | A gap when MFA is not required for everyone, at 5 or more Global Administrators, or with any app that can lead to Global Administrator; otherwise partial at most. The worse result counts. | partial |
| CC6.1 Logical Access Security Measures | AWS audit | MFA on the AWS root account and console users, and active root access keys | A gap when the root account or any console user has no MFA, or the root account has active access keys; otherwise partial at most. | partial |
| CC6.1 Logical Access Security Measures | Google Cloud audit | MFA enforcement, and owner or editor roles granted at project level | A gap when MFA is not enforced or any user holds owner or editor at project level; otherwise partial at most. | partial |
| CC6.1 Logical Access Security Measures | Microsoft 365 audit | enabled admin accounts with a phishing-resistant MFA method registered | A gap when any admin account has no passkey, FIDO2 security key or Windows Hello for Business registered; otherwise partial at most. | partial |
| CC6.3 Role Changes and Terminations | Site appliance | enabled Active Directory administrator accounts unused for the stale period | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This counts enabled administrator accounts unused for the stale period, a sign that access was not removed. Removal on role change or leaving, for every account and system, still needs a person. | partial |
| CC6.6 Logical Access from Outside Network | Site appliance | each listed boundary firewall's configuration read through its read-only API, and Telnet and the SNMP default community on each listed network device | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are settings on listed firewalls and network devices. Remote access, the boundary rule review and devices not listed still need a person. | partial |
| CC6.6 Logical Access from Outside Network | Microsoft 365, Entra ID, AWS, Google Cloud audit | security groups and firewall rules open to the internet | AWS: a gap when a security group opens a remote-administration, database or file-sharing port to the whole internet. GCP: a gap when a firewall rule allows RDP or SSH from anywhere. Otherwise partial at most. | partial |
| CC6.7 Transmission of Confidential Information | Site appliance | the protocol versions and certificate of each listed TLS endpoint (TLS 1.0 and 1.1 refused, certificate in date, key and signature strong) | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are three properties of the TLS endpoints that were listed. Encryption of other transmissions, removable media and endpoints not listed still need a person. | partial |
| CC6.7 Transmission of Confidential Information | Email authentication DNS check (DMARC, SPF, DKIM) | DMARC policy and SPF record of each of the client's domains, read from public DNS (DKIM at the common Microsoft 365 and Google selectors) | A gap when any domain has no DMARC record, a DMARC policy of none, more than one DMARC or SPF record, or no SPF record; otherwise partial at most; not assessed with no domain on file or when DNS could not be read. | partial |
| CC6.8 Malicious Software Prevention | Microsoft Intune | Microsoft Defender's malware protection and signature updates on each Intune-managed Windows device where Defender's real-time protection is on, as Defender last reported them | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This is Microsoft Defender's state on Intune-managed Windows devices where Defender's real-time protection is on. Devices protected by another product, devices Intune does not manage and how malware alerts are handled still need a person. | partial |
| CC6.8 Malicious Software Prevention | Site appliance | AppLocker and Windows Defender Application Control policy on each reachable Windows host | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: This shows an AppLocker or WDAC policy is enforced on each reachable Windows host, which stops unauthorised software running. Anti-malware coverage and devices the appliance cannot reach still need a person. | partial |
| CC6.8 Malicious Software Prevention | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage of enrolled devices and active threats | A gap below 60% EDR coverage or with active threats; otherwise partial at most. | partial |
| CC7.1 Configuration Management | Site appliance | the date each reachable Windows host last installed an update (within 30 days), SMBv1, the host firewall and the Office macro policy | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: These are particular settings on reachable hosts: an update within 30 days (SOC 2 sets no number; one month, as for the ISM), SMBv1 off, the host firewall on and internet macros blocked. Configuration baselines and change detection still need a person. | partial |
| CC7.1 Configuration Management | Vulnerability Scanner | the latest vulnerability scan's critical and high findings | A gap with any critical or high finding in the latest scan; otherwise partial at most. | partial |
| CC7.1 Configuration Management | Endpoint patch telemetry (AWS Systems Manager, RMM or the on-prem agent) | share of registered endpoints reporting no missing patches | A gap when fewer than 85% of registered endpoints report no missing patches; otherwise partial at most. | partial |
| CC7.2 Monitoring | Site appliance | Windows audit policy on each reachable Windows host, whether each listed firewall or Linux host sends its logs to a remote destination, and whether syslog from each listed source reached the appliance in the last window | A failed check is a gap; otherwise partial at most. A reading more than 8 days old counts as not assessed. Still needs a person: Logs being recorded, sent off the device and arriving are what monitoring depends on. Whether anyone or anything analyses them still needs a person. | partial |
| CC7.2 Monitoring | Microsoft 365, Entra ID, AWS, Google Cloud audit | EDR coverage and active threats, whether GuardDuty or Security Command Center is on, and CloudTrail and GCP audit log settings | A gap below 60% EDR coverage, with active threats, when GuardDuty is off in any enabled AWS region, or when no CloudTrail trail is logging; otherwise partial at most. The worst result counts. | partial |
| CC7.5 Recovery from Security Incidents | Backup monitoring (BC/DR Readiness score) | BC/DR Readiness score, as recovery capability | Partial at a score of 40 or more, a gap below 40; not assessed with no backup source connected. Never compliant. | partial |
| CC9.2 Vendor and Partner Risk Management | Vendor Questionnaires | security questionnaires answered by the client's vendors in the last 12 months (Vendor Questionnaires) | Partial when every vendor on file answered a questionnaire in the last 12 months; otherwise not assessed, naming the vendors without one. Never a gap, and never compliant. | partial |