Assessment State
At Risk
12.6% Security Posture Score (Composite Posture Score)
Mean time to remediate
Awaiting baseline
vs prior 30d
Skip to main contentRetry Purview collectionResolve Network Security coverage
⚠Synthetic demo dataFindings, identities, controls and metrics are fictional. Do not treat values as a real assessment or extract names or domains.
Polaris·Security Assessment · § 01 Executive Overview
Contoso Defense Systems
Generated May 15, 2026, 7:34 PM ET · trailing 30d
SCAN STALELast scan 96 days old; treat figures as historical until collection is rerun.
manifest only
Posture score
13
/ 100 F
composite grade
First baselinetrend unlocks at next scan
No prior comparison30d window
12 critical and 70 high exposures open across this tenant.
Open findings · by severity164 total · last 30d
Critical
12
—
High
70
—
Medium
67
—
Low
15
—
§ 01·A
Priority actions
5 items · scheduling pending01
P0On-Prem: Windows Firewall Disabled on One or More Profiles
5 assets
OwnerNetwork Security
ETA pending
02
P0Critical Security Configuration Gaps Require Action
4 assets
OwnerSecurity Operations
ETA pending
03
P0NSG Rules Allow All Inbound Traffic
4 assets
OwnerCloud/Network Team
ETA pending
04
P0External trust to legacy-supplier.example has SID filtering disabled
impact unmeasured
Ownerowner pending
ETA pending
05
P02 Domain Admins without MFA
impact unmeasured
Ownerowner pending
ETA pending
§ 01·B
Posture at a glance
identity · vulnerability · on-premIdentity & accessSecure score 56%
Graph Secure Score API · as of 2026-02-08 14:00 UTC
0 admins without MFA · 9 users without MFA
7
Admins
100%
Admin MFA
150
Users
94%
MFA coverage
Vulnerability
85
Tracked vulnerabilities
Upper cap — full list in Findings detail
12
Critical
28
High
0
Exposed hosts
40 critical/high6.8 avg CVSSsecure score
On-premisesCollected
4 sites · 9 DCs · 2 CAs · 4 trusts
0
Tier-0 at risk
0
DCs · EOL Windows
4
ADCS ESC1-8
5 collectors50 linked findingsad.attack path, ad.tier 0 +4
Device posture
Intune deviceManagement
8 devices non-compliant · 72 managed
67%
Compliance
Windows
Top platform · 50 devices
48 compliant8 non-compliant16 unknownWindows 50 · macOS 12
OAuth App Permissions1 high-risk
Graph Applications API · live collection
15
Total apps
4
Admin consented
1
High-risk apps
Top app: DataSync Pro (Unverified) · Most granted permission: User.Read (8)
Sign-In Analysis12 risky
Graph Sign-In Logs API · live collection
120
Failed sign-ins
12
Risky sign-ins
138
Users affected
Top failure: Invalid password (45) · Top geography: United States (4,200) · 12 risky sign-in events flagged in the current window
§ 01·C
Trust & coverage
auditor anchorCollection confidenceStrong
Payload coverage
100%
Permission scopes OK
100%
Endpoints succeeded
49 / 49
Last scan
Feb 8, 2026
◆ Evidence bundle present◆ Manifest only
Framework coveragePrimary · NIST CSF 2.0
★NIST CSF 2.0
50%
10 / 25 controls assessed
CIS v8 IG2
72%
33 / 43 controls assessed
SOC 2 TSC
56%
16 / 27 controls assessed
Hardening gatesNot yet run — results reappear after the first publish or next gate-suite pass for this run id.
§ 01·D
Improve report coverage
2 coverage items · action checklistCoverage unlock checklist
2 gapsAPI error - Polaris retry
Purview retention labels
Retry Purview retention labels, then handle Records Management consent if needed
This is not an Azure Reader issue. Microsoft Graph lists Purview retention labels through a delegated Records Management permission path. Polaris should retry first; if Microsoft still returns an authorization error, the customer Purview or records-management admin must approve RecordsManagement.Read.All for the delegated collection path.
OwnerPolaris first; customer Entra or Purview records-management admin if authorization is missing
Access/artifact neededMicrosoft Graph delegated RecordsManagement.Read.All for retention label reads
Customer actionIf the retry still fails with authorization, approve the delegated Records Management read path.
Polaris actionRetry the endpoint and show the exact Microsoft status code/message if it still fails.
Microsoft lists this endpoint as delegated-only for work or school accounts. It is not fixed by Azure RBAC Reader.
Unlocks after rerunData Protection, Compliance Matrix, Technical Evidence
Evidence not provided
Network Security
Confirm whether network security is in scope
Network Security is either not in scope yet or missing the source needed to assess it. Do not read 0% coverage as a clean network result.
OwnerCustomer Azure/network admin with Polaris support
Access/artifact neededAzure RBAC Reader for cloud network inventory, or firewall/network evidence for non-Azure scope
Customer actionEither mark Network Security out of scope with a reason, or grant/provide the network evidence source.
Polaris actionIf in scope, rerun Azure Resource Graph or ingest the network evidence and link it to findings.
Out of scope is acceptable when intentional. Missing source data should be fixed or explicitly excluded.
Unlocks after rerunNetwork Security
FF13941005797127067158515013
Live Assessment Active
Executive Summary
IT Operations Assessment
IT operations assessment and security posture score review for Contoso Defense Systems. 164 findings identified across 9 risk domains, with 12 critical and 70 high-severity items defining the current action window. Evidence landed from 49/49 collection endpoints in this run.
What Matters Most
Executive Priority Queue
Start here before the deeper evidence and benchmark sections.
- 1 2 Domain Admins without MFA
- 2 ADCS template CorpUserSmartcard is ESC1 vulnerable
- 3 ADCS template certifies domain controllers without signature (ESC1)
Open
164
Secure Score
56.7%
MFA
94% / 100%
Weights live findings, evidence-backed controls, and collection coverage. It is not the same as Microsoft Secure Score.
Evidence Confidence
Strong
100% endpoint coverage with resilience verified
Immediate Workload
82
Critical and high-severity items needing action in the next 30 days
Critical Risks
12
High Risks
70
Total Risks
164
Secure Score
56.7%
Device Compliance
96.7%
MFA (Users / Admins)
94.0% / 100.0%
164Total
12Critical
70High
164Open
0Resolved
Users
150
Managed Devices
150
Immediate Risk Snapshot
Primary Signals
The first three metrics drive urgency and workload.
emergency
Critical Risks
12
Immediate executive attention
warning
High Risks
70
Priority queue this month
task_alt
Open Findings
164
164 total findings in scope
Coverage and Guardrails
Supporting Context
These metrics explain confidence and baseline protections.
check_circle
Coverage Confidence
100%
Strong evidence coverage
shield
Secure Score Benchmark
56.7%
Supporting Microsoft benchmark, not the posture decision
security
MFA Adoption
94% / 100%
Users / admins protected
Change Tracking
Delta From Last Run
No prior run available. This run establishes the baseline for future deltas.
New
Findings present now that were absent in the prior run.
Resolved
Findings that disappeared since the prior run.
Improved
Controls that moved into a stronger assessed state.
Worsened
Controls that moved into a weaker assessed state.
Coverage Changed
0
0 assessed controls vs prior run (0 → 0).
priority_high
What To Do Next
Top 5 Action Items
Priority action guidance with expected impact, dependency context, and evidence-backed closure criteria.
-
1
Critical On-Prem: Windows Firewall Disabled on One or More Profiles
Expected Impact: On-premises infrastructure control 'Windows Firewall Disabled on One or More Profiles' is not met. Windows Firewall disabled on 1 profile(s): Public. (Reduces operational risk and improves control assurance)
Medium (2-4 hours)Closure Criteria: See portal verification steps
Dependency Guidance: Admin role and licensing as required
Assessability Reason: Assessed from collected tenant telemetry.
Evidence Freshness: Current assessment run
-
2
Critical Critical Security Configuration Gaps Require Action
Expected Impact: Critical Security Configuration Gaps Require Action is below the expected baseline. Current state is 12 against a target of 0, which weakens endpoint hardening and attacker containment. (Reduces operational risk and impr
Medium (2-4 hours)Closure Criteria: See portal verification steps
Dependency Guidance: Admin role and licensing as required
Assessability Reason: Assessed from collected tenant telemetry.
Evidence Freshness: Current assessment run
-
3
Critical NSG Rules Allow All Inbound Traffic
Expected Impact: NSG Rules Allow All Inbound Traffic is below the expected baseline. Current state is 1 against a target of 0, which increases cloud exposure, resilience, and recovery risk. (Reduces operational risk and improves control
Medium (2-4 hours)Closure Criteria: See portal verification steps
Dependency Guidance: Admin role and licensing as required
Assessability Reason: Assessed from collected tenant telemetry.
Evidence Freshness: Current assessment run
-
4
High Legacy Authentication Still Allowed
Expected Impact: Legacy authentication protocols (like IMAP, POP3, and SMTP) bypass modern security controls including MFA, making them a prime target for attackers. Credential stuffing and password spray attacks frequently target legacy
Medium (2-4 hours)Closure Criteria: See portal verification steps
Dependency Guidance: Admin role and licensing as required
Assessability Reason: Assessed from collected tenant telemetry.
Evidence Freshness: Current assessment run
-
5
High 40 Users Not Covered by MFA Policy
Expected Impact: 40 users (26.7% of your workforce) are not targeted by any Conditional Access policy that requires MFA. These users can sign in with just a password, making them vulnerable to credential theft, phishing, and password spr
Small (1-2 hours)Closure Criteria: See portal verification steps
Dependency Guidance: Admin role and licensing as required
Assessability Reason: Assessed from collected tenant telemetry.
Evidence Freshness: Current assessment run
Board Decision Points
Risk Acceptance and Approval Queue
1
Block legacy authentication protocols
Recommended decision: Approve cutoff after report-only pilot
Risk acceptance tradeoff: Legacy clients may fail; requires exception process
Impacted group: Users on older mail clients or scripts
Decision window: 7-21 days
auto_awesome
Executive Intelligence
Assessment Summary
Environment
Contoso Defense Systems operates a Microsoft 365 environment with 150 users and 150 managed devices across 3 verified domains.
Score Clarity
Microsoft Secure Score is 56.7%, while the broader composite posture score is 12.6%. The composite score weights live findings, evidence-backed controls, and collection coverage, so it is stricter than Secure Score alone. The gap between those measures indicates material risk remains despite partial control coverage. MFA coverage stands at 94%, with gaps remaining that expose the organization to credential-based attacks.
Immediate Attention
This assessment identified 164 findings, including 12 critical and 70 high-severity issues requiring immediate attention. The highest priority finding — "On-Prem: Windows Firewall Disabled on One or More Profiles" — should be the first item addressed.
info
Assessment Coverage: 77% of Available Data Sources
This assessment analyzed 37 of 48 available security data sources. The findings and recommendations in this report are based on the data that was successfully collected.
37 Assessed
9 Review Required
To expand coverage
- 9 platform access checks returned non-retryable API responses. Review the exact endpoints before classifying these as collection flakiness.
Confidence Context
Executive Confidence Context
Coverage
100%
Evidence-backed section coverage.
Freshness
May 15, 2026 23:34 UTC
Latest evidence timestamp surfaced here.
Source
Snapshot-based evidence
9 unresolved collection gaps affect confidence.
Bias / Limits
9 unresolved collection gaps still limit report-wide certainty.
fact_check
Compliance Benchmarks
Framework Assessment Summary
shield
CIS Controls v8 (IG1)
73%
43 results
18 passing
25 failing
policy
NIST CSF
50%
25 results
0 passing
25 failing
verified_user
SOC 2
56%
27 results
5 passing
22 failing
Visibility Constraints
Collection Gaps
These are visibility constraints, not failing controls. They explain where the current run cannot make a stronger claim yet.
Affected Domains
Network Security
Collection gap
9
No live collection or usable manual artifact was available for this input.
Unlocks: the missing evidence needed to move controls out of Not Assessed.
Examples access_review_summary, terms_of_use_summary, lifecycle_summary
Threat Distribution
Findings At a Glance
164
Total Risks
Critical
12
High Severity
70
Medium / Low
82
Exposure Vectors
Top Risk Domains
Identity
54 Issues
Infrastructure
26 Issues
Endpoint
25 Issues
Email
18 Issues
Strategic Roadmap
90-Day Action Plan
01
30 Days: Foundation
- radio_button_unchecked 2 Domain Admins without MFA
- radio_button_unchecked ADCS template CorpUserSmartcard is ESC1 vulnerable
- radio_button_unchecked ADCS template certifies domain controllers without signature (ESC1)
02
60 Days: Optimization
- radio_button_unchecked AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor
- radio_button_unchecked DAL-PRINT01 has unconstrained Kerberos delegation
- radio_button_unchecked External trust to legacy-supplier.example has SID filtering disabled
03
90 Days: Maturity
- radio_button_unchecked HSV-FILE02 has unconstrained Kerberos delegation
- radio_button_unchecked On-Prem: Windows Firewall Disabled on One or More Profiles
- radio_button_unchecked SMB server signing is not required domain-wide
thumb_up
Positive Indicators
What's Going Well
check_circleIdentity
User MFA Adoption Is Above 90%
check_circleIdentity
Administrative MFA Coverage Is Complete
check_circleIdentity
Conditional Access Enforcement Is Active
check_circleEndpoint
Device Compliance Rate Is Above 80%
check_circleEmail
Email Authentication Controls Are Configured
check_circleInfrastructure
Backup Resilience Baseline Is Healthy
security
Findings
164
Security findings with remediation steps
View Findings arrow_forward
fact_check
Compliance
0%
Framework controls passing
View Compliance arrow_forward
lab_profile
Technical Evidence
Raw Data
Collection telemetry and technical proof
View Evidence arrow_forward
help_outline
How to Use This Report
expand_more
How to Use This Report
Severity Levels & Response Targets
Critical — P0
Respond within 72 hours
Active exploitation risk or data exposure
High — P1
Respond within 7 days
Significant gap in security controls
Medium — P2
Respond within 30 days
Hardening opportunity or partial gap
Low — P3
Respond within 90 days
Best-practice improvement
Suggested Workflow
1
Overview
Risk snapshot and KPIs
2
Findings
Detailed issues with remediation
3
Compliance
Framework alignment matrix
4
Technical Evidence
Raw data and collection proof
Navigation Tips
- Use the sidebar to switch between tabs
- Toggle Executive / Operational / Detailed density in the top bar to control section visibility
- Click any finding card header to expand remediation details
- Use Ctrl+P to print — sidebar and header auto-hide
apartment
Environment Summary
Organization
Contoso Defense Systems
Tenant ID
a1b2c3d4-e5f6-7890-abcd-ef1234567890
Users
150
Managed Devices
150
Verified Domains
contoso.onmicrosoft.comcontoso.comcontoso.mail.onmicrosoft.com
download
Download Security Collector
Run the Polaris collector script against Contoso Defense Systems to gather security telemetry — identity configuration, endpoint posture, email transport rules, Conditional Access policies, and complementary compliance evidence. Results are encrypted and uploaded for analysis.
Quick Start
PS> .\Invoke-SecurityCollection.ps1 -OutputPath .\results
payments
Cost Optimization
When Azure FinOps telemetry is complete, this section highlights specific resources with quantified savings.
Total Licenses
185
Assigned
129
Unassigned
56
Est. Annual Savings
$0
Utilization
69.7%
License SKU Breakdown
Microsoft 365 Business Premium
Assigned
120
Total
130
Utilization
92.3%
EXCHANGESTANDARD
Assigned
5
Total
5
Utilization
100.0%
POWER_BI_STANDARD
Assigned
4
Total
50
Utilization
8.0%
Microsoft_Teams_Exploratory_Dept
Assigned
0
Total
0
Utilization
0.0%
| SKU | Assigned | Total | Utilization |
|---|---|---|---|
| Microsoft 365 Business Premium | 120 | 130 | 92.3% |
| EXCHANGESTANDARD | 5 | 5 | 100.0% |
| POWER_BI_STANDARD | 4 | 50 | 8.0% |
| Microsoft_Teams_Exploratory_Dept | 0 | 0 | 0.0% |
On-Prem Active Directory Assessment
Active Directory health telemetry collected from domain: —
Health Score
0%
Domain
—
Controls Passing
4
Controls Failing
4
Skip to main content
Audit non-privileged account usage: ensure daily operations use standard accounts, not admin accountsCreate separate admin accounts (e.g., adm-username@) for each IT staff memberConfigure Conditional Access to require compliant device + MFA for admin account sign-inBlock admin accounts from accessing email, Teams, and other productivity workloadsImplement privileged access workstations (PAWs) for administrative tasks Enable MFA for all users via Conditional Access -- Entra ID > Protection > Conditional Access > + New policy -- All users required to use MFAConfigure phishing-resistant MFA for privileged accounts -- Entra ID > Protection > Conditional Access > + New policy (with authentication strength) -- Admins required to use FIDO2 or Windows Hello for BusinessBlock legacy authentication (doesn't support MFA) -- Entra ID > Protection > Conditional Access > + New policy -- Legacy protocols blockedReview and complete MFA registration for all users -- Entra ID > Users > Per-user MFA > Multi-factor authentication -- All users have at least one MFA method registeredDeploy FIDO2 security keys to privileged users -- Entra ID > Security > Authentication methods > FIDO2 security key -- FIDO2 keys distributed and registered for adminsConfigure MFA registration campaign -- Entra ID > Protection > Authentication methods > Registration campaign -- Users prompted to register additional MFA methodsMonitor MFA usage and gaps -- Entra ID > Monitoring > Sign-in logs > Filter: MFA requirement -- Dashboard showing MFA adoption and any bypasses Deploy architecturally sound security designs: defense-in-depth with multiple control layersImplement network segmentation — separate CUI data stores from general-purpose networksEnable Azure Private Endpoints for all data services (Storage, CosmosDB, SQL)Configure DLP policies to prevent CUI from leaving the controlled environmentDocument the security architecture including network diagrams and data flow maps Enable advanced auditing in Microsoft 365: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $trueConfigure audit log alerts for security events: failed sign-ins, privilege escalation, bulk operationsDeploy Microsoft Sentinel or forward audit logs to an existing SIEM for centralized analysisCreate detection rules for anomalous behavior patterns (impossible travel, mass downloads, rule creation)Establish a weekly audit log review process with documented findings and actions taken Define and document authorized software for all organizational systemsDeploy application control using Microsoft Defender Application Control (WDAC) or AppLockerBlock unapproved software installation via Intune app management policiesMaintain a software allowlist and review quarterlyAudit installed software on all devices: Get-MgDeviceManagementDetectedApp | Select DisplayName, DeviceCount Deploy Microsoft Defender for Endpoint on all managed devicesEnable real-time protection, cloud-delivered protection, and automatic sample submissionConfigure anti-malware policies in Intune: scheduled scans (weekly full, daily quick)Enable Defender SmartScreen for Edge browser and WindowsDeploy ASR (Attack Surface Reduction) rules in audit mode, then enforce after 30 days Deploy Microsoft Defender for Endpoint P2 with EDR (Endpoint Detection and Response) capabilitiesEnable automated investigation and remediation in Defender XDRConfigure Defender for Identity to detect lateral movement and credential theft in Active DirectoryDeploy Microsoft Defender for Cloud Apps for shadow IT detection and SaaS application monitoringEnable attack disruption capabilities to automatically contain compromised users and devices Document incident response plan -- Create IRP document -- Written IRP with phases: Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons LearnedDefine incident severity levels and escalation paths -- Document in IRP -- Severity matrix (Critical/High/Medium/Low) with response timeframes and escalation contactsEnable Microsoft Sentinel for detection -- Azure Portal > Microsoft Sentinel > + Create -- Sentinel workspace connected with Azure AD and M365 data connectorsDeploy Sentinel analytics rules for detection -- Microsoft Sentinel > Analytics > + Create > Scheduled query rule -- Detection rules active for common attack patternsCreate incident response playbooks -- Microsoft Sentinel > Automation > + Create > Playbook -- Automated playbooks for common incident types (phishing, malware, compromised account)Establish communication protocols -- Document in IRP -- Communication plan including: internal notifications, external reporting (DoD within 72 hours), customer notification proceduresConduct tabletop exercise -- Schedule and execute -- Annual tabletop exercise completed with documented lessons learned
⚠Synthetic demo dataFindings, identities, controls and metrics are fictional. Do not treat values as a real assessment or extract names or domains.
Polaris·Security Assessment · § 02 Findings
Contoso Defense Systems
Generated May 15, 2026, 7:34 PM ET · trailing 30d
manifest only
§ 02 · Findings · operations console
164 open findings, prioritised by blast radius and evidence depth. Search the queue and inspect detail evidence inline.
Mean finding age
Awaiting baseline
across 164 tracked
Tracked
164
first baseline
Open
164
first baseline
P0 · Critical
12
Target 72 h
P1 · High
70
Target 7 d
P2 · Medium
67
Target 30 d
P3 · Low
15
Target 90 d
P4 · Note
0
Target —
§ 02.1
Findings queue
164 open · 12 P0 · 70 P1 · 67 P2 · 15 P3Visible queue updates as filters change./searchjkmovexcheck?help
Status appears only when a finding is not open. Severity is normalized from collected evidence; internal owners and due dates stay out of the shared report.
SevTitle · ID · blast
P0 · Critical12 items
P0
On-Prem: Windows Firewall Disabled on One or More Profiles
OnPremInfra-ONPREM-FW-0011Infrastructure Configuration (1)
P0
Critical Security Configuration Gaps Require Action
Device-0153Critical Configuration Gaps (12)
P0
NSG Rules Allow All Inbound Traffic
Network-0101Network Security Groups (1)
P0
External trust to legacy-supplier.example has SID filtering disabled
OnPrem-a838cee6bbdebeade5b6f87e45bd47bf
P0
2 Domain Admins without MFA
OnPrem-b2f1b05d8a827a2e5c84fa24de42f482
P0
krbtgt password age 247 days exceeds 180-day threshold
OnPrem-bed89eaf2193e46f4ff4e32592dae478
P0
AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor
OnPrem-16f7917e737ec4706ddf063523c83342
P0
DAL-PRINT01 has unconstrained Kerberos delegation
OnPrem-8ca006d6163ddcbbaba1e7966c2eadbf
P0
HSV-FILE02 has unconstrained Kerberos delegation
OnPrem-fa9a1cc45e2cca28fe8473c0489bcad6
P0
ADCS template certifies domain controllers without signature (ESC1)
OnPrem-4aa38d65ce3032519d1f521931c464da
P0
ADCS template CorpUserSmartcard is ESC1 vulnerable
OnPrem-76680815350c3b60af20b49eed10bff4
P0
SMB server signing is not required domain-wide
OnPrem-2481dae51698953372cf8077e7873270
P1 · High70 items
P1
Legacy Authentication Still Allowed
Identity-0053Users on Legacy Protocols (3)
P1
40 Users Not Covered by MFA Policy
Identity-0085Users Not Covered by MFA Policy (40)
P1
2 High-Risk User Accounts Detected
Identity-0106High-Risk Users (6)
P1
3 Active Security Alerts (2 High, 1 Medium)
Security-0013Active Security Alert Patterns (3)
P1
Safe Links Protection Disabled
Email-0051Email Security Control (1)
P1
Safe Attachments Protection Disabled
Email-0061Email Security Control (1)
P1
Anti-Phishing Controls Are Not Fully Enabled
Email-0071Email Security Control (1)
P1
Email Threat Detection/Containment Rate Is Below Target
Email-0084Email Threats (30 Days)
P1
FIDO2 / Passkey Authentication Not Enabled
Identity-0141Authentication Methods Policy (1)
P1
Failed and Risky Sign-In Volume Exceeds Baseline
Security-0023Active Security Alert Patterns (3)
P1
Privileged High-Risk Administrative Operations Require Review
Governance-0023High-Risk Administrative Operation (3)
P1
SharePoint External Sharing Is Enabled on Collaboration Sites
DataProtection-0105Sharepoint Site With External Sharing (7)
P1
Secure Score Recommendation Backlog Is Accumulating
Governance-0035Top Improvement Actions (85 total)
P1
Third-Party Application Consents Include Elevated-Risk Integrations
Application-0061High-Risk OAuth Apps (2)
P1
Strong Authentication Method Adoption Is Below Target
Identity-0174User Lacking Strong Auth Methods (52)
P1
Threat Pulse Indicates Elevated Active Alert Backlog
Security-0033Active Security Alert Patterns (3)
P1
Network Security Groups Allow Unrestricted Inbound Access
Infrastructure-0011Network Security Groups (1)
P1
Storage Accounts Allow Public Blob Access
Infrastructure-0021Storage Account (1)
P1
Security Configuration Gaps Require Remediation
Vulnerability-0013Critical Configuration Gaps (12)
P1
High-Severity Vulnerabilities Require Short-Term Remediation
Vulnerability-0022High-Priority Configuration Gaps (28)
P1
Orphaned Cloud Resources Incurring Waste
Cost-0013Orphaned Cloud Resources (6)
P1
AD: Privileged Admin Footprint Controlled
ActiveDirectory-0031AD: Privileged Admin Footprint Controlled
P1
AD: LDAP Signing/Channel Binding Gap
ActiveDirectory-0061AD: LDAP Signing/Channel Binding Gap
P1
On-Prem: RDP Exposed Broadly Across Networks
OnPremInfra-ONPREM-FW-0031Infrastructure Configuration (1)
P1
On-Prem: High-Risk Listening Ports Exposed
OnPremInfra-ONPREM-NET-0011Infrastructure Configuration (1)
P1
On-Prem: Windows Update Not Configured or Current
OnPremInfra-ONPREM-EP-0051Infrastructure Configuration (1)
P1
On-Prem: Certificates Expiring Within 30 Days
OnPremInfra-ONPREM-CERT-0011Infrastructure Configuration (1)
P1
On-Prem: Password Policy Below Minimum Strength
OnPremInfra-ONPREM-AD-0111Infrastructure Configuration (1)
P1
Too Many Global Administrators
Identity-0251Security Control (7)
P1
PIM Not Utilized for Privileged Roles
Identity-0261Security Control (12)
P1
Legacy Authentication Sign-Ins Detected
Identity-0273Users on Legacy Protocols (3)
P1
Managed Devices Missing Disk Encryption
Device-0101Device (1)
P1
No Device Compliance Policies Defined
Device-0136Non-Compliant Devices (1)
P1
High Endpoint Vulnerability Backlog
Device-0162High-Priority Configuration Gaps (85)
P1
No DLP Policies Configured
DataProtection-0131Dlp Policy Baseline (1)
P1
Excessive Third-Party App Permissions
DataProtection-0171Apps with Excessive Permissions (1)
P1
Sensitive Email Encryption Not Enabled
Network-0131Email Encryption Baseline (1)
P1
External Email Forwarding Rules Detected
Email-0091Security Control (1)
P1
No Outbound Spam Policy Enabled
Email-0121Security Control (1)
P1
Mail Flow Rules Bypass Security Filtering
Email-0131Security Control (1)
P1
Auto-Forward to External Addresses Detected
Email-0141Security Controls (2)
P1
Multiple Domains Without DMARC
Email-0161Security Control (1)
P1
Managed Devices Missing BitLocker or Device Encryption
Endpoint-0071Security Control (1)
P1
Defender Tamper Protection Disabled
Endpoint-0111Security Control (1)
P1
Unsupported Operating Systems in Managed Fleet
Endpoint-0131Security Control (1)
P1
Privileged Identity Management Not Protecting Admin Roles
Identity-0181Security Controls (12)
P1
Risky Sign-Ins Not Investigated
Identity-0201Security Controls (4)
P1
Emergency Access Accounts Not Ready for Lockout Recovery
Identity-0211Security Control (1)
P1
No Effective Network Segmentation Detected
Infrastructure-0101Security Control (1)
P1
Storage Accounts Allow HTTP
Infrastructure-0111Storage Accounts (1)
P1
Anonymous Storage Access Enabled
Infrastructure-0151Security Control (1)
P1
Key Vault Recovery Protections Disabled
Infrastructure-0161Security Control (1)
P1
Azure Secure Score Below Target
CloudPosture-0015Top Improvement Actions (85 total)
P1
Incident Response Plan Not Documented
Resilience-0011Security Control (1)
P1
SIEM Not Connected
Resilience-0025SIEM Configuration Requirements
P1
CMMC AC.L2-3.1.6: Non-Privileged Account Use (Fail)
CMMC-AC.L2-3.1.65AC.L2-3.1.6 — Access Control (Fail)
P1
CMMC IA.L2-3.5.3: Multifactor Authentication (Fail)
CMMC-IA.L2-3.5.37IA.L2-3.5.3 — Identification & Authentication (Fail)
P1
CMMC AU.L2-3.3.4: Audit Failure Alerting (Fail)
CMMC-AU.L2-3.3.45AU.L2-3.3.4 — Audit & Accountability (Fail)
P1
CMMC IR.L2-3.6.1: Incident Handling (Partial)
CMMC-IR.L2-3.6.17IR.L2-3.6.1 — Incident Response (Partial)
P1
Edinburgh DC replication lag exceeds 4h threshold
OnPrem-bb5a9d6f577335e859fca4309670b184
P1
AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor
OnPrem-a44af409d7d11e59c1493a0dbe64697b
P1
Protected Users group has zero members
OnPrem-f0f7d0c50d45e6b1a1ec9b4d31aa74e3
P1
Default Domain Password Policy minimum length is 12 (CMMC L2 gap)
OnPrem-196a963ef20ace8c875acdb6bd3cd146
P1
14 Kerberoastable service accounts
OnPrem-973c8114634333ec705572385c76c6a8
P1
Service account svc_legacy_ctip_connector is AS-REP roastable
OnPrem-115a403197926fcf3729afc5e5c88fd4
P1
Service account svc_mes_ctl is AS-REP roastable
OnPrem-2e376a0ca89c5193bc5bbd75360d2e4d
P1
ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable
OnPrem-0f0e6181ecd6d31732ee82cce27690dd
P1
Enterprise Issuing CA certificate expires in 57 days
OnPrem-ec4b457d71895584370f8701340b7c3a
P1
Legacy SMBv1 enabled on 47 endpoints
OnPrem-ad9235417f447a7ed15961e756550e6e
P1
LDAP signing is optional (LDAPServerIntegrity=1)
OnPrem-a249894fcd65540f5d07fd99f55e1c4b
P2 · Medium67 items
P2
3 Users Authenticating with Legacy Protocols
Identity-0063Users on Legacy Protocols (3)
P2
Excessive Global Administrators (7 accounts)
Identity-0097Privileged Accounts (7)
P2
Microsoft Sentinel SIEM Not Configured
Monitoring-0015SIEM Configuration Requirements
P2
2 Apps with High-Risk OAuth Permissions
Application-0011High-Risk OAuth Apps (2)
P2
1 Service Principal with High-Risk Permissions
Identity-0111High-Risk Service Principal (1)
P2
30 Guest Users Require Access Review (20.0% of user base)
Identity-0135Guest Users (30)
P2
Trusted Named Locations Coverage Is Too Narrow
Identity-015
P2
Default Domain Password Expiration Policy Increases Credential Risk
Identity-0161Default Domain Password Policy (1)
P2
Teams Guest Access Requires Stronger Collaboration Governance
Application-0055Guest Users (2)
P2
Device Configuration Baseline Policy Depth Is Limited
Endpoint-004
P2
Device Compliance Policy Coverage Is Incomplete
Endpoint-0056Non-Compliant Devices (6)
P2
Retention Policy Coverage Is Partial Across M365 Workloads
DataProtection-0121Retention Policy (1)
P2
Public IP Addresses With Exposure Risks
Infrastructure-0062Public IP Addresses (2)
P2
Medium-Severity Vulnerabilities Require Planned Remediation
Vulnerability-0031Medium-Priority Configuration Gaps (30)
P2
Unused License Spend Detected
Cost-0023Unused License Seats (32)
P2
Azure Advisor Savings Not Yet Realized
Cost-0031Cost Optimization Recommendations (7)
P2
Oversized VM Fleet Increasing Compute Spend
Cost-0043Oversized Virtual Machines (4)
P2
Cloud Budget Alerts Missing
Cost-0051Subscription Budget Control Gap (1)
P2
Unlicensed Users Consuming Paid Service Capacity
Cost-0061Unlicensed Users (30)
P2
Underutilized Premium License Portfolio
Cost-0081Premium Sku With Low Utilization (1)
P2
AD: Legacy Authentication Active
ActiveDirectory-0023Users on Legacy Protocols (3)
P2
AD: Domain Controller Patch Baseline Gap
ActiveDirectory-0081AD: Domain Controller Patch Baseline Gap
P2
On-Prem: USB Storage Policy Not Enforced
OnPremInfra-ONPREM-EP-0041Infrastructure Configuration (1)
P2
On-Prem: Security Audit Log Retention Below 1 GB
OnPremInfra-ONPREM-AUD-0021Infrastructure Configuration (1)
P2
On-Prem: Certificates Using Weak Algorithms (SHA1/MD5)
OnPremInfra-ONPREM-CERT-0021Infrastructure Configuration (1)
P2
On-Prem: Stale Computer Accounts Detected
OnPremInfra-ONPREM-AD-0101Infrastructure Configuration (1)
P2
Excessive Guest Users in Directory
Identity-0235Guest Users (35)
P2
Risky Sign-Ins from Unknown Locations
Identity-0281Security Control (8)
P2
SMS-Based MFA Still in Significant Use
Identity-0291Admins with SMS-Only MFA (24)
P2
Stale Device Sync Older Than 30 Days
Device-0111Device (1)
P2
Outdated Endpoint Operating System Versions
Device-0121Device (1)
P2
No Device Configuration Policies Applied
Device-0141Configuration Policy Baseline (1)
P2
SharePoint Sites Permit External Sharing
DataProtection-0191Sharepoint Site (1)
P2
Unassociated Public IP Addresses Detected
Network-0112Public IP Addresses (2)
P2
No Attack Simulation Campaigns Executed
Network-0141Phishing Simulation Program Baseline (1)
P2
DMARC Record Missing Aggregate Reporting
Email-0101Security Control (1)
P2
SPF Record Too Permissive
Email-0111Security Control (1)
P2
DMARC Policy Not Yet Set to Reject
Email-0151Security Control (1)
P2
Mailbox Auditing Disabled for Some or All Mailboxes
Email-0171Security Control (1)
P2
Email Quarantine Workflow Not Configured
Email-0191Security Control (1)
P2
Anti-Impersonation Coverage Below Target
Email-0201Security Control (1)
P2
OS Versions Not Current
Endpoint-0061Security Control (1)
P2
Stale Devices with No Sync > 90 Days
Endpoint-0081Security Control (1)
P2
Defender Attack Surface Reduction Rules Not Enforced
Endpoint-0121Security Control (1)
P2
Defender Onboarding Coverage Below 80%
Endpoint-01410Unprotected Devices (7)
P2
Defender EDR Block Mode Disabled
Endpoint-0151Security Control (1)
P2
eDiscovery Response Workflows Not Configured
DataProtection-0041Security Control (1)
P2
External Sharing Unrestricted on SharePoint Sites
DataProtection-0061Security Controls (3)
P2
OneDrive External Sharing Open
DataProtection-0071Security Control (1)
P2
Retention Period Below Compliance Baseline
DataProtection-0091Security Control (1)
P2
No Access Reviews Configured
Identity-0191Security Control (1)
P2
OAuth Consent Policy Allows User Consent
Identity-0221High-Risk OAuth Apps (1)
P2
SQL Servers Without Azure AD Authentication
Infrastructure-0121Security Control (1)
P2
Key Vault Secrets Not Rotated
Infrastructure-0131Security Controls (2)
P2
No Private Endpoints for PaaS Resources
Infrastructure-0141Security Control (1)
P2
Critical Azure Resources Missing Diagnostic Logging
CloudPosture-0031Security Controls (3)
P2
No Azure Policy Assignments Detected
CloudPosture-0041Security Control (1)
P2
No Analytic Rules for Critical Threat Scenarios
Resilience-0031Security Control (1)
P2
Backup Restore Testing Stale
Resilience-0041Security Control (1)
P2
CMMC SC.L2-3.13.2: Security Engineering (Partial)
CMMC-SC.L2-3.13.25SC.L2-3.13.2 — System & Communications Protection (Partial)
P2
CMMC CM.L2-3.4.5: Access Restrictions for Change (Partial)
CMMC-CM.L2-3.4.55CM.L2-3.4.5 — Configuration Management (Partial)
P2
CMMC SI.L2-3.14.2: Malicious Code Protection (Partial)
CMMC-SI.L2-3.14.25SI.L2-3.14.2 — System & Information Integrity (Partial)
P2
CMMC SI.L2-3.14.5: Advanced Persistent Threat Protection (Fail)
CMMC-SI.L2-3.14.55SI.L2-3.14.5 — System & Information Integrity (Fail)
P2
34 accounts still accept RC4 Kerberos encryption
OnPrem-97a5bcd3de1156ed22b2c2c6bf46b7c4
P2
PowerShell script-block logging disabled across 203 hosts
OnPrem-d9410d7869f255a0fec2355e9aefcf99
P2
LSA Protection (RunAsPPL) is not enabled
OnPrem-0f77e63ab314918dcaf223a564609ca8
P2
Legacy NTLMv1 authentication is still allowed
OnPrem-42f2c00314d0c3e902ae242f5915f138
P3 · Low15 items
P3
929 Email Threat Detections Observed in Last 30 Days
Email-0014Email Threats (30 Days)
P3
Sensitivity Labels Configured but Under-Adopted
DataProtection-0032Sensitivity Labels (2)
P3
Duplicate Security Tools Detected
Cost-0074Security Tooling Overlap (2)
P3
Disabled Accounts Are Not Being Removed
Identity-0241Security Control (15)
P3
No Passwordless Authentication Adoption
Identity-0301Security Control (150)
P3
Records Management Controls Disabled
DataProtection-0161Records Management Baseline (1)
P3
Teams Without Assigned Owners
DataProtection-0205Microsoft Team (8)
P3
No Named Locations Configured
Network-0121Conditional Access Location Baseline (1)
P3
External Sender Warning Banner Disabled
Email-0181Security Control (1)
P3
Windows Autopilot Profiles Not Configured
Endpoint-0101Security Control (1)
P3
Information Barriers Not Configured for Restricted Communications
DataProtection-0051Security Control (1)
P3
No Sensitivity Label Auto-Labeling Policies
DataProtection-0082Sensitivity Labels (2)
P3
Cloud Resource Ownership Tags Missing at Scale
CloudPosture-0051Security Controls (25)
P3
No Recent Security Tabletop Exercises
Resilience-0051Security Control (1)
P3
SYSVOL permissions hardened (no action required)
OnPrem-2033c52168ea3ca38362f4cc45adf8dd
Showing 30 of 164
P0OnPremInfra-ONPREM-FW-001
On-Prem: Windows Firewall Disabled on One or More Profiles
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Windows Firewall disabled on 1 profile(s): Public |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-FW-001 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-FW-001]
Severity Basis: Severity based on Critical impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Windows Firewall disabled on 1 profile(s): Public
onprem_infra_assessment.findings[ONPREM-FW-001]
2026-05-15T23:34:51.491662+00:00
P0OnPremInfra-ONPREM-FW-001
On-Prem: Windows Firewall Disabled on One or More Profiles
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Windows Firewall disabled on 1 profile(s): Public |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-FW-001 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-FW-001]
Severity Basis: Severity based on Critical impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Windows Firewall disabled on 1 profile(s): Public
onprem_infra_assessment.findings[ONPREM-FW-001]
2026-05-15T23:34:51.491662+00:00
P0Device-015
Critical Security Configuration Gaps Require Action
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 12 critical security configuration gap
Critical Configuration Gaps (12)
| Control / Recommendation | Priority | Score Impact |
|---|---|---|
| Do Not Allow Users To Grant Consent To Unmanaged Applications | Critical | 10.0 |
| Ensure Sign-In Risk Policy Is Enabled | Critical | 8.0 |
| Ensure User Risk Policy Is Enabled | Critical | 8.0 |
Showing 3 of 12 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore,MaxScore
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-015 meets target baseline (0) using vulnerability_data.critical_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: vulnerability_data.critical_count
Severity Basis: Severity based on Critical impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Critical Security Configuration Gaps Require Action: observed=12, target=0
vulnerability_data
2026-05-15T23:34:51.492029+00:00
P0Network-010
NSG Rules Allow All Inbound Traffic
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 network security group
Network Security Groups (1)
| NSG Name | Location | Rules |
|---|---|---|
| nsg-edge-westus2 |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Rollback the last rule/policy change impacting connectivity.
- Verify service connectivity and workflow recovery for approved traffic.
- Reintroduce controls with a staged rollout and explicit allowlist review.
Closure criteriaresolution contract
Network-010 meets target baseline (0) using arm_network_nsgs.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_network_nsgs
Severity Basis: Severity based on Critical impact and affected scope.
Evidence · 1full envelope in § 04
evidence
NSG Rules Allow All Inbound Traffic: observed=1, target=0
arm_network_nsgs
2026-05-15T23:34:51.492206+00:00
P0OnPrem-a838cee6bbdebeade5b6f87e45bd47bf
External trust to legacy-supplier.example has SID filtering disabled
Open
Impact
A compromise in the legacy-supplier forest can inject a Domain Admin SID into CORP via SID history, yielding tier-0 access without requiring any direct CORP credential theft.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADTrust -Filter * | Select Name,SIDFilteringQuarantined
Rollback
- netdom trust corp.contoso.local /domain:legacy-supplier.example /quarantine:no (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
External trust corp.contoso.local <-> legacy-supplier.example has sidFilteringQuarantined=false. SID history injection across the trust is not blocked, exposing a privilege-escalation path from a defense-subcontractor forest into CORP.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-b2f1b05d8a827a2e5c84fa24de42f482
2 Domain Admins without MFA
Open
Impact
A stolen password — even via phishing, credential stuffing, or LSASS dump on a tier-1 host — yields direct tier-0 access with no second factor blocking the attacker.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-MgUserAuthenticationMethod -UserId <UPN>
Rollback
- Disable the Conditional Access policy.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Human Domain Admins d.mercier.admin and r.hollingsworth.admin have no registered MFA method. CMMC L2 AC.L2-3.1.5 and NIST 800-171 3.5.3 both require multi-factor for privileged access.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-bed89eaf2193e46f4ff4e32592dae478
krbtgt password age 247 days exceeds 180-day threshold
Open
Impact
Adversary with prior domain compromise can issue Kerberos TGTs that pass every DC's validation indefinitely. Current ticket lifetime (10h default) is irrelevant once krbtgt is stolen.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADUser krbtgt -Properties PasswordLastSet | Select PasswordLastSet
Rollback
- N/A — krbtgt rotation cannot be rolled back.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
krbtgt password last set 2025-08-15 (247 days ago). CMMC L2 credential rotation guidance and Microsoft ESAE best practice both put the outer bound at 180 days. A stale krbtgt enables undetectable Golden Ticket forgery for any adversary that has obtained a prior NTLM hash.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-16f7917e737ec4706ddf063523c83342
AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor
Open
Impact
Attacker with control of the vendor principal can modify ACLs on protected accounts (Domain Admins, Enterprise Admins, krbtgt) and maintain persistence via hourly SDProp reapplication.
Verifyexpected post-remediation
- Verify remediation on the reporting host
(Get-Acl 'AD:CN=AdminSDHolder,CN=System,DC=corp,DC=contoso,DC=local').Access
Rollback
- Re-add the ACE via Set-Acl (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
CONTRACT\vendor_pki_audit holds GenericWrite on CN=AdminSDHolder,CN=System. SDProp reapplies this ACE to every protected group member every hour — the vendor account can maintain persistence even after cleanup.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-8ca006d6163ddcbbaba1e7966c2eadbf
DAL-PRINT01 has unconstrained Kerberos delegation
Open
Impact
Compromise of DAL-PRINT01 yields TGTs for every user who has authenticated to it, including potentially Domain Admin accounts.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADComputer DAL-PRINT01 -Properties TrustedForDelegation
Rollback
- Set-ADComputer DAL-PRINT01 -TrustedForDelegation $true (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
DAL-PRINT01.corp.contoso.local has TrustedForDelegation=True. Any user authenticating to the print server — including privileged users via printer management — leaves a TGT cached in memory.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-fa9a1cc45e2cca28fe8473c0489bcad6
HSV-FILE02 has unconstrained Kerberos delegation
Open
Impact
Compromise of HSV-FILE02 yields domain-wide TGT harvesting, including tier-0 credentials used to administer the file share.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADComputer HSV-FILE02 -Properties TrustedForDelegation
Rollback
- Set-ADComputer HSV-FILE02 -TrustedForDelegation $true.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
HSV-FILE02.corp.contoso.local has TrustedForDelegation=True. Huntsville site file server caches TGTs for every authenticated user.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-4aa38d65ce3032519d1f521931c464da
ADCS template certifies domain controllers without signature (ESC1)
Open
Impact
Adversary on any domain-joined host can enroll a DC authentication certificate and perform DCSync, Golden Certificate, or silent tier-0 pivot.
Verifyexpected post-remediation
- Verify remediation on the reporting host
certutil -v -template DomainControllerAuthentication | findstr /I 'ENROLLEE_SUPPLIES_SUBJECT'
Rollback
- Re-add the flag (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Template DomainControllerAuthentication permits requester-supplied subject, Client Authentication EKU, Domain Computers enrollment, and does not require manager approval. Any domain computer can enroll a certificate that authenticates as any DC.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-76680815350c3b60af20b49eed10bff4
ADCS template CorpUserSmartcard is ESC1 vulnerable
Open
Impact
Any authenticated domain user can enroll a certificate that authenticates as Domain Admin, bypassing MFA entirely.
Verifyexpected post-remediation
- Verify remediation on the reporting host
certutil -v -template CorpUserSmartcard | findstr /I 'ENROLLEE_SUPPLIES_SUBJECT'
Rollback
- Re-add ENROLLEE_SUPPLIES_SUBJECT (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Template CorpUserSmartcard permits the requester to supply the subject, has Client Authentication EKU, does not require manager approval, and is enrollable by Domain Users.
onprem_powershell
2026-05-15T23:34:43+00:00
P0OnPrem-2481dae51698953372cf8077e7873270
SMB server signing is not required domain-wide
Open
Impact
PetitPotam / PrinterBug coercion + relay to unsigned SMB yields code execution in the victim's context — often ending in domain compromise.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-SmbServerConfiguration | Select RequireSecuritySignature
Rollback
- Set-SmbServerConfiguration -RequireSecuritySignature $false.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Default Domain Controllers Policy does not enforce SMB server signing. Clients accept unsigned SMB sessions, leaving the domain open to NTLM relay attacks against file servers.
onprem_powershell
2026-05-15T23:34:43+00:00
P1Identity-005
Legacy Authentication Still Allowed
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
Legacy authentication protocols (like IMAP, POP3, and SMTP) bypass modern security controls including MFA, making them a prime target for attackers. Credential stuffing and password spray attacks frequently target legacy authentication. Leaving these protocols enabled creates a backdoor that undermines all MFA investments.
Blast radius · 1 tenant configuration gap
Users on Legacy Protocols (3)
| User | Protocol | Last Sign-in |
|---|---|---|
| david.mitchell@contoso.com | IMAP4 | Feb 11, 2026 21:14 |
| patricia.kowalski@contoso.com | IMAP4 | Feb 12, 2026 07:14 |
| robert.chen@contoso.com | SMTP | Feb 12, 2026 15:14 |
Verifyexpected post-remediation
- Run verification command
Get-MgAuditLogSignIn -Filter "clientAppUsed eq 'Exchange ActiveSync' or clientAppUsed eq 'Other clients'" -Top 10 | Select UserPrincipalName, ClientAppUsed, Status - Run verification command
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.Conditions.ClientAppTypes -contains 'exchangeActiveSync' -and $_.GrantControls.BuiltInControls -contains 'block'} | Select DisplayName, State
Rollback
- Identify the failing application from sign-in logs
- Set legacy auth CA policy to Report-only
- Verify application functionality restored
- Plan modern auth upgrade for the application
- Re-enable block after app is upgraded
Closure criteriaresolution contract
No results or only blocked attempts
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: conditional_access.policies
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No policy found blocking legacy authentication
/identity/conditionalAccess/policies
2026-05-15T23:34:51.489829+00:00
P1Identity-008
40 Users Not Covered by MFA Policy
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 40 users without MFA policy coverage
Users Not Covered by MFA Policy (40)
| User (Reason) |
|---|
| david.mitchell@contoso.com (Not covered) |
| patricia.kowalski@contoso.com (Not covered) |
| robert.chen@contoso.com (Not covered) |
| lisa.nakamura@contoso.com (Not covered) |
| kevin.patel@contoso.com (Not covered) |
Showing 5 of 40 total
Verifyexpected post-remediation
- Run verification command
# Re-run CA coverage analysis after policy updates # Expected: 0 unprotected users - Run verification command
Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.Users.IncludeUsers -contains 'All' -and $_.GrantControls.BuiltInControls -contains 'mfa' } | Select DisplayName, State
Rollback
- Temporarily exclude affected users from the MFA CA policy
- Assist users with MFA registration via Helpdesk
- Re-include users once registration is complete
Closure criteriaresolution contract
All users covered by MFA policy
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: ca_mfa_coverage.total_users
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
40 users not covered by 2 MFA policies
/identity/conditionalAccess/policies + /users
2026-05-15T23:34:51.489866+00:00
P1Identity-010
2 High-Risk User Accounts Detected
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 2 high-risk user accounts
High-Risk Users (6)
| User | Risk Level | Risk State | Last Updated |
|---|---|---|---|
| marcus.williams@contoso.com | High | At Risk | Feb 12, 2026 04:50 |
| jennifer.park@contoso.com | High | At Risk | Feb 12, 2026 04:50 |
| emily.rodriguez@contoso.com | Medium | At Risk | Feb 12, 2026 04:50 |
| james.okafor@contoso.com | Medium | At Risk | Feb 12, 2026 04:50 |
| rachel.kim@contoso.com | Medium | Remediated | Feb 12, 2026 04:50 |
| thomas.bergstrom@contoso.com | Low | Dismissed | Feb 12, 2026 04:50 |
Verifyexpected post-remediation
- Run verification command
Get-MgRiskyUser -Filter "riskLevel eq 'high'" | Select UserPrincipalName, RiskLevel, RiskLastUpdatedDateTime - Run verification command
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.Conditions.UserRiskLevels -ne $null} | Select DisplayName, State
Rollback
- Confirm risk is a false positive in Entra ID Protection
- Dismiss the risk and restore user access
- Reset user credentials as a precaution
Closure criteriaresolution contract
No results (all high-risk users remediated)
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: risky_users.high_risk_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
2 high-risk users out of 6 total risky
/identityProtection/riskyUsers
2026-05-15T23:34:51.489913+00:00
P1Security-001
3 Active Security Alerts (2 High, 1 Medium)
Open
Impact
Detection and response gaps increase dwell time and breach cost. IBM reports organizations with mature detection/response capabilities reduce breach impact by more than $1M compared to low-maturity peers.
Blast radius · 3 active security alerts
Active Security Alert Patterns (3)
| Alert Pattern | Severity | Count | Top Context | Latest Seen |
|---|---|---|---|---|
| Impossible travel activity | High | 1 | Status: New | Feb 05, 2026 |
| Suspicious inbox forwarding rule created | High | 1 | Status: New | Feb 03, 2026 |
| Email messages containing malicious URL removed after delivery | Medium | 1 | Status: New | Feb 06, 2026 |
Showing top 3 alert patterns from 3 active alerts.
Verifyexpected post-remediation
- Run verification command
Get-MgSecurityAlert -Filter "severity eq 'high' or severity eq 'critical' or severity eq 'medium'" -Property Id, Title, Severity, Status | Where-Object {$_.Status -ne 'resolved'} | Select Title, Severity - Run verification command
Get-MgSecurityAlert -Top 50 | Group-Object Status | Select Name, Count
Rollback
- Revert the specific configuration change in the relevant admin portal
- Verify service is restored for affected users
- Document the conflict for security review
Closure criteriaresolution contract
No unresolved critical or high alerts; medium alerts under review
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: security_alerts.critical_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 2full envelope in § 04
evidence
2 high, 1 medium alerts active
/security/alerts
2026-05-15T23:34:51.490113+00:00
evidence
38 incidents, 8 in last 7 days
/security/incidents
2026-05-15T23:34:51.490116+00:00
P1Email-005
Safe Links Protection Disabled
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Why this matters
Users are not protected by click-time malicious URL inspection, increasing phishing success probability.
Blast radius · 1 email security control
Email Security Control (1)
| Email Security Control |
|---|
| Safe Links Status |
Verifyexpected post-remediation
- Run verification command
Get-SafeLinksPolicy | Select-Object Name,IsEnabled - Run verification command
Get-SafeLinksRule | Select-Object Name,State,RecipientDomainIs
Rollback
- Place policy in monitor mode or exclude known-safe business domains
- Review user false-positive reports
- Re-enable full enforcement after tuning
Closure criteriaresolution contract
IsEnabled = True for default and scoped policies
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Safe Links Status: disabled
/security/emailThreatProtection
2026-05-15T23:34:51.490381+00:00
P1Email-006
Safe Attachments Protection Disabled
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Why this matters
Attachment sandboxing is disabled, increasing the risk that malware-bearing email reaches end users.
Blast radius · 1 email security control
Email Security Control (1)
| Email Security Control |
|---|
| Safe Attachments Status |
Verifyexpected post-remediation
- Run verification command
Get-SafeAttachmentPolicy | Select-Object Name,Enable - Run verification command
Get-SafeAttachmentRule | Select-Object Name,State,RecipientDomainIs
Rollback
- Switch policy action to Dynamic Delivery
- Review quarantine and detonation outcomes
- Tune exclusions for approved low-risk senders
Closure criteriaresolution contract
Enable = True for tenant policy
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Safe Attachments Status: disabled
/security/emailThreatProtection
2026-05-15T23:34:51.490396+00:00
P1Email-007
Anti-Phishing Controls Are Not Fully Enabled
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Why this matters
Impersonation and targeted phishing defenses are weakened, increasing risk to executives and finance users.
Blast radius · 1 email security control
Email Security Control (1)
| Email Security Control |
|---|
| Anti-Phishing Status |
Verifyexpected post-remediation
- Run verification command
Get-AntiPhishPolicy | Select-Object Name,Enabled,EnableTargetedUserProtection - Run verification command
Get-AntiPhishRule | Select-Object Name,State,RecipientDomainIs
Rollback
- Reduce impersonation strictness temporarily for impacted domains/users
- Review blocked sender patterns
- Re-enable strict policy after tuning
Closure criteriaresolution contract
Policy enabled with targeted user/domain protection
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Anti-Phishing Status: disabled
/security/emailThreatProtection
2026-05-15T23:34:51.490408+00:00
P1Email-008
Email Threat Detection/Containment Rate Is Below Target
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Why this matters
A lower containment rate means more malicious email may remain in user mailboxes, increasing business compromise and incident response risk.
Blast radius · 1 email security control
Email Threats (30 Days)
| Category | Count |
|---|---|
| Spam | 892 |
| Phishing | 34 |
| Malware | 3 |
| Total | 929 |
Verifyexpected post-remediation
- Run verification command
Get-MgSecurityAlert -Top 200 | Measure-Object - Run verification command
Get-MessageTrace -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date)
Rollback
- Restore prior threshold configuration
- Validate true-positive rates on recent detections
- Retune gradually with SOC feedback
Closure criteriaresolution contract
Containment rate trends to >=95% over the next reporting window
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Threat Detection Rate: 67.0%
/security/emailThreatProtection
2026-05-15T23:34:51.490424+00:00
P1Identity-014
FIDO2 / Passkey Authentication Not Enabled
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
Phishing-resistant authentication is not enabled at the policy layer. This leaves the tenant more exposed to credential theft and MFA fatigue attacks.
Blast radius · 1 authentication methods policy
Authentication Methods Policy (1)
| Authentication Methods Policy |
|---|
| FIDO2 method configuration |
Verifyexpected post-remediation
- Run verification command
Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration | Where-Object {$_.Id -eq 'Fido2'} | Select-Object Id,State - Run verification command
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 20 | Select-Object userPrincipalName,isPasswordlessCapable
Rollback
- Disable FIDO2 method policy target group temporarily
- Keep Microsoft Authenticator available as fallback
- Review registration failures before re-enabling
Closure criteriaresolution contract
State = enabled
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: authentication_methods_policy.method_configurations
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
FIDO2 method state = disabled
/policies/authenticationMethodsPolicy
2026-05-15T23:34:51.490448+00:00
P1Security-002
Failed and Risky Sign-In Volume Exceeds Baseline
Open
Impact
Detection and response gaps increase dwell time and breach cost. IBM reports organizations with mature detection/response capabilities reduce breach impact by more than $1M compared to low-maturity peers.
Why this matters
Authentication failure and risky sign-in volume is elevated, suggesting active account targeting or policy/user experience gaps that could lead to compromise.
Blast radius · 120 risky or failed sign-in event
Active Security Alert Patterns (3)
| Alert Pattern | Severity | Count | Top Context | Latest Seen |
|---|---|---|---|---|
| Impossible travel activity | High | 1 | Status: New | Feb 05, 2026 |
| Suspicious inbox forwarding rule created | High | 1 | Status: New | Feb 03, 2026 |
| Email messages containing malicious URL removed after delivery | Medium | 1 | Status: New | Feb 06, 2026 |
Showing top 3 alert patterns from 3 active alerts.
Verifyexpected post-remediation
- Run verification command
Get-MgAuditLogSignIn -Top 200 | Group-Object Status | Select-Object Name,Count - Run verification command
Get-MgIdentityProtectionRiskyUser -Top 50 | Select-Object UserPrincipalName,RiskLevel,RiskState
Rollback
- Set impacted Conditional Access rules to report-only
- Review sign-in logs for top failure causes
- Tune policy scope before enforcing again
Closure criteriaresolution contract
Failed sign-in count trends downward week-over-week
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sign_in_analysis.failed_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Failed sign-ins: 120, risky sign-ins: 12
/auditLogs/signIns
2026-05-15T23:34:51.490496+00:00
P1Governance-002
Privileged High-Risk Administrative Operations Require Review
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 3 high-risk administrative operation
High-Risk Administrative Operation (3)
| High-Risk Administrative Operation |
|---|
| sarah.chen@contoso.com -> Add member to role |
| michael.torres@contoso.com -> Disable MFA for user |
| sarah.chen@contoso.com -> Consent to application |
Verifyexpected post-remediation
- Run verification command
Get-MgAuditLogDirectoryAudit -Top 50 | Select-Object ActivityDisplayName,InitiatedBy,TargetResources,ActivityDateTime - Run verification command
Get-MgSecurityAlert -Top 20 | Select-Object Title,Severity,Status
Rollback
- Temporarily relax operation approval condition
- Complete emergency change with ticket references
- Reinstate controls and review exception
Closure criteriaresolution contract
All high-risk actions map to approved change tickets
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: high_risk_operations.total_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
High-risk operations: 3 (critical: 1)
/auditLogs/directoryAudits
2026-05-15T23:34:51.490579+00:00
P1DataProtection-010
SharePoint External Sharing Is Enabled on Collaboration Sites
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 7 sharepoint site with external sharing
Sharepoint Site With External Sharing (7)
| Sharepoint Site With External Sharing |
|---|
| Human Resources |
| Finance and Billing |
| IT Operations |
| Training Portal |
| Marcus Williams |
Showing 5 of 7 total
Verifyexpected post-remediation
- Run verification command
Get-SPOSite -Limit All | Select-Object Url,SharingCapability - Run verification command
Get-SPOTenant | Select-Object RequireAnonymousLinksExpireInDays
Rollback
- Temporarily allow partner domain sharing for approved sites
- Maintain strict sharing controls on sensitive sites
- Re-tune policy after business validation
Closure criteriaresolution contract
Sensitive sites show SharingCapability = Disabled
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sharepoint_sites.sites
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
External sharing enabled on 7 sites
/sites
2026-05-15T23:34:51.490606+00:00
P1Governance-003
Secure Score Recommendation Backlog Is Accumulating
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
A large recommendation backlog indicates delayed security hardening and prolonged exposure to known control gaps.
Blast radius · 11 deferred secure score recommendation
Top Improvement Actions (85 total)
| Recommendation | Priority | Score Impact |
|---|---|---|
| Do Not Allow Users To Grant Consent To Unmanaged Applications | Critical | 9.0 |
| Ensure Sign-In Risk Policy Is Enabled | Critical | 8.5 |
| Ensure User Risk Policy Is Enabled | Critical | 8.5 |
| Windows Print Spooler Elevation Of Privilege | High | 7.8 |
| Windows Ancillary Function Driver For Win Sock Elevation Of Privilege | High | 7.8 |
These are Microsoft Secure Score recommendations, not CVE vulnerabilities.
Verifyexpected post-remediation
- Run verification command
Get-MgSecuritySecureScoreControlProfile -Top 50 | Select-Object Title,ImplementationStatus,Score - Run verification command
Get-Content remediation_backlog.csv | Select-Object -First 20
Rollback
- Pause recommendation sprint board updates
- Reprioritize backlog with risk and business owners
- Resume with adjusted scope
Closure criteriaresolution contract
Not-started high-value recommendations trend downward each sprint
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: recommendations.recommendations
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Not-started recommendations: 11
/security/secureScores
2026-05-15T23:34:51.490651+00:00
P1Application-006
Third-Party Application Consents Include Elevated-Risk Integrations
Open
Impact
Overprivileged applications can access broad tenant data silently. OAuth app abuse has been used in major cloud intrusions, and unauthorized app consent can bypass traditional endpoint controls.
Why this matters
Several third-party applications hold elevated Microsoft 365 permissions, including apps from unverified publishers. This raises supply-chain and data exfiltration risk.
Blast radius · 2 third-party app with elevated permissions
High-Risk OAuth Apps (2)
| Application | Permissions | Consent Type | Risky Perms |
|---|---|---|---|
| DataSync Pro (Unverified) | User.Read.All, Mail.ReadWrite, Files.ReadWrite.All, Directory.Read.All, Sites.FullControl.All | 0 users | 5 |
Showing 1 of 2 total
Verifyexpected post-remediation
- Run verification command
Get-MgServicePrincipal -All | Select-Object DisplayName,AppOwnerOrganizationId - Run verification command
Get-MgOauth2PermissionGrant -All | Select-Object ClientId,Scope,ConsentType
Rollback
- Re-consent approved business-critical applications
- Restrict permissions to minimum required scope
- Schedule vendor remediation for high-risk permissions
Closure criteriaresolution contract
Only approved apps with documented owners remain
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: third_party_apps.apps
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Risky third-party apps detected: 2
/servicePrincipals
2026-05-15T23:34:51.490712+00:00
P1Identity-017
Strong Authentication Method Adoption Is Below Target
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
A material portion of user accounts is not prepared for strong MFA, increasing susceptibility to phishing and account takeover.
Blast radius · 52 user lacking strong auth methods
User Lacking Strong Auth Methods (52)
| User Lacking Strong Auth Methods |
|---|
| david.mitchell@contoso.com |
| robert.johnson@contoso.com |
| ana.rodriguez@contoso.com |
| jenny.lee@contoso.com |
Showing 4 of 52 total
Verifyexpected post-remediation
- Run verification command
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 200 | Select-Object UserPrincipalName,IsMfaCapable,MethodsRegistered - Run verification command
Get-Content mfa_exceptions.csv | Select-Object -First 20
Rollback
- Temporarily exempt affected users from strict auth strength policy
- Keep Authenticator MFA as fallback
- Complete registration support and re-apply
Closure criteriaresolution contract
Coverage reaches at least 95% MFA-capable users
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: user_auth_methods.stats
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
MFA-capable coverage: 65.3%
/reports/authenticationMethods/userRegistrationDetails
2026-05-15T23:34:51.490741+00:00
P1Security-003
Threat Pulse Indicates Elevated Active Alert Backlog
Open
Impact
Detection and response gaps increase dwell time and breach cost. IBM reports organizations with mature detection/response capabilities reduce breach impact by more than $1M compared to low-maturity peers.
Blast radius · 28 active security alert
Active Security Alert Patterns (3)
| Alert Pattern | Severity | Count | Top Context | Latest Seen |
|---|---|---|---|---|
| Impossible travel activity | High | 1 | Status: New | Feb 05, 2026 |
| Suspicious inbox forwarding rule created | High | 1 | Status: New | Feb 03, 2026 |
| Email messages containing malicious URL removed after delivery | Medium | 1 | Status: New | Feb 06, 2026 |
Showing top 3 alert patterns from 3 active alerts.
Verifyexpected post-remediation
- Run verification command
Get-MgSecurityAlert -Top 200 | Group-Object Severity | Select-Object Name,Count - Run verification command
Get-Content soc_triage_metrics.csv | Select-Object -First 20
Rollback
- Revert triage automation to prior rule set
- Restore previous alert routing
- Retune thresholds and redeploy
Closure criteriaresolution contract
High-severity backlog decreases week-over-week
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: threat_pulse.active_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Active alerts: 28; high severity: 2
/security/alerts_v2
2026-05-15T23:34:51.490757+00:00
P1Infrastructure-001
Network Security Groups Allow Unrestricted Inbound Access
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 Network Security Group
Network Security Groups (1)
| NSG Name | Location | Rules |
|---|---|---|
| nsg-edge-westus2 |
Verifyexpected post-remediation
- Run verification command
az network nsg list --query '[].{Name:name, RG:resourceGroup}' -o table - Run verification command
az network nsg rule list --nsg-name <nsg-name> --resource-group <rg> --query '[?direction==`Inbound` && access==`Allow`]'
Rollback
- Identify the affected NSG rule from Azure Activity Log
- Re-add the specific allow rule for the affected service
- Verify the workload is accessible again
- Schedule a change window to implement the restriction with proper testing
Closure criteriaresolution contract
List of NSGs for review
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_network_nsgs
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
1 NSG with risky inbound rules
Azure Network Management API
2026-05-15T23:34:51.490811+00:00
P1Infrastructure-002
Storage Accounts Allow Public Blob Access
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 Storage Account
Storage Account (1)
| Storage Account |
|---|
| stapp01 |
Verifyexpected post-remediation
- Run verification command
az storage account list --query '[?allowBlobPublicAccess==`true`].{Name:name, RG:resourceGroup}' -o table
Rollback
- Re-enable public blob access on the specific storage account
- Verify the application content is accessible
- Evaluate Azure CDN or Azure Front Door as alternatives to public blob access
- Implement SAS token-based access for non-public content
Closure criteriaresolution contract
No results (all accounts have public access disabled)
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_storage_accounts
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
1 storage accounts allow public access
Azure Storage Management API
2026-05-15T23:34:51.490825+00:00
P1Vulnerability-001
Security Configuration Gaps Require Remediation
Open
Impact
Unpatched vulnerabilities compress defender response windows. Mandiant reports critical exploit weaponization often occurs within days to weeks, increasing incident probability and emergency remediation spend.
Why this matters
12 high-priority security configuration gaps detected across the tenant. These represent significant configuration weaknesses that increase the organization's attack surface and should be addressed promptly.
Blast radius · 12 Security Controls
Critical Configuration Gaps (12)
| Control / Recommendation | Priority | Score Impact |
|---|---|---|
| Do Not Allow Users To Grant Consent To Unmanaged Applications | Critical | 10.0 |
| Ensure Sign-In Risk Policy Is Enabled | Critical | 8.0 |
| Ensure User Risk Policy Is Enabled | Critical | 8.0 |
Showing 3 of 12 total
Verifyexpected post-remediation
- Run verification command
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore, MaxScore
Rollback
- Restore previous configuration or patch level
- Document the incompatibility
- Engage vendor for compatible fix
- Implement compensating controls
Closure criteriaresolution contract
CurrentScore near MaxScore with no critical gaps
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: vulnerability_data
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
12 critical vulnerabilities
Microsoft Secure Score
2026-05-15T23:34:51.490909+00:00
P1Vulnerability-002
High-Severity Vulnerabilities Require Short-Term Remediation
Open
Impact
Unpatched vulnerabilities compress defender response windows. Mandiant reports critical exploit weaponization often occurs within days to weeks, increasing incident probability and emergency remediation spend.
Why this matters
28 high-severity security vulnerabilities identified. These represent significant configuration gaps that increase the organization's attack surface and should be addressed within 30 days.
Blast radius · 28 Security Controls
High-Priority Configuration Gaps (28)
| Control / Recommendation | Priority | Affected Assets |
|---|---|---|
| Windows Print Spooler Elevation Of Privilege | High | 12 |
| Windows Ancillary Function Driver For Win Sock Elevation Of Privilege | High | 8 |
Showing 2 of 28 total
Verifyexpected post-remediation
- Run verification command
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore
Rollback
- Restore previous configuration or patch level
- Document the incompatibility
- Engage vendor for compatible fix
- Implement compensating controls
Closure criteriaresolution contract
Score improved after remediation
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: vulnerability_data
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
28 high-severity vulnerabilities
Microsoft Secure Score
2026-05-15T23:34:51.490923+00:00
P1Cost-001
Orphaned Cloud Resources Incurring Waste
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
6 orphaned resources are consuming budget without delivering business value. Current avoidable spend is $1,240/month ($14,880/year).
Blast radius · 6 orphaned cloud resources
Orphaned Cloud Resources (6)
| Orphaned Cloud Resources |
|---|
| orphaned-managed-disk-fin01 |
| unused-public-ip-westus2 |
| stale-snapshot-hr-archive |
Showing 3 of 6 total
Verifyexpected post-remediation
- Run verification command
az resource list --tag orphaned=true -o table
Rollback
- Restore deleted resource from backup or deployment template
- Reattach recovered resource to dependent workload
- Tag resource as protected from cleanup automation
Closure criteriaresolution contract
No orphaned resources returned
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: cost_summary.orphaned_resources
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
6 orphaned resources costing $1,240/month ($14,880/year)
cost_summary.orphaned_resources
2026-05-15T23:34:51.490974+00:00
P1ActiveDirectory-003
AD: Privileged Admin Footprint Controlled
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 3 AD configuration
AD: Privileged Admin Footprint Controlled
| Control | Current State | Evidence |
|---|---|---|
| Privileged Admin Footprint Controlled | 3 Global Admins (target: <=4), but 1 admin without MFA | 3 Global Admins found; admin3@contoso.com lacks MFA registration |
Verifyexpected post-remediation
- Run verification command
Get-MgReportAuthenticationMethodUserRegistrationDetail | Where-Object {$_.IsAdmin -eq $true -and $_.IsMfaRegistered -eq $false} | Measure-Object - Run verification command
Get-MgRoleManagementDirectoryRoleAssignmentSchedule -Filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" | Select PrincipalId, MemberType - Run verification command
./Invoke-SecurityCollection.ps1 -OutputPath ./results
Rollback
- Use a break-glass account (excluded from MFA policy) to regain access
- Temporarily disable the MFA Conditional Access policy
- Issue Temporary Access Passes to affected administrators
- Re-enable MFA after ensuring all admins have registered MFA methods
Closure criteriaresolution contract
Count: 0
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_ad_assessment
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
3 Global Admins found; admin3@contoso.com lacks MFA registration
onprem_ad_assessment.controls[AD-003]
2026-05-15T23:34:51.491435+00:00
P1ActiveDirectory-006
AD: LDAP Signing/Channel Binding Gap
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 AD configuration
AD: LDAP Signing/Channel Binding Gap
| Control | Current State | Evidence |
|---|---|---|
| LDAP Signing/Channel Binding Gap | LDAP signing not enforced on domain controllers | GPO audit shows LDAPServerIntegrity = 0 (Not Required) on DC-01, DC-02 |
Verifyexpected post-remediation
- Run verification command
Get-ADDomainController -Filter * | ForEach-Object { Get-ItemProperty "\\$($_.HostName)\HKLM\System\CurrentControlSet\Services\NTDS\Parameters" -Name LDAPServerIntegrity } - Run verification command
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Services\NTDS\Parameters' -Name 'LdapEnforceChannelBinding' - Run verification command
./Invoke-SecurityCollection.ps1 -OutputPath ./results
Rollback
- Set LDAPServerIntegrity back to 1 (negotiate) or 0 (not required) on affected DCs
- Set LdapEnforceChannelBinding back to 0 or 1 if channel binding broke clients
- Restart the NTDS service on affected DCs for changes to take effect
- Identify non-compliant LDAP clients via Event ID 2889 in the Directory Service log
- Update the non-compliant clients to support LDAP signing before re-enforcing
Closure criteriaresolution contract
LDAPServerIntegrity: 2 (Require signing) on all DCs
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_ad_assessment
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
GPO audit shows LDAPServerIntegrity = 0 (Not Required) on DC-01, DC-02
onprem_ad_assessment.controls[AD-006]
2026-05-15T23:34:51.491451+00:00
P1OnPremInfra-ONPREM-FW-003
On-Prem: RDP Exposed Broadly Across Networks
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| RDP is exposed to all networks — primary ransomware entry vector |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-FW-003 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-FW-003]
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
RDP is exposed to all networks — primary ransomware entry vector
onprem_infra_assessment.findings[ONPREM-FW-003]
2026-05-15T23:34:51.491679+00:00
P1OnPremInfra-ONPREM-NET-001
On-Prem: High-Risk Listening Ports Exposed
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Open high-risk ports: 3389 (RDP (remote access exposure)), 445 (SMB (lateral movement, ransomware)), 1433 (SQL Server (d |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-NET-001 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-NET-001]
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Open high-risk ports: 3389 (RDP (remote access exposure)), 445 (SMB (lateral movement, ransomware)), 1433 (SQL Server (database exposure))
onprem_infra_assessment.findings[ONPREM-NET-001]
2026-05-15T23:34:51.491693+00:00
P1OnPremInfra-ONPREM-EP-005
On-Prem: Windows Update Not Configured or Current
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| System patching is behind — 12 updates pending, last update 45 days ago |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-EP-005 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-EP-005]
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
System patching is behind — 12 updates pending, last update 45 days ago
onprem_infra_assessment.findings[ONPREM-EP-005]
2026-05-15T23:34:51.491707+00:00
P1OnPremInfra-ONPREM-CERT-001
On-Prem: Certificates Expiring Within 30 Days
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Certificates expiring soon: CN=mail.contoso.local |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-CERT-001 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-CERT-001]
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Certificates expiring soon: CN=mail.contoso.local
onprem_infra_assessment.findings[ONPREM-CERT-001]
2026-05-15T23:34:51.491720+00:00
P1OnPremInfra-ONPREM-AD-011
On-Prem: Password Policy Below Minimum Strength
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Domain password policy requires only 8 characters — below CMMC/NIST minimum of 12 |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-AD-011 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-AD-011]
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Domain password policy requires only 8 characters — below CMMC/NIST minimum of 12
onprem_infra_assessment.findings[ONPREM-AD-011]
2026-05-15T23:34:51.491732+00:00
P1Identity-025
Too Many Global Administrators
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 7 security control
Security Control (7)
| Security Control |
|---|
| Too Many Global Administrators |
Showing 1 of 7 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-025 meets target baseline (<=5) using privileged_accounts.global_admin_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.global_admin_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Too Many Global Administrators: observed=7, target=<=5
privileged_accounts
2026-05-15T23:34:51.491848+00:00
P1Identity-026
PIM Not Utilized for Privileged Roles
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 12 security control
Security Control (12)
| Security Control |
|---|
| PIM Not Utilized for Privileged Roles |
Showing 1 of 12 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-026 meets target baseline (PIM enabled for privileged roles) using privileged_accounts.pim_eligible_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.pim_eligible_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
PIM Not Utilized for Privileged Roles: observed=0/12, target=PIM enabled for privileged roles
privileged_accounts
2026-05-15T23:34:51.491856+00:00
P1Identity-027
Legacy Authentication Sign-Ins Detected
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 23 security control
Users on Legacy Protocols (3)
| User | Protocol | Last Sign-in |
|---|---|---|
| david.mitchell@contoso.com | IMAP4 | Feb 11, 2026 21:14 |
| patricia.kowalski@contoso.com | IMAP4 | Feb 12, 2026 07:14 |
| robert.chen@contoso.com | SMTP | Feb 12, 2026 15:14 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-027 meets target baseline (0) using sign_in_analysis.legacy_auth_sign_ins.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sign_in_analysis.legacy_auth_sign_ins
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Legacy Authentication Sign-Ins Detected: observed=23, target=0
sign_in_analysis
2026-05-15T23:34:51.491866+00:00
P1Device-010
Managed Devices Missing Disk Encryption
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 device
Device (1)
| Device |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-010 meets target baseline (0) using managed_devices.devices[].is_encrypted.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices[].is_encrypted
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Managed Devices Missing Disk Encryption: observed=1, target=0
managed_devices
2026-05-15T23:34:51.491926+00:00
P1Device-013
No Device Compliance Policies Defined
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 compliance policy baseline
Non-Compliant Devices (1)
| Device | OS | Status | Owner |
|---|---|---|---|
| SRP-PC012 | Windows | Non-compliant | marcus.williams@contoso.com |
| SRP-PC025 | Windows | Non-compliant | james.okafor@contoso.com |
| SRP-PC038 | Windows | Unknown | thomas.bergstrom@contoso.com |
| SRP-PC007 | Windows | Non-compliant | james.liu@contoso.com |
| SRP-PC008 | Windows | Unknown | robert.johnson@contoso.com |
| SRP-MAC007 | macOS | Non-compliant | ana.rodriguez@contoso.com |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-013 meets target baseline (>=1) using device_compliance_policies.total_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: device_compliance_policies.total_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Device Compliance Policies Defined: observed=0, target=>=1
device_compliance_policies
2026-05-15T23:34:51.491954+00:00
P1Device-016
High Endpoint Vulnerability Backlog
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 85 known vulnerability
High-Priority Configuration Gaps (85)
| Control / Recommendation | Priority | Affected Assets |
|---|---|---|
| Windows Print Spooler Elevation Of Privilege | High | 12 |
| Windows Ancillary Function Driver For Win Sock Elevation Of Privilege | High | 8 |
Showing 2 of 85 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore,MaxScore
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-016 meets target baseline (<=20) using vulnerability_data.total_vulnerabilities.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: vulnerability_data.total_vulnerabilities
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
High Endpoint Vulnerability Backlog: observed=85, target=<=20
vulnerability_data
2026-05-15T23:34:51.492048+00:00
P1DataProtection-013
No DLP Policies Configured
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 DLP policy baseline
Dlp Policy Baseline (1)
| Dlp Policy Baseline |
|---|
| No DLP Policies Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy/rule assignment for impacted collaboration scopes.
- Confirm access for approved business processes is restored.
- Reapply controls with staged rollout and policy exceptions approved by owners.
Closure criteriaresolution contract
DataProtection-013 meets target baseline (>=1) using dlp_policies.total_policies.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: dlp_policies.total_policies
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No DLP Policies Configured: observed=0, target=>=1
dlp_policies
2026-05-15T23:34:51.492074+00:00
P1DataProtection-017
Excessive Third-Party App Permissions
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 third-party application
Apps with Excessive Permissions (1)
| Application | Permissions | Consent Type | Risky Perms |
|---|---|---|---|
| DataSync Pro (Unverified) | User.Read.All, Mail.ReadWrite, Files.ReadWrite.All, Directory.Read.All, Sites.FullControl.All | 0 users | 5 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy/rule assignment for impacted collaboration scopes.
- Confirm access for approved business processes is restored.
- Reapply controls with staged rollout and policy exceptions approved by owners.
Closure criteriaresolution contract
DataProtection-017 meets target baseline (0 apps with >10 permissions) using third_party_apps.apps.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: third_party_apps.apps
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Excessive Third-Party App Permissions: observed=1, target=0 apps with >10 permissions
third_party_apps
2026-05-15T23:34:51.492107+00:00
P1Network-013
Sensitive Email Encryption Not Enabled
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 email encryption baseline
Email Encryption Baseline (1)
| Email Encryption Baseline |
|---|
| Sensitive Email Encryption Not Enabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Rollback the last rule/policy change impacting connectivity.
- Verify service connectivity and workflow recovery for approved traffic.
- Reintroduce controls with a staged rollout and explicit allowlist review.
Closure criteriaresolution contract
Network-013 meets target baseline (enabled) using email_security.email_encryption_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.email_encryption_enabled
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Sensitive Email Encryption Not Enabled: observed=disabled, target=enabled
email_security
2026-05-15T23:34:51.492235+00:00
P1Email-009
External Email Forwarding Rules Detected
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| ForwardAll |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-009 meets target baseline (0 external forwarding rules) using exchange_transport_rules.rules.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: exchange_transport_rules.rules
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
External Email Forwarding Rules Detected: observed=1, target=0 external forwarding rules
exchange_transport_rules
2026-05-15T23:34:51.492268+00:00
P1Email-012
No Outbound Spam Policy Enabled
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Outbound Spam Policy Enabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-012 meets target baseline (enabled) using email_security.outbound_spam_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.outbound_spam_enabled
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Outbound Spam Policy Enabled: observed=disabled, target=enabled
email_security
2026-05-15T23:34:51.492296+00:00
P1Email-013
Mail Flow Rules Bypass Security Filtering
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| BypassSpam |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-013 meets target baseline (0 bypass rules) using exchange_transport_rules.rules.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: exchange_transport_rules.rules
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Mail Flow Rules Bypass Security Filtering: observed=1, target=0 bypass rules
exchange_transport_rules
2026-05-15T23:34:51.492305+00:00
P1Email-014
Auto-Forward to External Addresses Detected
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 2 security controls
Security Controls (2)
| Security Controls |
|---|
| Auto-Forward to External Addresses Detected |
Showing 1 of 2 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-014 meets target baseline (0 mailbox auto-forward rules to external domains) using email_security.external_forward_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.external_forward_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Auto-Forward to External Addresses Detected: observed=2, target=0 mailbox auto-forward rules to external domains
email_security
2026-05-15T23:34:51.492315+00:00
P1Email-016
Multiple Domains Without DMARC
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| contoso.com |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-016 meets target baseline (DMARC enabled on all verified domains) using email_security.domains.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.domains
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Multiple Domains Without DMARC: observed=1, target=DMARC enabled on all verified domains
email_security
2026-05-15T23:34:51.492335+00:00
P1Endpoint-007
Managed Devices Missing BitLocker or Device Encryption
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-007 meets target baseline (100% encryption coverage for managed devices) using managed_devices.devices.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Managed Devices Missing BitLocker or Device Encryption: observed=1, target=100% encryption coverage for managed devices
managed_devices
2026-05-15T23:34:51.492399+00:00
P1Endpoint-011
Defender Tamper Protection Disabled
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Defender Tamper Protection Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-011 meets target baseline (enabled) using mde_summary.tamper_protection_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: mde_summary.tamper_protection_enabled
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Defender Tamper Protection Disabled: observed=disabled, target=enabled
mde_summary
2026-05-15T23:34:51.492427+00:00
P1Endpoint-013
Unsupported Operating Systems in Managed Fleet
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-013 meets target baseline (0 unsupported operating systems) using managed_devices.devices.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Unsupported Operating Systems in Managed Fleet: observed=1, target=0 unsupported operating systems
managed_devices
2026-05-15T23:34:51.492446+00:00
P1Identity-018
Privileged Identity Management Not Protecting Admin Roles
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 12 security controls
Security Controls (12)
| Security Controls |
|---|
| Privileged Identity Management Not Protecting Admin Roles |
Showing 1 of 12 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Identity-018 meets target baseline (Privileged roles protected with PIM eligibility and just-in-time activation) using privileged_accounts.pim_eligible_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.pim_eligible_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Privileged Identity Management Not Protecting Admin Roles: observed=0/12, target=Privileged roles protected with PIM eligibility and just-in-time activation
privileged_accounts
2026-05-15T23:34:51.492567+00:00
P1Identity-020
Risky Sign-Ins Not Investigated
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 4 security controls
Security Controls (4)
| Security Controls |
|---|
| Risky Sign-Ins Not Investigated |
Showing 1 of 4 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Identity-020 meets target baseline (0 unresolved risky sign-ins) using risky_sign_ins.unresolved_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: risky_sign_ins.unresolved_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Risky Sign-Ins Not Investigated: observed=4, target=0 unresolved risky sign-ins
risky_sign_ins
2026-05-15T23:34:51.492633+00:00
P1Identity-021
Emergency Access Accounts Not Ready for Lockout Recovery
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Emergency Access Accounts Not Ready for Lockout Recovery |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Identity-021 meets target baseline (At least 2 monitored emergency access accounts) using privileged_accounts.break_glass_accounts.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.break_glass_accounts
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Emergency Access Accounts Not Ready for Lockout Recovery: observed=1, target=At least 2 monitored emergency access accounts
privileged_accounts
2026-05-15T23:34:51.492642+00:00
P1Infrastructure-010
No Effective Network Segmentation Detected
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Effective Network Segmentation Detected |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-010 meets target baseline (Segmented NSG architecture by workload trust boundary) using arm_network_nsgs.total_nsgs.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_network_nsgs.total_nsgs
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Effective Network Segmentation Detected: observed=1, target=Segmented NSG architecture by workload trust boundary
arm_network_nsgs
2026-05-15T23:34:51.492667+00:00
P1Infrastructure-011
Storage Accounts Allow HTTP
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Storage Accounts (1)
| Account Name | HTTPS Only | Public Access |
|---|---|---|
| stapp01 | Disabled | Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-011 meets target baseline (HTTPS-only enforced on all storage accounts) using arm_storage_accounts.http_enabled_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_storage_accounts.http_enabled_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Storage Accounts Allow HTTP: observed=1, target=HTTPS-only enforced on all storage accounts
arm_storage_accounts
2026-05-15T23:34:51.492677+00:00
P1Infrastructure-015
Anonymous Storage Access Enabled
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Anonymous Storage Access Enabled |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-015 meets target baseline (0 storage accounts with anonymous blob access) using arm_storage_accounts.anonymous_access_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_storage_accounts.anonymous_access_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Anonymous Storage Access Enabled: observed=1, target=0 storage accounts with anonymous blob access
arm_storage_accounts
2026-05-15T23:34:51.492716+00:00
P1Infrastructure-016
Key Vault Recovery Protections Disabled
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Key Vault Recovery Protections Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-016 meets target baseline (Soft-delete + purge protection enabled on all key vaults) using arm_key_vaults.soft_delete_disabled_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_key_vaults.soft_delete_disabled_count
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Key Vault Recovery Protections Disabled: observed=1, target=Soft-delete + purge protection enabled on all key vaults
arm_key_vaults
2026-05-15T23:34:51.492725+00:00
P1CloudPosture-001
Azure Secure Score Below Target
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Top Improvement Actions (85 total)
| Recommendation | Priority | Score Impact |
|---|---|---|
| Do Not Allow Users To Grant Consent To Unmanaged Applications | Critical | 9.0 |
| Ensure Sign-In Risk Policy Is Enabled | Critical | 8.5 |
| Ensure User Risk Policy Is Enabled | Critical | 8.5 |
| Windows Print Spooler Elevation Of Privilege | High | 7.8 |
| Windows Ancillary Function Driver For Win Sock Elevation Of Privilege | High | 7.8 |
These are Microsoft Secure Score recommendations, not CVE vulnerabilities.
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore,MaxScore
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
CloudPosture-001 meets target baseline (>= 65%) using secure_score.score_percent.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: secure_score.score_percent
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Azure Secure Score Below Target: observed=56.7%, target=>= 65%
secure_score
2026-05-15T23:34:51.492738+00:00
P1Resilience-001
Incident Response Plan Not Documented
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Incident Response Plan Not Documented |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Resilience-001 meets target baseline (Documented and approved incident response plan) using resilience.incident_response_plan_documented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: resilience.incident_response_plan_documented
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Incident Response Plan Not Documented: observed=not documented, target=Documented and approved incident response plan
resilience
2026-05-15T23:34:51.492780+00:00
P1Resilience-002
SIEM Not Connected
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
SIEM Configuration Requirements
| Action | Priority |
|---|---|
| Deploy Microsoft Sentinel workspace | Required |
| Connect Azure AD sign-in and audit logs | Required |
| Connect Microsoft 365 audit logs | Required |
| Configure alert rules for critical events | Required |
| Set up automated incident response playbooks | Recommended |
Without SIEM, security events are not centrally monitored.
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Resilience-002 meets target baseline (SIEM/Sentinel connected and ingesting security telemetry) using log_analytics_summary.sentinel_connected.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: log_analytics_summary.sentinel_connected
Severity Basis: Severity based on High impact and affected scope.
Evidence · 1full envelope in § 04
evidence
SIEM Not Connected: observed=disconnected, target=SIEM/Sentinel connected and ingesting security telemetry
log_analytics_summary
2026-05-15T23:34:51.492789+00:00
P1CMMC-AC.L2-3.1.6
CMMC AC.L2-3.1.6: Non-Privileged Account Use (Fail)
Open
Impact
CMMC practice AC.L2-3.1.6 (Non-Privileged Account Use) in the Access Control domain is fail. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
AC.L2-3.1.6 — Access Control (Fail)
| Remediation Action | Priority |
|---|---|
| Audit non-privileged account usage: ensure daily operations use standard accounts, not admin accounts | Required |
| Create separate admin accounts (e.g., adm-username@) for each IT staff member | Required |
| Configure Conditional Access to require compliant device + MFA for admin account sign-in | Required |
| Block admin accounts from accessing email, Teams, and other productivity workloads | Required |
| Implement privileged access workstations (PAWs) for administrative tasks | Required |
Assessment: Assessed via Manual Questionnaire
Remediation5 steps
- Audit non-privileged account usage: ensure daily operations use standard accounts, not admin accounts
- Create separate admin accounts (e.g., adm-username@) for each IT staff member
- Configure Conditional Access to require compliant device + MFA for admin account sign-in
- Block admin accounts from accessing email, Teams, and other productivity workloads
- Implement privileged access workstations (PAWs) for administrative tasks
Verifyexpected post-remediation
- Check sign-in logs for admin accounts accessing non-admin workloads (Exchange, Teams)
Get-MgAuditLogSignIn -Filter "userPrincipalName startswith 'adm-'" | Select AppDisplayName | Group-Object AppDisplayName
Rollback
- Temporarily exempt the admin account from the blocking CA policy,
- Resolve the issue,
- Remove the exemption within 4 hours
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity high based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P1CMMC-IA.L2-3.5.3
CMMC IA.L2-3.5.3: Multifactor Authentication (Fail)
Open
Impact
CMMC practice IA.L2-3.5.3 (Multifactor Authentication) in the Identification and Authentication domain is fail. This control carries a SPRS weight of -5 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
IA.L2-3.5.3 — Identification & Authentication (Fail)
| Remediation Action | Priority |
|---|---|
| Enable MFA for all users via Conditional Access -- Entra ID > Protection > Conditional Access > + New policy -- All users required to use MFA | Required |
| Configure phishing-resistant MFA for privileged accounts -- Entra ID > Protection > Conditional Access > + New policy (with authentication strength) -- Admins required to use FIDO2 or Windows Hello for Business | Required |
| Block legacy authentication (doesn't support MFA) -- Entra ID > Protection > Conditional Access > + New policy -- Legacy protocols blocked | Required |
| Review and complete MFA registration for all users -- Entra ID > Users > Per-user MFA > Multi-factor authentication -- All users have at least one MFA method registered | Required |
| Deploy FIDO2 security keys to privileged users -- Entra ID > Security > Authentication methods > FIDO2 security key -- FIDO2 keys distributed and registered for admins | Required |
| Configure MFA registration campaign -- Entra ID > Protection > Authentication methods > Registration campaign -- Users prompted to register additional MFA methods | Required |
| Monitor MFA usage and gaps -- Entra ID > Monitoring > Sign-in logs > Filter: MFA requirement -- Dashboard showing MFA adoption and any bypasses | Required |
Assessment: Assessed via Manual Questionnaire
Remediation7 steps
- Enable MFA for all users via Conditional Access -- Entra ID > Protection > Conditional Access > + New policy -- All users required to use MFA
- Configure phishing-resistant MFA for privileged accounts -- Entra ID > Protection > Conditional Access > + New policy (with authentication strength) -- Admins required to use FIDO2 or Windows Hello for Business
- Block legacy authentication (doesn't support MFA) -- Entra ID > Protection > Conditional Access > + New policy -- Legacy protocols blocked
- Review and complete MFA registration for all users -- Entra ID > Users > Per-user MFA > Multi-factor authentication -- All users have at least one MFA method registered
- Deploy FIDO2 security keys to privileged users -- Entra ID > Security > Authentication methods > FIDO2 security key -- FIDO2 keys distributed and registered for admins
- Configure MFA registration campaign -- Entra ID > Protection > Authentication methods > Registration campaign -- Users prompted to register additional MFA methods
- Monitor MFA usage and gaps -- Entra ID > Monitoring > Sign-in logs > Filter: MFA requirement -- Dashboard showing MFA adoption and any bypasses
Verifyexpected post-remediation
- Sign in as standard user
Query control evidence and capture the result: Sign in as standard user - Sign in as admin user
Query control evidence and capture the result: Sign in as admin user - Attempt legacy auth connection
Query Entra sign-in logs and authentication reports for the validation scenario: Attempt legacy auth connection - Review MFA registration report
Query Entra sign-in logs and authentication reports for the validation scenario: Review MFA registration report
Rollback
- Admin can reset MFA via Entra ID > Users > [User] > Authentication methods > Require re-register MFA
- Break-glass should be excluded from MFA policies; if locked out, contact Microsoft support
Closure criteriaresolution contract
MFA prompt appears before access granted
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity high based on SPRS weight (-5) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P1CMMC-AU.L2-3.3.4
CMMC AU.L2-3.3.4: Audit Failure Alerting (Fail)
Open
Impact
CMMC practice AU.L2-3.3.4 (Audit Failure Alerting) in the Audit and Accountability domain is fail. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
AU.L2-3.3.4 — Audit & Accountability (Fail)
| Remediation Action | Priority |
|---|---|
| Enable advanced auditing in Microsoft 365: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true | Required |
| Configure audit log alerts for security events: failed sign-ins, privilege escalation, bulk operations | Required |
| Deploy Microsoft Sentinel or forward audit logs to an existing SIEM for centralized analysis | Required |
| Create detection rules for anomalous behavior patterns (impossible travel, mass downloads, rule creation) | Required |
| Establish a weekly audit log review process with documented findings and actions taken | Required |
Assessment: Assessed via Manual Questionnaire
Remediation5 steps
- Enable advanced auditing in Microsoft 365: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
- Configure audit log alerts for security events: failed sign-ins, privilege escalation, bulk operations
- Deploy Microsoft Sentinel or forward audit logs to an existing SIEM for centralized analysis
- Create detection rules for anomalous behavior patterns (impossible travel, mass downloads, rule creation)
- Establish a weekly audit log review process with documented findings and actions taken
Verifyexpected post-remediation
- Verify audit alert rules: Get-ProtectionAlert | Select Name, Severity, IsEnabled. Confirm log forwarding to SIEM is operational. Review last 7 days of alerts.
Get-ProtectionAlert | Select Name, Severity, IsEnabled
Rollback
- Tune alert thresholds to reduce false positives,
- Prioritize Critical/High alerts,
- Suppress known-benign patterns via exclusion rules
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity high based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P1CMMC-IR.L2-3.6.1
CMMC IR.L2-3.6.1: Incident Handling (Partial)
Open
Impact
CMMC practice IR.L2-3.6.1 (Incident Handling) in the Incident Response domain is partial. This control carries a SPRS weight of -5 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
IR.L2-3.6.1 — Incident Response (Partial)
| Remediation Action | Priority |
|---|---|
| Document incident response plan -- Create IRP document -- Written IRP with phases: Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned | Required |
| Define incident severity levels and escalation paths -- Document in IRP -- Severity matrix (Critical/High/Medium/Low) with response timeframes and escalation contacts | Required |
| Enable Microsoft Sentinel for detection -- Azure Portal > Microsoft Sentinel > + Create -- Sentinel workspace connected with Azure AD and M365 data connectors | Required |
| Deploy Sentinel analytics rules for detection -- Microsoft Sentinel > Analytics > + Create > Scheduled query rule -- Detection rules active for common attack patterns | Required |
| Create incident response playbooks -- Microsoft Sentinel > Automation > + Create > Playbook -- Automated playbooks for common incident types (phishing, malware, compromised account) | Required |
| Establish communication protocols -- Document in IRP -- Communication plan including: internal notifications, external reporting (DoD within 72 hours), customer notification procedures | Required |
| Conduct tabletop exercise -- Schedule and execute -- Annual tabletop exercise completed with documented lessons learned | Required |
Assessment: Assessed via Manual Questionnaire
Remediation7 steps
- Document incident response plan -- Create IRP document -- Written IRP with phases: Preparation, Detection, Analysis, Containment, Eradication, Recovery, Lessons Learned
- Define incident severity levels and escalation paths -- Document in IRP -- Severity matrix (Critical/High/Medium/Low) with response timeframes and escalation contacts
- Enable Microsoft Sentinel for detection -- Azure Portal > Microsoft Sentinel > + Create -- Sentinel workspace connected with Azure AD and M365 data connectors
- Deploy Sentinel analytics rules for detection -- Microsoft Sentinel > Analytics > + Create > Scheduled query rule -- Detection rules active for common attack patterns
- Create incident response playbooks -- Microsoft Sentinel > Automation > + Create > Playbook -- Automated playbooks for common incident types (phishing, malware, compromised account)
- Establish communication protocols -- Document in IRP -- Communication plan including: internal notifications, external reporting (DoD within 72 hours), customer notification procedures
- Conduct tabletop exercise -- Schedule and execute -- Annual tabletop exercise completed with documented lessons learned
Verifyexpected post-remediation
- Trigger test security alert
Query Sentinel or SIEM alerts for the validation scenario: Trigger test security alert - Walk through IRP with incident responders
Query incident records and run the documented playbook checkpoint: Walk through IRP with incident responders - Review Sentinel incident queue
Query Sentinel or SIEM alerts for the validation scenario: Review Sentinel incident queue
Rollback
- Tune analytics rules, add exclusions for known benign activity
- Disable automation and handle incidents manually while debugging
Closure criteriaresolution contract
Alert appears in Sentinel, incident created per playbook
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity high based on SPRS weight (-5) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P1OnPrem-bb5a9d6f577335e859fca4309670b184
Edinburgh DC replication lag exceeds 4h threshold
Open
Impact
Authentication failures for Edinburgh users referencing newly-created CORP objects. Secondary: stale group membership used in ACL evaluations for 5+ hours.
Verifyexpected post-remediation
- Verify remediation on the reporting host
repadmin /showrepl EDI-DC01 /csv
Rollback
- N/A
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
EDI-DC01 shows 5h14m inbound replication lag from Dallas-HQ. Site link bandwidth (T1 backup link) is saturated during ECB manufacturing shift handover.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-a44af409d7d11e59c1493a0dbe64697b
AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor
Open
Impact
Backup vendor principal can rewrite ACLs on every member of Domain Admins, Enterprise Admins, and Schema Admins.
Verifyexpected post-remediation
- Verify remediation on the reporting host
(Get-Acl 'AD:CN=AdminSDHolder,CN=System,DC=corp,DC=contoso,DC=local').Access
Rollback
- Re-add the ACE.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
CONTRACT\vendor_backup_ops holds WriteDACL on CN=AdminSDHolder,CN=System. This is a weaker right than GenericWrite but still reaches persistent ACL control over protected principals.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-f0f7d0c50d45e6b1a1ec9b4d31aa74e3
Protected Users group has zero members
Open
Impact
Tier-0 credentials remain harvestable via NTLM relay, cached credentials on lower-tier hosts, and unconstrained delegation.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADGroupMember 'Protected Users' | Measure-Object | Select Count
Rollback
- Remove-ADGroupMember 'Protected Users' (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Protected Users group is empty. Tier-0 accounts are not receiving the built-in protections (NTLM denial, cached-credential refusal, unconstrained delegation refusal).
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-196a963ef20ace8c875acdb6bd3cd146
Default Domain Password Policy minimum length is 12 (CMMC L2 gap)
Open
Impact
12-character passwords are within reach of offline cracking after a successful DCSync or ntds.dit exfiltration, particularly for service accounts and local admins.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADFineGrainedPasswordPolicy -Filter *
Rollback
- Revert FGPP via Remove-ADFineGrainedPasswordPolicy.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Default Domain Password Policy sets min_length=12. CMMC L2 IA.L2-3.5.7 and the DoD STIG baseline both require 14 characters minimum for privileged accounts.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-973c8114634333ec705572385c76c6a8
14 Kerberoastable service accounts
Open
Impact
An authenticated adversary can request TGS tickets for these accounts and crack them offline, then pivot with the cleartext service-account password — often into SQL, SharePoint, or Exchange-backed data stores.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADUser -Filter {ServicePrincipalName -like '*'} -Properties ServicePrincipalName,PasswordLastSet
Rollback
- Revert to static passwords (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
14 service accounts with SPNs and passwords >180d old were identified: svc_sql_reporting (412d), svc_iis_portal (455d), svc_skype_fe (604d), and 11 others. CMMC L2 IA.L2-3.5.7 and Microsoft ESAE both require 25+ character random passwords rotated at least every 180 days for SPN-bearing accounts.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-115a403197926fcf3729afc5e5c88fd4
Service account svc_legacy_ctip_connector is AS-REP roastable
Open
Impact
No authentication is required to request the AS-REP, so this is an external-adjacent attack if the DC is reachable from any partner or vendor segment.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADUser svc_legacy_ctip_connector -Properties DoesNotRequirePreAuth
Rollback
- Re-set DONT_REQ_PREAUTH (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
svc_legacy_ctip_connector has DoesNotRequirePreAuth=True and a 612-day-old password. AS-REP requests return encrypted material any unauthenticated attacker can crack offline.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-2e376a0ca89c5193bc5bbd75360d2e4d
Service account svc_mes_ctl is AS-REP roastable
Open
Impact
MES controller account compromise pivots directly into defense-manufacturing OT network segment.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADUser svc_mes_ctl -Properties DoesNotRequirePreAuth
Rollback
- Re-set DONT_REQ_PREAUTH.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
svc_mes_ctl has DoesNotRequirePreAuth=True. Manufacturing Execution System controller account exposed to offline cracking via unauthenticated AS-REP request.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-0f0e6181ecd6d31732ee82cce27690dd
ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable
Open
Impact
Vendor principal can rewrite template ACLs or flags to create a domain-wide certificate-issuance privilege escalation.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-Acl 'AD:CN=ContoWorkstationAuth,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=local'
Rollback
- Re-grant WriteDACL (not recommended).
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Template ContoWorkstationAuth has WriteDACL granted to CONTRACT\vendor_pki_audit (non-admin). That principal can modify the template itself, including enabling ESC1 on it.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-ec4b457d71895584370f8701340b7c3a
Enterprise Issuing CA certificate expires in 57 days
Open
Impact
Imminent service outage — 802.1X/EAP-TLS Wi-Fi, VPN, RDP cert auth, internal HTTPS all fail when the intermediate expires.
Verifyexpected post-remediation
- Verify remediation on the reporting host
certutil -ca.cert c:\ca.crt && openssl x509 -in c:\ca.crt -noout -enddate
Rollback
- N/A — expiry cannot be rolled back.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
CONTOSO-ISSUING-CA01 certificate expires 2026-06-15 (57 days). All services chaining to this intermediate fail on expiry: 802.1X EAP-TLS, VPN client cert auth, RDP, internal HTTPS.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-ad9235417f447a7ed15961e756550e6e
Legacy SMBv1 enabled on 47 endpoints
Open
Impact
Ransomware worm families (WannaCry, EternalBlue, older Petya variants) propagate via SMBv1 — 47-host foothold can become a domain-wide incident within hours.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-SmbServerConfiguration | Select EnableSMB1Protocol
Rollback
- Re-enable SMBv1 on specific hosts.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
47 endpoints have SMBv1 client/server enabled. SMBv1 is the WannaCry / NotPetya propagation vector and has been Microsoft-deprecated since 2017.
onprem_powershell
2026-05-15T23:34:43+00:00
P1OnPrem-a249894fcd65540f5d07fd99f55e1c4b
LDAP signing is optional (LDAPServerIntegrity=1)
Open
Impact
Credential material in simple-bind LDAP traffic can be intercepted and tampered with on the wire.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Services\NTDS\Parameters' LDAPServerIntegrity
Rollback
- Set LDAPServerIntegrity=1.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
Domain Controllers accept unsigned LDAP simple binds. Microsoft moved this to an explicit hardening requirement in 2020 (CVE-2017-8563 follow-on).
onprem_powershell
2026-05-15T23:34:43+00:00
P2Identity-006
3 Users Authenticating with Legacy Protocols
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 3 users using legacy authentication
Users on Legacy Protocols (3)
| User | Protocol | Last Sign-in |
|---|---|---|
| david.mitchell@contoso.com | IMAP4 | Feb 11, 2026 21:14 |
| patricia.kowalski@contoso.com | IMAP4 | Feb 12, 2026 07:14 |
| robert.chen@contoso.com | SMTP | Feb 12, 2026 15:14 |
Verifyexpected post-remediation
- Run verification command
Get-MgAuditLogSignIn -Filter "clientAppUsed eq 'Exchange ActiveSync' or clientAppUsed eq 'IMAP4' or clientAppUsed eq 'POP3'" -Top 100 | Group-Object UserPrincipalName | Select Name, Count | Sort-Object Count -Descending
Rollback
- Identify the affected application from Entra sign-in logs (filter: clientAppUsed)
- Set the legacy authentication CA policy to Report-only mode
- Verify the application can authenticate again
- Engage the app vendor to add modern auth (OAuth 2.0 / SAML) support
- Re-enable the legacy auth block after the app is upgraded
Closure criteriaresolution contract
No results after remediation
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: legacy_auth_users.unique_users
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
3 users with 47 legacy auth sign-ins
/auditLogs/signIns
2026-05-15T23:34:51.489743+00:00
P2Identity-009
Excessive Global Administrators (7 accounts)
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 7 global admin accounts
Privileged Accounts (7)
| Account | Roles | MFA Status | Last sign-in |
|---|---|---|---|
| admin.breakglass@contoso.com | Global Admin | Registered | 2025-06-20 11:00:00+00:00 |
| david.mitchell@contoso.com | Security Admin | Registered | 2026-02-07 08:30:00+00:00 |
| emily.rodriguez@contoso.com | SharePoint Admin | Registered | 2026-02-05 13:20:00+00:00 |
| kevin.patel@contoso.com | Helpdesk Admin | Registered | 2026-02-07 10:00:00+00:00 |
| michael.torres@contoso.com | Global Admin, User Admin | Registered | 2026-02-07 09:15:00+00:00 |
| rachel.kim@contoso.com | Exchange Admin | Registered | 2026-02-06 16:45:00+00:00 |
| sarah.chen@contoso.com | Global Admin | Registered | 2026-02-07 14:30:00+00:00 |
Verifyexpected post-remediation
- Run verification command
Get-MgDirectoryRoleMember -DirectoryRoleId (Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'").Id | Measure-Object | Select Count - Run verification command
Get-MgDirectoryRoleMember -DirectoryRoleId (Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'").Id | Select AdditionalProperties
Rollback
- Re-assign Global Administrator role to affected user
- Document the exception reason
- Schedule review for role reduction
Closure criteriaresolution contract
Count <= 4
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.global_admin_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
7 global admins (recommended max: 4)
/directoryRoles (Global Administrator)
2026-05-15T23:34:51.489891+00:00
P2Monitoring-001
Microsoft Sentinel SIEM Not Configured
Open
Impact
Detection and response gaps increase dwell time and breach cost. IBM reports organizations with mature detection/response capabilities reduce breach impact by more than $1M compared to low-maturity peers.
Blast radius · 1 Log Analytics workspace without SIEM
SIEM Configuration Requirements
| Action | Priority |
|---|---|
| Deploy Microsoft Sentinel workspace | Required |
| Connect Azure AD sign-in and audit logs | Required |
| Connect Microsoft 365 audit logs | Required |
| Configure alert rules for critical events | Required |
| Set up automated incident response playbooks | Recommended |
Without SIEM, security events are not centrally monitored.
Verifyexpected post-remediation
- Run verification command
Azure Portal → Microsoft Sentinel → Overview → Verify workspace connected - Run verification command
Azure Portal → Sentinel → Data connectors → Filter: Connected
Rollback
- Reduce log collection verbosity
- Disable the specific diagnostic setting causing load
- Adjust retention period to reduce storage costs
Closure criteriaresolution contract
Sentinel shows active workspace with data connectors
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: log_analytics_summary.sentinel_configured
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Log Analytics active (0 events, 90d retention) but Sentinel not configured
Log Analytics / Sentinel
2026-05-15T23:34:51.490138+00:00
P2Application-001
2 Apps with High-Risk OAuth Permissions
Open
Impact
Overprivileged applications can access broad tenant data silently. OAuth app abuse has been used in major cloud intrusions, and unauthorized app consent can bypass traditional endpoint controls.
Why this matters
2 third-party applications have been granted broad permissions to access email, files, or directory data. Compromised or malicious apps can use these permissions to exfiltrate sensitive data, send phishing emails from user accounts, or persist access even after password resets. OAuth abuse is increasingly used in supply chain attacks.
Blast radius · 2 apps with high-risk permissions
High-Risk OAuth Apps (2)
| Application | Permissions | Consent Type | Risky Perms |
|---|---|---|---|
| DataSync Pro (Unverified) | User.Read.All, Mail.ReadWrite, Files.ReadWrite.All, Directory.Read.All, Sites.FullControl.All | 0 users | 5 |
Showing 1 of 2 total
Verifyexpected post-remediation
- Run verification command
Get-MgOauth2PermissionGrant | Where-Object {$_.Scope -match 'Mail|Files|Directory'} | Select ResourceId, Scope, ConsentType - Run verification command
Get-MgPolicyAuthorizationPolicy | Select -ExpandProperty DefaultUserRolePermissions | Select AllowedToCreateApps, PermissionGrantPoliciesAssigned
Rollback
- Re-grant admin consent for the app in Entra Admin Center > Enterprise Applications
- Verify the application functions correctly
- Document the business justification for elevated permissions
Closure criteriaresolution contract
Only approved apps with documented business justification
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: third_party_apps.apps
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
2 apps with high-risk permissions (granted)
/oauth2PermissionGrants
2026-05-15T23:34:51.490200+00:00
P2Identity-011
1 Service Principal with High-Risk Permissions
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 1 overprivileged service principal
High-Risk Service Principal (1)
| Service Principal | High-Risk Permissions | Risk Level |
|---|---|---|
| DataSync Pro (Unverified) | User.Read.All, Mail.ReadWrite, Files.ReadWrite.All | High |
Verifyexpected post-remediation
- Run verification command
Get-MgServicePrincipal -All | ForEach-Object { Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $_.Id } | Where-Object { $_.AppRoleId -eq '19dbc75e-c2e2-444c-a770-ec69d8559fc7' }
Rollback
- Re-grant the revoked permission via Entra Admin Center > Enterprise Applications
- Verify the integration is restored
- Document the business justification for the permission
- Schedule access review for the service principal
Closure criteriaresolution contract
Only documented, approved apps
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sp_audit.high_privilege_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
1 high-risk app out of 28 total
/servicePrincipals + /appRoleAssignments
2026-05-15T23:34:51.490231+00:00
P2Identity-013
30 Guest Users Require Access Review (20.0% of user base)
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
Your tenant has 30 guest (external) accounts, representing 20.0% of all users. Without regular access reviews, stale guest accounts become a persistent attack surface — former partners and vendors retain access to shared resources.
Blast radius · 30 guest user accounts
Guest Users (30)
| Name | UPN | Domain | Last sign-in |
|---|---|---|---|
| Amanda Foster | amanda.foster_clientcorp.example.com#EXT#@contoso.onmicrosoft.com | clientcorp.example.com | Not collected |
| Robert Hayes | robert.hayes_partnerfirm.example.com#EXT#@contoso.onmicrosoft.com | partnerfirm.example.com | Not collected |
| Diana Petrova | diana.petrova_outsideaudit.example.com#EXT#@contoso.onmicrosoft.com | outsideaudit.example.com | Not collected |
| Carlos Mendez | carlos.mendez_vendorservices.example.com#EXT#@contoso.onmicrosoft.com | vendorservices.example.com | Not collected |
| stale-contractor | old.contractor_defunct-company.example.com#EXT#@contoso.onmicrosoft.com | defunct-company.example.com | Not collected |
Showing 5 of 30 total | Sign-in context not collected (requires signInActivity access with AuditLog.Read.All) | Sign-in context based on 5 collected guest records
Verifyexpected post-remediation
- Run verification command
Get-MgUser -Filter "userType eq 'Guest'" -Property DisplayName,SignInActivity | Select DisplayName,@{N='LastSignIn';E={$_.SignInActivity.LastSignInDateTime}} - Run verification command
Get-MgIdentityGovernanceAccessReviewDefinition | Where-Object {$_.Scope.Query -like '*Guest*'}
Rollback
- Restore guest access for affected users via Entra admin center
- Add exception to access review policy
- Verify partner access is restored
Closure criteriaresolution contract
All guests have recent sign-in or are removed
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: guest_users
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
30 guest accounts, 5 with direct access
/users?$filter=userType eq 'Guest'
2026-05-15T23:34:51.490273+00:00
P2Identity-015
Trusted Named Locations Coverage Is Too Narrow
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
Conditional Access location context is limited, reducing the ability to make precise risk-based access decisions and increasing false positives/false negatives.
Verifyexpected post-remediation
- Run verification command
Get-MgIdentityConditionalAccessNamedLocation | Select-Object DisplayName,Id - Run verification command
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName,Conditions
Rollback
- Set Conditional Access policy to report-only
- Validate named location ranges
- Re-enable enforcement after correction
Closure criteriaresolution contract
At least three trusted named locations are present
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: named_locations.locations
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Named locations configured: 0
/identity/conditionalAccess/namedLocations
2026-05-15T23:34:51.490460+00:00
P2Identity-016
Default Domain Password Expiration Policy Increases Credential Risk
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Why this matters
Routine password expiration remains configured on the default domain. Frequent rotation can drive weaker password behavior without materially improving security.
Blast radius · 1 default domain password policy
Default Domain Password Policy (1)
| Default Domain Password Policy |
|---|
| contoso.com |
Verifyexpected post-remediation
- Run verification command
Get-MgDomain -All | Select-Object Id,IsDefault,PasswordValidityPeriodInDays - Run verification command
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Measure-Object
Rollback
- Restore previous password validity period
- Validate legacy applications and federation dependencies
- Document exception and timeline for modernization
Closure criteriaresolution contract
Default domain shows PasswordValidityPeriodInDays = 2147483647
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: password_policies.domains
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Default domain password validity = 90 days
/domains
2026-05-15T23:34:51.490475+00:00
P2Application-005
Teams Guest Access Requires Stronger Collaboration Governance
Open
Impact
Overprivileged applications can access broad tenant data silently. OAuth app abuse has been used in major cloud intrusions, and unauthorized app consent can bypass traditional endpoint controls.
Why this matters
External guests are active in Teams collaboration spaces. Without periodic review, guest access can persist beyond business need and expose sensitive discussions or files.
Blast radius · 2 team with guest members
Guest Users (2)
| Name | UPN | Domain | Last sign-in |
|---|---|---|---|
| Amanda Foster | amanda.foster_clientcorp.example.com#EXT#@contoso.onmicrosoft.com | clientcorp.example.com | Not collected |
| Robert Hayes | robert.hayes_partnerfirm.example.com#EXT#@contoso.onmicrosoft.com | partnerfirm.example.com | Not collected |
| Diana Petrova | diana.petrova_outsideaudit.example.com#EXT#@contoso.onmicrosoft.com | outsideaudit.example.com | Not collected |
| Carlos Mendez | carlos.mendez_vendorservices.example.com#EXT#@contoso.onmicrosoft.com | vendorservices.example.com | Not collected |
| stale-contractor | old.contractor_defunct-company.example.com#EXT#@contoso.onmicrosoft.com | defunct-company.example.com | Not collected |
Sign-in context not collected (requires signInActivity access with AuditLog.Read.All)
Verifyexpected post-remediation
- Run verification command
Get-Team | ForEach-Object {Get-TeamUser -GroupId $_.GroupId -Role Guest} - Run verification command
Get-MgIdentityGovernanceAccessReviewDefinition -All | Select-Object DisplayName,Status
Rollback
- Restore guest access for approved project teams
- Apply scoped guest policy exclusions
- Document business owner approval
Closure criteriaresolution contract
Guest access is limited to approved teams only
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: teams_summary.teams
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Teams with guests: 2
/teams
2026-05-15T23:34:51.490623+00:00
P2Endpoint-004
Device Configuration Baseline Policy Depth Is Limited
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Verifyexpected post-remediation
- Run verification command
Get-MgDeviceManagementDeviceConfiguration -All | Select-Object DisplayName,Id - Run verification command
Get-MgDeviceManagementDeviceConfigurationAssignment -All
Rollback
- Withdraw the latest configuration assignment
- Restore previous policy profile
- Pilot revised baseline before broad deployment
Closure criteriaresolution contract
Baseline policy set expands to at least three profiles
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: device_configuration_policies.total_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Device configuration policies: 0
/deviceManagement/deviceConfigurations
2026-05-15T23:34:51.490768+00:00
P2Endpoint-005
Device Compliance Policy Coverage Is Incomplete
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 0 device compliance policy
Non-Compliant Devices (6)
| Device | OS | Status | Owner |
|---|---|---|---|
| SRP-PC012 | Windows | Non-compliant | marcus.williams@contoso.com |
| SRP-PC025 | Windows | Non-compliant | james.okafor@contoso.com |
| SRP-PC038 | Windows | Unknown | thomas.bergstrom@contoso.com |
| SRP-PC007 | Windows | Non-compliant | james.liu@contoso.com |
| SRP-PC008 | Windows | Unknown | robert.johnson@contoso.com |
| SRP-MAC007 | macOS | Non-compliant | ana.rodriguez@contoso.com |
Verifyexpected post-remediation
- Run verification command
Get-MgDeviceManagementDeviceCompliancePolicy -All | Select-Object DisplayName,Id - Run verification command
Get-MgDeviceManagementDeviceCompliancePolicyAssignment -All
Rollback
- Revert compliance assignments to prior scope
- Review non-compliance reasons
- Re-assign in staged rollout
Closure criteriaresolution contract
All required platform policies are present
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: device_compliance_policies.total_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Compliance policies: 0, unassigned: 0
/deviceManagement/deviceCompliancePolicies
2026-05-15T23:34:51.490781+00:00
P2DataProtection-012
Retention Policy Coverage Is Partial Across M365 Workloads
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Why this matters
Retention configuration exists but does not appear comprehensive across core workloads, which increases legal/compliance exposure and inconsistent data lifecycle handling.
Blast radius · 1 retention policy
Retention Policy (1)
| Retention Policy |
|---|
| Default Retention |
Verifyexpected post-remediation
- Run verification command
Get-RetentionCompliancePolicy | Select-Object Name,Enabled,ExchangeLocation,SharePointLocation,OneDriveLocation,TeamsChatLocation - Run verification command
Get-RetentionCompliancePolicy | Where-Object {$_.Enabled -eq $true}
Rollback
- Pause new retention policy assignments
- Validate workloads and exclusions
- Re-enable with staged rollout
Closure criteriaresolution contract
Core workloads show explicit retention coverage
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: retention_policies.total_policies
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Retention policies: 1, workloads covered: 2
/security/labels/retentionPolicies
2026-05-15T23:34:51.490797+00:00
P2Infrastructure-006
Public IP Addresses With Exposure Risks
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 2 Public IP Addresses
Public IP Addresses (2)
| Name | IP Address | Associated Resource |
|---|---|---|
| Unknown | 52.160.14.27 | Unassociated |
| Unknown | 20.45.71.11 | vm-finance-jumpbox |
Verifyexpected post-remediation
- Run verification command
az network public-ip list --query '[].{Name:name, IP:ipAddress, Associated:ipConfiguration.id}' -o table
Rollback
- Re-associate the public IP with the resource
- Verify application connectivity is restored
- Plan migration to private endpoint or load balancer
Closure criteriaresolution contract
No orphaned IPs, no direct VM attachments
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_public_ips
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
2 public IPs with exposure risks
Azure Network Management API
2026-05-15T23:34:51.490847+00:00
P2Vulnerability-003
Medium-Severity Vulnerabilities Require Planned Remediation
Open
Impact
Unpatched vulnerabilities compress defender response windows. Mandiant reports critical exploit weaponization often occurs within days to weeks, increasing incident probability and emergency remediation spend.
Why this matters
30 medium-severity security vulnerabilities identified. These represent configuration improvements that would strengthen the overall security posture and should be addressed within 90 days.
Blast radius · 30 Security Controls
Medium-Priority Configuration Gaps (30)
| Security Controls | Details |
|---|---|
| 30 security controls | 30 medium-severity vulnerabilities |
Verifyexpected post-remediation
- Run verification command
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore
Rollback
- Restore previous configuration setting
- Document the incompatibility and workaround
- Plan remediation with next maintenance window
Closure criteriaresolution contract
Score improved after remediation
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: vulnerability_data
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
30 medium-severity vulnerabilities
Microsoft Secure Score
2026-05-15T23:34:51.490932+00:00
P2Cost-002
Unused License Spend Detected
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
32 license seats are unassigned while still billed, creating recurring waste of $135/month ($1,620/year).
Blast radius · 32 unused license seats
Unused License Seats (32)
| Unused License Seats |
|---|
| Microsoft 365 Business Premium: 5 unused |
| Microsoft Defender for Office 365 Plan 2: 5 unused |
| Microsoft 365 E5: 22 unused |
Showing 3 of 32 total
Verifyexpected post-remediation
- Run verification command
Get-MgSubscribedSku | Select SkuPartNumber, ConsumedUnits, PrepaidUnits
Rollback
- Reassign prior SKU to affected user
- Confirm service access is restored
- Document exception and update license policy
Closure criteriaresolution contract
Purchased seats closely match consumed seats by SKU
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: license_compliance.by_type
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
32 unused licenses costing $135/month ($1,620/year)
license_compliance.by_type
2026-05-15T23:34:51.490998+00:00
P2Cost-003
Azure Advisor Savings Not Yet Realized
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
Unimplemented Azure Advisor actions represent $1,850/month ($22,200/year) in potential savings.
Blast radius · 7 cost optimization recommendations
Cost Optimization Recommendations (7)
| Cost Optimization Recommendations |
|---|
| Azure Advisor cost recommendations pending implementation |
Showing 1 of 7 total
Verifyexpected post-remediation
- Run verification command
az advisor recommendation list --category Cost -o table
Rollback
- Revert the specific recommendation implementation
- Restore prior resource sizing/configuration
- Re-test in non-production before retrying
Closure criteriaresolution contract
Recommendation backlog reduced and savings realized
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: cost_summary.advisor_savings
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
7 advisor recommendations worth $1,850/month ($22,200/year)
cost_summary.advisor_savings
2026-05-15T23:34:51.491011+00:00
P2Cost-004
Oversized VM Fleet Increasing Compute Spend
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
4 virtual machines appear over-provisioned. Rightsizing opportunity is $960/month ($11,520/year).
Blast radius · 4 oversized virtual machines
Oversized Virtual Machines (4)
| Oversized Virtual Machines |
|---|
| vm-finance-etl-01 |
| vm-reporting-api-02 |
| vm-legacy-print-01 |
Showing 3 of 4 total
Verifyexpected post-remediation
- Run verification command
az vm list -d --query "[].{name:name,size:hardwareProfile.vmSize}" -o table
Rollback
- Resize VM back to prior SKU
- Validate application response times
- Re-baseline utilization before another resize attempt
Closure criteriaresolution contract
Flagged VMs resized to target SKUs without performance regressions
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: cost_summary.oversized_vms
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
4 oversized VMs with $960/month ($11,520/year) savings potential
cost_summary.oversized_vms
2026-05-15T23:34:51.491027+00:00
P2Cost-005
Cloud Budget Alerts Missing
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
No cost budget alerts are configured, increasing the likelihood of late detection for spend overruns. Unmonitored monthly run-rate exposure: $28,750/month ($345,000/year).
Blast radius · 1 subscription budget control gap
Subscription Budget Control Gap (1)
| Subscription Budget Control Gap |
|---|
| No active budget thresholds or notifications |
Verifyexpected post-remediation
- Run verification command
az consumption budget list --subscription <subscription-id> -o table
Rollback
- Adjust budget threshold percentages
- Tune alert recipients and severity routing
- Re-enable alerting after threshold calibration
Closure criteriaresolution contract
Budgets present with active threshold notifications
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: cost_summary.budget_alerts
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Budget alerting disabled with monitored spend baseline $28,750/month ($345,000/year)
cost_summary.budget_alerts
2026-05-15T23:34:51.491040+00:00
P2Cost-006
Unlicensed Users Consuming Paid Service Capacity
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
30 users are operating without licenses while consuming tenant resources. Estimated commercial exposure is $783/month ($9,401/year).
Blast radius · 30 unlicensed users
Unlicensed Users (30)
| Unlicensed Users |
|---|
| Unlicensed user inventory available in license compliance report |
Showing 1 of 30 total
Verifyexpected post-remediation
- Run verification command
Get-MgUser -All | Where-Object {$_.AssignedLicenses.Count -eq 0} | Measure-Object
Rollback
- Restore prior license assignments or tooling configuration for impacted users/services.
- Validate service access and performance baseline recovery.
- Re-stage optimization with owner-approved scope and change controls.
Closure criteriaresolution contract
Unlicensed users reduced below 15% threshold with approved exceptions
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: license_compliance.unlicensed_users
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
30 unlicensed users with estimated exposure $783/month ($9,401/year)
license_compliance.unlicensed_users
2026-05-15T23:34:51.491060+00:00
P2Cost-008
Underutilized Premium License Portfolio
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
Premium SKU assignment coverage is below target and represents avoidable spend of $1,254/month ($15,048/year).
Blast radius · 1 premium SKU with low utilization
Premium Sku With Low Utilization (1)
| Premium Sku With Low Utilization |
|---|
| Microsoft 365 E5: 18/40 assigned |
Verifyexpected post-remediation
- Run verification command
Get-MgSubscribedSku | Select SkuPartNumber,ConsumedUnits,PrepaidUnits
Rollback
- Restore prior license assignments or tooling configuration for impacted users/services.
- Validate service access and performance baseline recovery.
- Re-stage optimization with owner-approved scope and change controls.
Closure criteriaresolution contract
Premium SKU utilization trends above 70% with documented exceptions
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: license_compliance.by_type
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Low-utilization premium license spend estimated at $1,254/month ($15,048/year)
license_compliance.by_type
2026-05-15T23:34:51.491158+00:00
P2ActiveDirectory-002
AD: Legacy Authentication Active
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 3 AD configuration
Users on Legacy Protocols (3)
| User | Protocol | Last Sign-in |
|---|---|---|
| david.mitchell@contoso.com | IMAP4 | Feb 11, 2026 21:14 |
| patricia.kowalski@contoso.com | IMAP4 | Feb 12, 2026 07:14 |
| robert.chen@contoso.com | SMTP | Feb 12, 2026 15:14 |
Verifyexpected post-remediation
- Run verification command
Get-MgIdentityConditionalAccessPolicy | Where-Object {$_.Conditions.ClientAppTypes -contains 'exchangeActiveSync'} | Select DisplayName, State - Run verification command
Get-MgAuditLogSignIn -Filter "clientAppUsed ne 'Browser' and clientAppUsed ne 'Mobile Apps and Desktop clients'" -Top 10 | Measure-Object - Run verification command
./Invoke-SecurityCollection.ps1 -OutputPath ./results
Rollback
- Identify the application using legacy auth from AD sign-in logs
- Re-enable legacy auth for the specific application via Group Policy exception
- Engage the application vendor to add modern authentication support
- Re-block legacy auth after the application is upgraded
Closure criteriaresolution contract
State: enabled
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_ad_assessment
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Sign-in logs show 47 legacy auth events from 3 users in past 7 days
onprem_ad_assessment.controls[AD-002]
2026-05-15T23:34:51.491415+00:00
P2ActiveDirectory-008
AD: Domain Controller Patch Baseline Gap
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 AD configuration
AD: Domain Controller Patch Baseline Gap
| Control | Current State | Evidence |
|---|---|---|
| Domain Controller Patch Baseline Gap | 1 of 2 DCs fully patched (50%); DC-02 missing KB5034441 | DC-01: up to date; DC-02: 1 critical update pending (KB5034441, 18 days old) |
Verifyexpected post-remediation
- Run verification command
Get-HotFix -ComputerName (Get-ADDomainController -Filter *).HostName | Group-Object PSComputerName | Select Count, Name - Run verification command
repadmin /replsummary - Run verification command
./Invoke-SecurityCollection.ps1 -OutputPath ./results
Rollback
- Boot the affected DC into Directory Services Restore Mode (DSRM) if it fails to start
- Uninstall the problematic update: wusa /uninstall /kb:<KBID> /quiet /norestart
- Verify AD replication is healthy after rollback: repadmin /replsummary
- Run dcdiag /v /c to confirm the DC is advertising and healthy
- Schedule the patch for re-testing in a staging environment before re-applying
Closure criteriaresolution contract
All DCs show latest cumulative update installed
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_ad_assessment
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
DC-01: up to date; DC-02: 1 critical update pending (KB5034441, 18 days old)
onprem_ad_assessment.controls[AD-008]
2026-05-15T23:34:51.491632+00:00
P2OnPremInfra-ONPREM-EP-004
On-Prem: USB Storage Policy Not Enforced
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| USB mass storage devices are not restricted — data exfiltration risk |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-EP-004 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-EP-004]
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
USB mass storage devices are not restricted — data exfiltration risk
onprem_infra_assessment.findings[ONPREM-EP-004]
2026-05-15T23:34:51.491745+00:00
P2OnPremInfra-ONPREM-AUD-002
On-Prem: Security Audit Log Retention Below 1 GB
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| Security event log is limited to 20 MB — may lose critical forensic data |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-AUD-002 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-AUD-002]
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Security event log is limited to 20 MB — may lose critical forensic data
onprem_infra_assessment.findings[ONPREM-AUD-002]
2026-05-15T23:34:51.491763+00:00
P2OnPremInfra-ONPREM-CERT-002
On-Prem: Certificates Using Weak Algorithms (SHA1/MD5)
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| 1 certificates use deprecated cryptographic algorithms (SHA1/MD5) |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-CERT-002 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-CERT-002]
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
1 certificates use deprecated cryptographic algorithms (SHA1/MD5)
onprem_infra_assessment.findings[ONPREM-CERT-002]
2026-05-15T23:34:51.491777+00:00
P2OnPremInfra-ONPREM-AD-010
On-Prem: Stale Computer Accounts Detected
Open
Impact
This control gap increases security and operational risk. Resolve promptly to reduce breach likelihood, compliance exposure, and avoidable recovery cost.
Blast radius · 1 infrastructure configuration
Infrastructure Configuration (1)
| Infrastructure Configuration |
|---|
| 1 computer accounts have not authenticated in over 90 days |
Verifyexpected post-remediation
- Run verification command
Invoke-PolarisCollection -Modules All -OutputPath ./results
Rollback
- Revert the configuration change in the admin portal
- Verify service is restored
- Document the issue for review
Closure criteriaresolution contract
ONPREM-AD-010 status: pass
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: onprem_infra_assessment.findings[ONPREM-AD-010]
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
1 computer accounts have not authenticated in over 90 days
onprem_infra_assessment.findings[ONPREM-AD-010]
2026-05-15T23:34:51.491789+00:00
P2Identity-023
Excessive Guest Users in Directory
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 35 security control
Guest Users (35)
| Name | UPN | Domain | Last sign-in |
|---|---|---|---|
| Amanda Foster | amanda.foster_clientcorp.example.com#EXT#@contoso.onmicrosoft.com | clientcorp.example.com | Not collected |
| Robert Hayes | robert.hayes_partnerfirm.example.com#EXT#@contoso.onmicrosoft.com | partnerfirm.example.com | Not collected |
| Diana Petrova | diana.petrova_outsideaudit.example.com#EXT#@contoso.onmicrosoft.com | outsideaudit.example.com | Not collected |
| Carlos Mendez | carlos.mendez_vendorservices.example.com#EXT#@contoso.onmicrosoft.com | vendorservices.example.com | Not collected |
| stale-contractor | old.contractor_defunct-company.example.com#EXT#@contoso.onmicrosoft.com | defunct-company.example.com | Not collected |
Showing 5 of 35 total | Sign-in context not collected (requires signInActivity access with AuditLog.Read.All) | Sign-in context based on 5 collected guest records
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-023 meets target baseline (<=20%) using all_users_summary.guest_users.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: all_users_summary.guest_users
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Excessive Guest Users in Directory: observed=23.3%, target=<=20%
all_users_summary
2026-05-15T23:34:51.491825+00:00
P2Identity-028
Risky Sign-Ins from Unknown Locations
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 8 security control
Security Control (8)
| Security Control |
|---|
| Risky Sign-Ins from Unknown Locations |
Showing 1 of 8 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-028 meets target baseline (<=5) using sign_in_analysis.sign_ins_from_unknown_locations.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sign_in_analysis.sign_ins_from_unknown_locations
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Risky Sign-Ins from Unknown Locations: observed=8, target=<=5
sign_in_analysis
2026-05-15T23:34:51.491875+00:00
P2Identity-029
SMS-Based MFA Still in Significant Use
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 24 security control
Admins with SMS-Only MFA (24)
| Account | Role | Auth Method |
|---|---|---|
| SMS-Based MFA Still in Significant Use | Admin | SMS |
Showing 1 of 24 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-029 meets target baseline (<=10%) using user_auth_methods.stats.sms_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: user_auth_methods.stats.sms_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
SMS-Based MFA Still in Significant Use: observed=16.0%, target=<=10%
user_auth_methods
2026-05-15T23:34:51.491888+00:00
P2Device-011
Stale Device Sync Older Than 30 Days
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 device
Device (1)
| Device |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-011 meets target baseline (0) using managed_devices.devices[].last_sync_datetime.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices[].last_sync_datetime
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Stale Device Sync Older Than 30 Days: observed=1, target=0
managed_devices
2026-05-15T23:34:51.491936+00:00
P2Device-012
Outdated Endpoint Operating System Versions
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 device
Device (1)
| Device |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-012 meets target baseline (0) using managed_devices.devices[].os_version.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices[].os_version
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Outdated Endpoint Operating System Versions: observed=1, target=0
managed_devices
2026-05-15T23:34:51.491944+00:00
P2Device-014
No Device Configuration Policies Applied
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 configuration policy baseline
Configuration Policy Baseline (1)
| Configuration Policy Baseline |
|---|
| No Device Configuration Policies Applied |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Rollback affected policy assignment for impacted device cohorts.
- Validate endpoint functionality and service access restoration.
- Reapply remediations with pilot-first rollout and updated exclusions.
Closure criteriaresolution contract
Device-014 meets target baseline (>=1) using device_configuration_policies.total_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: device_configuration_policies.total_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Device Configuration Policies Applied: observed=0, target=>=1
device_configuration_policies
2026-05-15T23:34:51.491979+00:00
P2DataProtection-019
SharePoint Sites Permit External Sharing
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 SharePoint site
Sharepoint Site (1)
| Sharepoint Site |
|---|
| Contoso - Main |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy/rule assignment for impacted collaboration scopes.
- Confirm access for approved business processes is restored.
- Reapply controls with staged rollout and policy exceptions approved by owners.
Closure criteriaresolution contract
DataProtection-019 meets target baseline (0 externally shared sites without approved exception) using sharepoint_sites.sites.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sharepoint_sites.sites
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
SharePoint Sites Permit External Sharing: observed=1, target=0 externally shared sites without approved exception
sharepoint_sites
2026-05-15T23:34:51.492135+00:00
P2Network-011
Unassociated Public IP Addresses Detected
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 public IP address
Public IP Addresses (2)
| Name | IP Address | Associated Resource |
|---|---|---|
| Unknown | 52.160.14.27 | Unassociated |
| Unknown | 20.45.71.11 | vm-finance-jumpbox |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Rollback the last rule/policy change impacting connectivity.
- Verify service connectivity and workflow recovery for approved traffic.
- Reintroduce controls with a staged rollout and explicit allowlist review.
Closure criteriaresolution contract
Network-011 meets target baseline (0) using arm_public_ips.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_public_ips
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Unassociated Public IP Addresses Detected: observed=1, target=0
arm_public_ips
2026-05-15T23:34:51.492216+00:00
P2Network-014
No Attack Simulation Campaigns Executed
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 phishing simulation program baseline
Phishing Simulation Program Baseline (1)
| Phishing Simulation Program Baseline |
|---|
| No Attack Simulation Campaigns Executed |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Rollback the last rule/policy change impacting connectivity.
- Verify service connectivity and workflow recovery for approved traffic.
- Reintroduce controls with a staged rollout and explicit allowlist review.
Closure criteriaresolution contract
Network-014 meets target baseline (>=1) using attack_simulation.campaign_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: attack_simulation.campaign_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Attack Simulation Campaigns Executed: observed=0, target=>=1
attack_simulation
2026-05-15T23:34:51.492245+00:00
P2Email-010
DMARC Record Missing Aggregate Reporting
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DMARC Record Missing Aggregate Reporting |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-010 meets target baseline (DMARC record includes rua= aggregate reporting destination) using email_security.dmarc_record.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.dmarc_record
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
DMARC Record Missing Aggregate Reporting: observed=v=dmarc1; p=quarantine, target=DMARC record includes rua= aggregate reporting destination
email_security
2026-05-15T23:34:51.492277+00:00
P2Email-011
SPF Record Too Permissive
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| SPF Record Too Permissive |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-011 meets target baseline (SPF policy terminates with -all) using email_security.spf_record.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.spf_record
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
SPF Record Too Permissive: observed=v=spf1 include:_spf.contoso.com ~all, target=SPF policy terminates with -all
email_security
2026-05-15T23:34:51.492286+00:00
P2Email-015
DMARC Policy Not Yet Set to Reject
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DMARC Policy Not Yet Set to Reject |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-015 meets target baseline (reject) using email_security.dmarc_policy.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.dmarc_policy
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
DMARC Policy Not Yet Set to Reject: observed=quarantine, target=reject
email_security
2026-05-15T23:34:51.492323+00:00
P2Email-017
Mailbox Auditing Disabled for Some or All Mailboxes
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Mailbox Auditing Disabled for Some or All Mailboxes |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-017 meets target baseline (enabled) using email_security.mailbox_auditing_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.mailbox_auditing_enabled
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Mailbox Auditing Disabled for Some or All Mailboxes: observed=disabled, target=enabled
email_security
2026-05-15T23:34:51.492343+00:00
P2Email-019
Email Quarantine Workflow Not Configured
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Email Quarantine Workflow Not Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-019 meets target baseline (enabled) using email_security.quarantine_policy_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.quarantine_policy_enabled
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Email Quarantine Workflow Not Configured: observed=disabled, target=enabled
email_security
2026-05-15T23:34:51.492360+00:00
P2Email-020
Anti-Impersonation Coverage Below Target
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Anti-Impersonation Coverage Below Target |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-020 meets target baseline (>= 80%) using email_security.anti_impersonation_coverage_pct.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.anti_impersonation_coverage_pct
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Anti-Impersonation Coverage Below Target: observed=55.0%, target=>= 80%
email_security
2026-05-15T23:34:51.492371+00:00
P2Endpoint-006
OS Versions Not Current
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-006 meets target baseline (0 devices on outdated/EOL operating systems) using managed_devices.devices.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
OS Versions Not Current: observed=1, target=0 devices on outdated/EOL operating systems
managed_devices
2026-05-15T23:34:51.492390+00:00
P2Endpoint-008
Stale Devices with No Sync > 90 Days
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| DESKTOP-FIN01 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-008 meets target baseline (0 stale devices over 90 days) using managed_devices.devices.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: managed_devices.devices
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Stale Devices with No Sync > 90 Days: observed=1, target=0 stale devices over 90 days
managed_devices
2026-05-15T23:34:51.492407+00:00
P2Endpoint-012
Defender Attack Surface Reduction Rules Not Enforced
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Defender Attack Surface Reduction Rules Not Enforced |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-012 meets target baseline (enabled) using mde_summary.asr_rules_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: mde_summary.asr_rules_enabled
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Defender Attack Surface Reduction Rules Not Enforced: observed=disabled, target=enabled
mde_summary
2026-05-15T23:34:51.492437+00:00
P2Endpoint-014
Defender Onboarding Coverage Below 80%
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 7 security controls
Unprotected Devices (7)
| Device | OS | Owner |
|---|---|---|
| SRP-PC001 | Windows | sarah.chen@contoso.com |
| SRP-PC012 | Windows | marcus.williams@contoso.com |
| SRP-MAC003 | macOS | emily.rodriguez@contoso.com |
| SRP-PC025 | Windows | james.okafor@contoso.com |
| SRP-IPAD005 | iOS | rachel.kim@contoso.com |
| SRP-PC038 | Windows | thomas.bergstrom@contoso.com |
| SRP-PC006 | Windows | emily.watson@contoso.com |
| SRP-PC007 | Windows | james.liu@contoso.com |
| SRP-MAC006 | macOS | maria.garcia@contoso.com |
| SRP-iPHONE004 | iOS | priya.patel@contoso.com |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-014 meets target baseline (>= 80% Defender onboarding coverage) using mde_summary.onboarded_devices.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: mde_summary.onboarded_devices
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Defender Onboarding Coverage Below 80%: observed=3/10, target=>= 80% Defender onboarding coverage
mde_summary
2026-05-15T23:34:51.492458+00:00
P2Endpoint-015
Defender EDR Block Mode Disabled
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Defender EDR Block Mode Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-015 meets target baseline (enabled) using mde_summary.edr_block_mode_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: mde_summary.edr_block_mode_enabled
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Defender EDR Block Mode Disabled: observed=disabled, target=enabled
mde_summary
2026-05-15T23:34:51.492467+00:00
P2DataProtection-004
eDiscovery Response Workflows Not Configured
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| eDiscovery Response Workflows Not Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-004 meets target baseline (enabled) using data_protection.ediscovery_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: data_protection.ediscovery_enabled
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
eDiscovery Response Workflows Not Configured: observed=disabled, target=enabled
data_protection
2026-05-15T23:34:51.492479+00:00
P2DataProtection-006
External Sharing Unrestricted on SharePoint Sites
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 3 security controls
Security Controls (3)
| Security Controls |
|---|
| External Sharing Unrestricted on SharePoint Sites |
Showing 1 of 3 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-006 meets target baseline (0 unrestricted externally shared sites) using sharepoint_sites.external_sharing_open_sites.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sharepoint_sites.external_sharing_open_sites
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
External Sharing Unrestricted on SharePoint Sites: observed=3, target=0 unrestricted externally shared sites
sharepoint_sites
2026-05-15T23:34:51.492497+00:00
P2DataProtection-007
OneDrive External Sharing Open
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| OneDrive External Sharing Open |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-007 meets target baseline (restricted sharing with governance controls) using sharepoint_sites.onedrive_external_sharing_open.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sharepoint_sites.onedrive_external_sharing_open
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
OneDrive External Sharing Open: observed=open, target=restricted sharing with governance controls
sharepoint_sites
2026-05-15T23:34:51.492505+00:00
P2DataProtection-009
Retention Period Below Compliance Baseline
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Retention Period Below Compliance Baseline |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-009 meets target baseline (>= 365 days baseline retention for regulated workloads) using retention_policies.min_retention_days.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: retention_policies.min_retention_days
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Retention Period Below Compliance Baseline: observed=90 days, target=>= 365 days baseline retention for regulated workloads
retention_policies
2026-05-15T23:34:51.492554+00:00
P2Identity-019
No Access Reviews Configured
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Access Reviews Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Identity-019 meets target baseline (Recurring access reviews for privileged and guest access) using privileged_accounts.access_reviews_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: privileged_accounts.access_reviews_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Access Reviews Configured: observed=0, target=Recurring access reviews for privileged and guest access
privileged_accounts
2026-05-15T23:34:51.492623+00:00
P2Identity-022
OAuth Consent Policy Allows User Consent
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 1 security control
High-Risk OAuth Apps (1)
| Application | Permissions | Consent Type | Risky Perms |
|---|---|---|---|
| DataSync Pro (Unverified) | User.Read.All, Mail.ReadWrite, Files.ReadWrite.All, Directory.Read.All, Sites.FullControl.All | 0 users | 5 |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Identity-022 meets target baseline (Admin consent workflow required for high-risk app permissions) using oauth_audit.user_consent_allowed.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: oauth_audit.user_consent_allowed
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
OAuth Consent Policy Allows User Consent: observed=enabled, target=Admin consent workflow required for high-risk app permissions
oauth_audit
2026-05-15T23:34:51.492650+00:00
P2Infrastructure-012
SQL Servers Without Azure AD Authentication
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| SQL Servers Without Azure AD Authentication |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-012 meets target baseline (Azure AD authentication configured on all SQL servers) using arm_sql_servers.aad_auth_disabled_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_sql_servers.aad_auth_disabled_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
SQL Servers Without Azure AD Authentication: observed=1, target=Azure AD authentication configured on all SQL servers
arm_sql_servers
2026-05-15T23:34:51.492687+00:00
P2Infrastructure-013
Key Vault Secrets Not Rotated
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 2 security controls
Security Controls (2)
| Security Controls |
|---|
| Key Vault Secrets Not Rotated |
Showing 1 of 2 total
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-013 meets target baseline (All secrets rotated within defined policy interval) using arm_key_vaults.stale_secret_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_key_vaults.stale_secret_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Key Vault Secrets Not Rotated: observed=2, target=All secrets rotated within defined policy interval
arm_key_vaults
2026-05-15T23:34:51.492697+00:00
P2Infrastructure-014
No Private Endpoints for PaaS Resources
Open
Impact
Cloud misconfiguration remains a primary breach driver. Public exposure and weak network controls can enable rapid compromise, outage, and recovery costs that frequently exceed six figures for SMB environments.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Private Endpoints for PaaS Resources |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Infrastructure-014 meets target baseline (Private endpoints enabled for internet-facing PaaS resources) using arm_private_endpoints.total_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_private_endpoints.total_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Private Endpoints for PaaS Resources: observed=0, target=Private endpoints enabled for internet-facing PaaS resources
arm_private_endpoints
2026-05-15T23:34:51.492706+00:00
P2CloudPosture-003
Critical Azure Resources Missing Diagnostic Logging
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 3 security controls
Security Controls (3)
| Security Controls |
|---|
| Critical Azure Resources Missing Diagnostic Logging |
Showing 1 of 3 total
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
CloudPosture-003 meets target baseline (0 critical resources missing diagnostic settings) using arm_diagnostic_settings.missing_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_diagnostic_settings.missing_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Critical Azure Resources Missing Diagnostic Logging: observed=3, target=0 critical resources missing diagnostic settings
arm_diagnostic_settings
2026-05-15T23:34:51.492747+00:00
P2CloudPosture-004
No Azure Policy Assignments Detected
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Azure Policy Assignments Detected |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
CloudPosture-004 meets target baseline (>= 1 baseline Azure policy initiative assigned) using arm_policy_assignments.total_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_policy_assignments.total_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Azure Policy Assignments Detected: observed=0, target=>= 1 baseline Azure policy initiative assigned
arm_policy_assignments
2026-05-15T23:34:51.492757+00:00
P2Resilience-003
No Analytic Rules for Critical Threat Scenarios
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Analytic Rules for Critical Threat Scenarios |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Resilience-003 meets target baseline (>= 1 high-confidence alert rule per critical threat scenario) using log_analytics_summary.alert_rules_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: log_analytics_summary.alert_rules_count
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Analytic Rules for Critical Threat Scenarios: observed=0, target=>= 1 high-confidence alert rule per critical threat scenario
log_analytics_summary
2026-05-15T23:34:51.492798+00:00
P2Resilience-004
Backup Restore Testing Stale
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Backup Restore Testing Stale |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Resilience-004 meets target baseline (Restore tests executed every <= 180 days) using backup_health.restore_test_last_days.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: backup_health.restore_test_last_days
Severity Basis: Severity based on Medium impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Backup Restore Testing Stale: observed=9999 days, target=Restore tests executed every <= 180 days
backup_health
2026-05-15T23:34:51.492807+00:00
P2CMMC-SC.L2-3.13.2
CMMC SC.L2-3.13.2: Security Engineering (Partial)
Open
Impact
CMMC practice SC.L2-3.13.2 (Security Engineering) in the System and Communications Protection domain is partial. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
SC.L2-3.13.2 — System & Communications Protection (Partial)
| Remediation Action | Priority |
|---|---|
| Deploy architecturally sound security designs: defense-in-depth with multiple control layers | Required |
| Implement network segmentation — separate CUI data stores from general-purpose networks | Required |
| Enable Azure Private Endpoints for all data services (Storage, CosmosDB, SQL) | Required |
| Configure DLP policies to prevent CUI from leaving the controlled environment | Required |
| Document the security architecture including network diagrams and data flow maps | Required |
Assessment: Assessed via Manual Questionnaire
Remediation5 steps
- Deploy architecturally sound security designs: defense-in-depth with multiple control layers
- Implement network segmentation — separate CUI data stores from general-purpose networks
- Enable Azure Private Endpoints for all data services (Storage, CosmosDB, SQL)
- Configure DLP policies to prevent CUI from leaving the controlled environment
- Document the security architecture including network diagrams and data flow maps
Verifyexpected post-remediation
- Verify private endpoints: Get-AzPrivateEndpoint | Select Name, ProvisioningState. Confirm DLP policies: Get-DlpCompliancePolicy | Select Name, Enabled.
Get-AzPrivateEndpoint | Select Name, ProvisioningState
Rollback
- Verify DNS resolution for the private endpoint,
- Check NSG rules on the private endpoint subnet,
- Temporarily allow public access while troubleshooting
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity medium based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P2CMMC-CM.L2-3.4.5
CMMC CM.L2-3.4.5: Access Restrictions for Change (Partial)
Open
Impact
CMMC practice CM.L2-3.4.5 (Access Restrictions for Change) in the Configuration Management domain is partial. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
CM.L2-3.4.5 — Configuration Management (Partial)
| Remediation Action | Priority |
|---|---|
| Define and document authorized software for all organizational systems | Required |
| Deploy application control using Microsoft Defender Application Control (WDAC) or AppLocker | Required |
| Block unapproved software installation via Intune app management policies | Required |
| Maintain a software allowlist and review quarterly | Required |
| Audit installed software on all devices: Get-MgDeviceManagementDetectedApp | Select DisplayName, DeviceCount | Required |
Assessment: Assessed via Manual Questionnaire
Remediation5 steps
- Define and document authorized software for all organizational systems
- Deploy application control using Microsoft Defender Application Control (WDAC) or AppLocker
- Block unapproved software installation via Intune app management policies
- Maintain a software allowlist and review quarterly
- Audit installed software on all devices: Get-MgDeviceManagementDetectedApp | Select DisplayName, DeviceCount
Verifyexpected post-remediation
- Review Intune > Apps > Discovered apps for unauthorized software. Verify AppLocker/WDAC policies are enforced on managed devices.
Query control evidence and capture the result: Review Intune > Apps > Discovered apps for unauthorized software. Verify AppLocker/WDAC policies are enforced on managed devices.
Rollback
- Add the app hash/publisher to the allowlist,
- Push updated policy,
- Verify the application functions correctly
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity medium based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P2CMMC-SI.L2-3.14.2
CMMC SI.L2-3.14.2: Malicious Code Protection (Partial)
Open
Impact
CMMC practice SI.L2-3.14.2 (Malicious Code Protection) in the System and Information Integrity domain is partial. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
SI.L2-3.14.2 — System & Information Integrity (Partial)
| Remediation Action | Priority |
|---|---|
| Deploy Microsoft Defender for Endpoint on all managed devices | Required |
| Enable real-time protection, cloud-delivered protection, and automatic sample submission | Required |
| Configure anti-malware policies in Intune: scheduled scans (weekly full, daily quick) | Required |
| Enable Defender SmartScreen for Edge browser and Windows | Required |
| Deploy ASR (Attack Surface Reduction) rules in audit mode, then enforce after 30 days | Required |
Assessment: Assessed via PowerShell Collector
Remediation5 steps
- Deploy Microsoft Defender for Endpoint on all managed devices
- Enable real-time protection, cloud-delivered protection, and automatic sample submission
- Configure anti-malware policies in Intune: scheduled scans (weekly full, daily quick)
- Enable Defender SmartScreen for Edge browser and Windows
- Deploy ASR (Attack Surface Reduction) rules in audit mode, then enforce after 30 days
Verifyexpected post-remediation
- Run the verification command and confirm the expected state.
Get-MgDeviceManagementDeviceComplianceDeviceStatus to check Defender enrollment. Verify real-time protection: Get-MpComputerStatus | Select RealTimeProtectionEnabled.
Rollback
- Add an exclusion for the specific file/folder/process,
- Submit the file for analysis to Microsoft,
- Remove the exclusion once the false positive is resolved
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (PowerShell Collector)
Severity Basis: Severity medium based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via PowerShell Collector
—
—
P2CMMC-SI.L2-3.14.5
CMMC SI.L2-3.14.5: Advanced Persistent Threat Protection (Fail)
Open
Impact
CMMC practice SI.L2-3.14.5 (Advanced Persistent Threat Protection) in the System and Information Integrity domain is fail. This control carries a SPRS weight of -3 points. Non-compliance with this practice will reduce your SPRS score and may block CMMC Level 2 certification.
Blast radius · 1 organization-wide compliance gap
SI.L2-3.14.5 — System & Information Integrity (Fail)
| Remediation Action | Priority |
|---|---|
| Deploy Microsoft Defender for Endpoint P2 with EDR (Endpoint Detection and Response) capabilities | Required |
| Enable automated investigation and remediation in Defender XDR | Required |
| Configure Defender for Identity to detect lateral movement and credential theft in Active Directory | Required |
| Deploy Microsoft Defender for Cloud Apps for shadow IT detection and SaaS application monitoring | Required |
| Enable attack disruption capabilities to automatically contain compromised users and devices | Required |
Assessment: Assessed via Manual Questionnaire
Remediation5 steps
- Deploy Microsoft Defender for Endpoint P2 with EDR (Endpoint Detection and Response) capabilities
- Enable automated investigation and remediation in Defender XDR
- Configure Defender for Identity to detect lateral movement and credential theft in Active Directory
- Deploy Microsoft Defender for Cloud Apps for shadow IT detection and SaaS application monitoring
- Enable attack disruption capabilities to automatically contain compromised users and devices
Verifyexpected post-remediation
- Verify Defender for Endpoint P2 onboarding: check Microsoft 365 Defender portal > Endpoints > Device inventory. Confirm EDR is collecting telemetry from all managed devices.
Query control evidence and capture the result: Verify Defender for Endpoint P2 onboarding: check Microsoft 365 Defender portal > Endpoints > Device inventory. Confirm EDR is collecting telemetry from all managed devices.
Rollback
- Switch to manual remediation mode in Defender XDR settings,
- Investigate the specific alert,
- Whitelist the affected process/file if confirmed benign,
- Re-enable automation
Closure criteriaresolution contract
Verification evidence confirms the control is implemented.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: CMMC Evidence Assessment (Manual Questionnaire)
Severity Basis: Severity medium based on SPRS weight (-3) and CMMC certification impact.
Evidence · 1full envelope in § 04
evidence
Assessed via Manual Questionnaire
—
—
P2OnPrem-97a5bcd3de1156ed22b2c2c6bf46b7c4
34 accounts still accept RC4 Kerberos encryption
Open
Impact
Reduced Kerberoasting cost — attacker needs fewer computational resources to crack captured TGS tickets.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ADUser -Filter * -Properties 'msDS-SupportedEncryptionTypes' | Where-Object { $_.'msDS-SupportedEncryptionTypes' -band 4 }
Rollback
- Re-enable RC4 on specific accounts.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
34 accounts have msDS-SupportedEncryptionTypes flags that permit RC4-HMAC. RC4 is cryptographically deprecated and enables faster offline cracking than AES.
onprem_powershell
2026-05-15T23:34:43+00:00
P2OnPrem-d9410d7869f255a0fec2355e9aefcf99
PowerShell script-block logging disabled across 203 hosts
Open
Impact
Detection and response lose their single highest-signal source for PowerShell-based intrusion activity.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' EnableScriptBlockLogging
Rollback
- Set EnableScriptBlockLogging=0.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
EnableScriptBlockLogging=0 on 203 hosts. Event 4104 is not being produced — post-compromise PowerShell activity is invisible to DFIR across 24% of the endpoint fleet.
onprem_powershell
2026-05-15T23:34:43+00:00
P2OnPrem-0f77e63ab314918dcaf223a564609ca8
LSA Protection (RunAsPPL) is not enabled
Open
Impact
Credential dumping (Mimikatz) against lsass is easier than it should be post-compromise.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' RunAsPPL
Rollback
- Set RunAsPPL=0.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
RunAsPPL=0 on monitored endpoints. lsass can be read by any SYSTEM-level process, including benign-looking tools.
onprem_powershell
2026-05-15T23:34:43+00:00
P2OnPrem-42f2c00314d0c3e902ae242f5915f138
Legacy NTLMv1 authentication is still allowed
Open
Impact
Captured authentication traffic from internal segments can be relayed or cracked offline in seconds.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Lsa' LmCompatibilityLevel
Rollback
- Set LmCompatibilityLevel=2.
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
LmCompatibilityLevel=2 allows NTLMv1 challenge/response. NTLMv1 is trivially crackable given captured traffic.
onprem_powershell
2026-05-15T23:34:43+00:00
P3Email-001
929 Email Threat Detections Observed in Last 30 Days
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 929 email threat detections (30 days)
Email Threats (30 Days)
| Category | Count |
|---|---|
| Spam | 892 |
| Phishing | 34 |
| Malware | 3 |
| Total | 929 |
Verifyexpected post-remediation
- Run verification command
Get-SafeLinksPolicy | Select Name,IsEnabled,EnableForInternalSenders - Run verification command
Get-MalwareFilterPolicy | Select Identity,ZapEnabled
Rollback
- Review quarantine for false positives
- Add sender/domain to allowed list if legitimate
- Reduce policy aggressiveness if needed
Closure criteriaresolution contract
All policies enabled, internal senders covered
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
929 threat detections in 30 days
/security/threatAssessmentRequests
2026-05-15T23:34:51.490347+00:00
P3DataProtection-003
Sensitivity Labels Configured but Under-Adopted
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 3 sensitivity labels with low adoption
Sensitivity Labels (2)
| Label Name | Status |
|---|---|
| Confidential | Active |
| Highly Confidential | Active |
Verifyexpected post-remediation
- Run verification command
Get-LabelPolicy | Select Name, Labels - Run verification command
Get-AutoSensitivityLabelPolicy | Select Name, Mode, Enabled
Rollback
- Set label policy to recommendation mode instead of mandatory
- Review user complaints for over-classification
- Adjust auto-labeling thresholds
Closure criteriaresolution contract
All labels published to user groups
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: purview_summary
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
3 labels, 0 applied, 0 auto-label policies
/security/informationProtection/sensitivityLabels
2026-05-15T23:34:51.490870+00:00
P3Cost-007
Duplicate Security Tools Detected
Open
Impact
Identified spend inefficiencies create direct, recurring waste. Converting these findings into action typically reclaims monthly OPEX immediately and compounds into annual savings with no reduction in security posture.
Why this matters
Overlapping security tooling appears to create avoidable run-rate spend of $640/month ($7,680/year).
Blast radius · 2 security tooling overlap
Security Tooling Overlap (2)
| Security Tooling Overlap |
|---|
| crowdstrike falcon |
| defender for endpoint |
| defender for office 365 |
| mimecast |
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Restore prior license assignments or tooling configuration for impacted users/services.
- Validate service access and performance baseline recovery.
- Re-stage optimization with owner-approved scope and change controls.
Closure criteriaresolution contract
Cost-007 meets target baseline ($0/month ($0/year)) using cost_summary.duplicate_tools.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: cost_summary.duplicate_tools
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Overlapping security tooling with estimated cost $640/month ($7,680/year)
cost_summary.duplicate_tools
2026-05-15T23:34:51.491132+00:00
P3Identity-024
Disabled Accounts Are Not Being Removed
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 15 security control
Security Control (15)
| Security Control |
|---|
| Disabled Accounts Are Not Being Removed |
Showing 1 of 15 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-024 meets target baseline (<=10) using all_users_summary.disabled_users.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: all_users_summary.disabled_users
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Disabled Accounts Are Not Being Removed: observed=15, target=<=10
all_users_summary
2026-05-15T23:34:51.491836+00:00
P3Identity-030
No Passwordless Authentication Adoption
Open
Impact
Identity compromise enables tenant-wide privilege abuse. Verizon DBIR 2024 reports 53% of breaches involve stolen credentials, and Microsoft reports MFA blocks 99.9% of automated account attacks.
Blast radius · 150 security control
Security Control (150)
| Security Control |
|---|
| No Passwordless Authentication Adoption |
Showing 1 of 150 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Move the new policy to report-only or scoped pilot mode.
- Restore minimum viable access for approved business exceptions.
- Re-stage enforcement after root cause validation and owner sign-off.
Closure criteriaresolution contract
Identity-030 meets target baseline (>0) using user_auth_methods.stats.passwordless_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: user_auth_methods.stats.passwordless_count
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Passwordless Authentication Adoption: observed=0, target=>0
user_auth_methods
2026-05-15T23:34:51.491899+00:00
P3DataProtection-016
Records Management Controls Disabled
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 records management baseline
Records Management Baseline (1)
| Records Management Baseline |
|---|
| Records Management Controls Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy/rule assignment for impacted collaboration scopes.
- Confirm access for approved business processes is restored.
- Reapply controls with staged rollout and policy exceptions approved by owners.
Closure criteriaresolution contract
DataProtection-016 meets target baseline (enabled) using records_management.enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: records_management.enabled
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Records Management Controls Disabled: observed=disabled, target=enabled
records_management
2026-05-15T23:34:51.492084+00:00
P3DataProtection-020
Teams Without Assigned Owners
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 8 Microsoft Team
Microsoft Team (8)
| Microsoft Team |
|---|
| All Company |
| Leadership Team |
| Client Services |
| IT Operations |
| Human Resources |
Showing 5 of 8 total
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy/rule assignment for impacted collaboration scopes.
- Confirm access for approved business processes is restored.
- Reapply controls with staged rollout and policy exceptions approved by owners.
Closure criteriaresolution contract
DataProtection-020 meets target baseline (0) using teams_summary.teams.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: teams_summary.teams
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Teams Without Assigned Owners: observed=8, target=0
teams_summary
2026-05-15T23:34:51.492152+00:00
P3Network-012
No Named Locations Configured
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 conditional access location baseline
Conditional Access Location Baseline (1)
| Conditional Access Location Baseline |
|---|
| No Named Locations Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgReportAuthenticationMethodUserRegistrationDetail -Top 50 | Select-Object userPrincipalName,isMfaRegistered
Rollback
- Rollback the last rule/policy change impacting connectivity.
- Verify service connectivity and workflow recovery for approved traffic.
- Reintroduce controls with a staged rollout and explicit allowlist review.
Closure criteriaresolution contract
Network-012 meets target baseline (>=1) using named_locations.total_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: named_locations.total_count
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Named Locations Configured: observed=0, target=>=1
named_locations
2026-05-15T23:34:51.492226+00:00
P3Email-018
External Sender Warning Banner Disabled
Open
Impact
Business email compromise remains the top cybercrime loss vector. FBI IC3 2024 reports median BEC losses near $50,000 per incident, with larger enterprises seeing seven-figure fraud exposure.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| External Sender Warning Banner Disabled |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-SafeLinksPolicy | Select-Object Name,IsEnabled,EnableForInternalSenders
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Email-018 meets target baseline (enabled) using email_security.external_sender_tag_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: email_security.external_sender_tag_enabled
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
External Sender Warning Banner Disabled: observed=disabled, target=enabled
email_security
2026-05-15T23:34:51.492352+00:00
P3Endpoint-010
Windows Autopilot Profiles Not Configured
Open
Impact
Non-compliant endpoints materially increase lateral-movement risk. Microsoft security telemetry shows unmanaged or weakly managed devices have materially higher incident rates and recovery costs often exceed $8,000 per endpoint.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Windows Autopilot Profiles Not Configured |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgDeviceManagementManagedDevice -Top 50 | Select-Object DeviceName,ComplianceState
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Endpoint-010 meets target baseline (>= 1 production autopilot profile) using device_configuration_policies.autopilot_profiles.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: device_configuration_policies.autopilot_profiles
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Windows Autopilot Profiles Not Configured: observed=no profiles, target=>= 1 production autopilot profile
device_configuration_policies
2026-05-15T23:34:51.492418+00:00
P3DataProtection-005
Information Barriers Not Configured for Restricted Communications
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| Information Barriers Not Configured for Restricted Communications |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-005 meets target baseline (enabled) using information_protection_policies.information_barriers_enabled.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: information_protection_policies.information_barriers_enabled
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Information Barriers Not Configured for Restricted Communications: observed=disabled, target=enabled
information_protection_policies
2026-05-15T23:34:51.492487+00:00
P3DataProtection-008
No Sensitivity Label Auto-Labeling Policies
Open
Impact
Weak data governance increases breach and regulatory exposure. IBM Cost of a Data Breach 2024 reports a $4.88M global average breach cost, with exfiltration and compliance penalties driving long-tail impact.
Blast radius · 1 security control
Sensitivity Labels (2)
| Label Name | Status |
|---|---|
| Confidential | Active |
| Highly Confidential | Active |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgOrganization | Select-Object DisplayName,Id
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
DataProtection-008 meets target baseline (>= 1 auto-label policy for sensitive data classes) using sensitivity_labels.auto_label_policy_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: sensitivity_labels.auto_label_policy_count
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Sensitivity Label Auto-Labeling Policies: observed=0, target=>= 1 auto-label policy for sensitive data classes
sensitivity_labels
2026-05-15T23:34:51.492514+00:00
P3CloudPosture-005
Cloud Resource Ownership Tags Missing at Scale
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 25 security controls
Security Controls (25)
| Security Controls |
|---|
| Cloud Resource Ownership Tags Missing at Scale |
Showing 1 of 25 total
Verifyexpected post-remediation
- Validate control state from telemetry
az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
CloudPosture-005 meets target baseline (<= 10 untagged resources) using arm_resource_tags.missing_tags_count.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: arm_resource_tags.missing_tags_count
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
Cloud Resource Ownership Tags Missing at Scale: observed=25, target=<= 10 untagged resources
arm_resource_tags
2026-05-15T23:34:51.492768+00:00
P3Resilience-005
No Recent Security Tabletop Exercises
Open
Impact
This finding indicates measurable security and business risk. Delayed remediation increases the likelihood of operational disruption, compliance impact, and avoidable response cost.
Blast radius · 1 security control
Security Control (1)
| Security Control |
|---|
| No Recent Security Tabletop Exercises |
Verifyexpected post-remediation
- Validate control state from telemetry
Get-MgSecurityAlert -Top 50 | Select-Object Severity,Status,CreatedDateTime
Rollback
- Revert the latest policy or configuration change linked to this finding.
- Confirm access, service health, and alerting return to baseline.
- Log exception scope and re-stage remediation with pilot validation.
Closure criteriaresolution contract
Resilience-005 meets target baseline (Tabletop exercise completed within last 365 days) using resilience.tabletop_exercise_last_days.
Program-derived from explicit closure text or the first verification outcome.
Traceabilitypayload-backed provenance
Data Source: resilience.tabletop_exercise_last_days
Severity Basis: Severity based on Low impact and affected scope.
Evidence · 1full envelope in § 04
evidence
No Recent Security Tabletop Exercises: observed=9999 days, target=Tabletop exercise completed within last 365 days
resilience
2026-05-15T23:34:51.492815+00:00
P3OnPrem-2033c52168ea3ca38362f4cc45adf8dd
SYSVOL permissions hardened (no action required)
Open
Impact
None — control is in place.
Verifyexpected post-remediation
- Verify remediation on the reporting host
Get-Acl \\corp.contoso.local\SYSVOL
Rollback
- N/A
Closure criteriaresolution contract
Command returns the expected value above.
Program-derived from explicit closure text or the first verification outcome.
Evidence · 1full envelope in § 04
evidence
SYSVOL does not grant Authenticated Users write. This is hygiene confirmation, not a gap.
onprem_powershell
2026-05-15T23:34:43+00:00
Skip to main content
⚠Synthetic demo dataFindings, identities, controls and metrics are fictional. Do not treat values as a real assessment or extract names or domains.
Polaris·Security Assessment · § 03 Compliance Matrix
Contoso Defense Systems
Generated May 15, 2026, 7:34 PM ET · trailing 30d
manifest only
4 frameworks NIST primary 50% scored CMMC most-incomplete (28%)
Frameworks · 4 assessed
Crosswalk: mapping enrichment pending§ 03 · Compliance Matrixprimary frameworkManifest · May 15, 2026
Last assessed May 15, 2026Polaris automated
NIST CSF 2.0
2 controls failing · 60% not yet assessed.
Score of assessed controls
50%
10 of 25 controls scored · 15 not yet assessed
Pass2
8%
Partial6
24%
Fail2
8%
Not assessed15
60%
§ 03·A
Functions at a glance
status density by function§ 03·B
Control ledger
25 controlsControl
Status
Name
Coverage
Evidence
Govern3 controls
GV.OC-01
Not assessed
Organizational mission and stakeholders are understood
0%
0 ev
GV.RM-01
Not assessed
Risk management objectives are established and communicated
0%
0 ev
GV.SC-01
Not assessed
Supply chain risk management program is established
0%
0 ev
Identify5 controls
ID.AM-05
Partial
Assets are prioritized based on classification and criticality
40%
1 ev
ID.AM-01
Pass
Hardware asset inventories are maintained
60%
1 ev
ID.AM-02
Not assessed
Software asset inventories are maintained
0%
0 ev
ID.RA-01
Not assessed
Vulnerabilities in assets are identified
0%
0 ev
ID.RA-02
Not assessed
Threat intelligence is received from information sharing
0%
0 ev
Protect9 controls
PR.AA-03
Fail
MFA and risk-based authentication are enforced
0%
0 ev
PR.AA-05
Partial
Access permissions managed using least privilege
40%
1 ev
PR.DS-02
Partial
Data in transit is protected
40%
1 ev
PR.DS-10
Partial
Data classification and handling policies
40%
1 ev
PR.IR-01
Pass
Backups of data are maintained and tested
60%
1 ev
PR.AA-01
Not assessed
Identities and credentials are managed
0%
0 ev
PR.AA-02
Not assessed
Identities are proofed and bound to credentials
0%
0 ev
PR.DS-01
Not assessed
Data at rest is protected
0%
0 ev
PR.PS-01
Not assessed
Configuration management practices are established
0%
0 ev
Detect4 controls
DE.CM-01
Fail
Networks are monitored for potential adverse events
0%
0 ev
DE.CM-03
Not assessed
Computing hardware and software are monitored
0%
0 ev
DE.CM-06
Not assessed
External service provider activities are monitored
0%
0 ev
DE.AE-02
Not assessed
Adverse events are analyzed
0%
0 ev
Respond2 controls
RS.MA-01
Not assessed
Incident response plan is executed
0%
0 ev
RS.AN-03
Not assessed
Analysis is performed to establish what has taken place
0%
0 ev
Recover2 controls
RC.RP-01
Partial
Recovery plan is executed during or after incident
40%
1 ev
RC.RP-03
Partial
Integrity of backups and restored assets is verified
20%
1 ev
Evidence chain
sig
Manifest signed · bundle verified · 2026-05-15T23:34:52.960141+00:00
Assessment
NIST CSF 2.0 · v2.0
Polaris automated
last assessed May 15, 2026
Scope
Contoso Defense Systems
30-day scan window
run 20260515T233445Z_ad-hoc
§ 03 · Compliance MatrixManifest · May 15, 2026
Last assessed May 15, 2026Polaris automated
CIS v8 IG2
3 controls failing · 23% not yet assessed.
Score of assessed controls
72%
33 of 43 controls scored · 10 not yet assessed
Pass18
42%
Partial12
28%
Fail3
7%
Not assessed10
23%
§ 03·A
Functions at a glance
status density by function§ 03·B
Control ledger
43 controlsControl
Status
Name
Coverage
Evidence
Control 12 controls
1.1
Pass
Establish and Maintain Detailed Enterprise Asset Inventory
100%
1 ev
1.2
Pass
Address Unauthorized Assets
100%
1 ev
Control 23 controls
2.1
Pass
Establish and Maintain a Software Inventory
100%
1 ev
2.2
Not assessed
Ensure Authorized Software is Currently Supported
0%
1 ev
2.3
Not assessed
Address Unauthorized Software
0%
1 ev
Control 35 controls
3.1
Partial
Establish and Maintain a Data Management Process
65%
1 ev
3.3
Partial
Configure Data Access Control Lists
65%
1 ev
3.6
Partial
Encrypt Data on End-User Devices
65%
1 ev
3.2
Pass
Establish and Maintain a Data Inventory
100%
1 ev
3.4
Pass
Enforce Data Retention
100%
1 ev
Control 43 controls
4.7
Fail
Manage Default Accounts on Enterprise Assets and Software
25%
1 ev
4.1
Partial
Establish and Maintain a Secure Configuration Process
65%
1 ev
4.3
Pass
Configure Automatic Session Locking on Enterprise Assets
100%
1 ev
Control 54 controls
5.4
Fail
Restrict Administrator Privileges to Dedicated Administrator Accounts
25%
1 ev
5.2
Partial
Use Unique Passwords
65%
1 ev
5.1
Pass
Establish and Maintain an Inventory of Accounts
100%
1 ev
5.3
Not assessed
Disable Dormant Accounts
0%
1 ev
Control 65 controls
6.5
Fail
Require MFA for Administrative Access
25%
1 ev
6.1
Pass
Establish an Access Granting Process
100%
1 ev
6.2
Pass
Establish an Access Revoking Process
100%
1 ev
6.3
Pass
Require MFA for Externally-Exposed Applications
100%
1 ev
6.4
Pass
Require MFA for Remote Network Access
100%
1 ev
Control 73 controls
7.1
Pass
Establish and Maintain a Vulnerability Management Process
100%
1 ev
7.2
Pass
Establish and Maintain a Remediation Process
100%
1 ev
7.3
Pass
Perform Automated Operating System Patch Management
100%
1 ev
Control 83 controls
8.2
Partial
Collect Audit Logs
65%
1 ev
8.3
Pass
Ensure Adequate Audit Log Storage
100%
1 ev
8.1
Not assessed
Establish and Maintain an Audit Log Management Process
0%
1 ev
Control 92 controls
9.1
Partial
Ensure Use of Only Fully Supported Browsers and Email Clients
65%
1 ev
9.2
Pass
Use DNS Filtering Services
100%
1 ev
Control 103 controls
10.2
Partial
Configure Automatic Anti-Malware Signature Updates
65%
1 ev
10.3
Partial
Disable Autorun and Autoplay for Removable Media
65%
1 ev
10.1
Pass
Deploy and Maintain Anti-Malware Software
100%
1 ev
Control 114 controls
11.1
Not assessed
Establish and Maintain a Data Recovery Process
0%
1 ev
11.2
Not assessed
Perform Automated Backups
0%
1 ev
11.3
Not assessed
Protect Recovery Data
0%
1 ev
11.4
Not assessed
Establish and Maintain an Isolated Instance of Recovery Data
0%
1 ev
Control 131 control
13.1
Pass
Centralize Security Event Alerting
100%
1 ev
Control 145 controls
14.1
Partial
Establish and Maintain a Security Awareness Program
65%
1 ev
14.3
Partial
Train Workforce Members on Authentication Best Practices
65%
1 ev
14.4
Partial
Train Workforce Members on Data Handling Best Practices
65%
1 ev
14.2
Not assessed
Train Workforce Members to Recognize Social Engineering Attacks
0%
1 ev
14.5
Not assessed
Train Workforce Members on Causes of Unintentional Data Exposure
0%
1 ev
Evidence chain
sig
Manifest signed · bundle verified · 2026-05-15T23:34:52.960141+00:00
Assessment
CIS v8 IG2 · v8.0
Polaris automated
last assessed May 15, 2026
Scope
Contoso Defense Systems
30-day scan window
run 20260515T233445Z_ad-hoc
§ 03 · Compliance MatrixManifest · May 15, 2026
Last assessed May 15, 2026Polaris automated
SOC 2 TSC
3 controls failing · 41% not yet assessed.
Score of assessed controls
56%
16 of 27 controls scored · 11 not yet assessed
Pass5
19%
Partial8
30%
Fail3
11%
Not assessed11
41%
§ 03·A
Functions at a glance
status density by function§ 03·B
Control ledger
27 controlsControl
Status
Name
Coverage
Evidence
CC18 controls
CC2.1
Fail
Obtains and uses relevant quality information
25%
0 ev
CC7.1
Fail
Monitors system components for anomalies
25%
0 ev
CC7.2
Fail
Detects and reports security incidents
25%
0 ev
CC5.1
Partial
Logical access security over information assets
65%
1 ev
CC5.2
Partial
Access restricted to authorized personnel
65%
1 ev
CC5.3
Partial
Security of access credentials
65%
1 ev
CC6.2
Partial
Encryption of data in transit
65%
1 ev
CC6.7
Partial
Restricts transmission and movement of data
65%
1 ev
CC6.3
Pass
Access to data is restricted and controlled
100%
1 ev
CC1.1
Not assessed
Demonstrates commitment to integrity and ethical values
0%
1 ev
CC1.2
Not assessed
Board exercises oversight of internal controls
0%
0 ev
CC3.1
Not assessed
Specifies objectives and identifies risks
0%
0 ev
CC3.2
Not assessed
Identifies and assesses risks to objectives
0%
0 ev
CC6.1
Not assessed
Encryption of data at rest
0%
0 ev
CC6.6
Not assessed
Security measures against threats to infrastructure
0%
0 ev
CC7.3
Not assessed
Evaluates and responds to security incidents
0%
0 ev
CC7.4
Not assessed
Responds to identified security incidents
0%
0 ev
CC8.1
Not assessed
Manages changes to infrastructure and software
0%
0 ev
A3 controls
A1.2
Partial
Environmental protections and recovery mechanisms
65%
1 ev
A1.3
Partial
Tests recovery plan procedures
65%
1 ev
A1.1
Pass
Maintains availability commitments and system requirements
100%
1 ev
C2 controls
C1.1
Pass
Identifies and maintains confidential information
100%
1 ev
C1.2
Pass
Disposes of confidential information per policy
100%
1 ev
PI2 controls
PI1.1
Partial
Obtains and communicates processing integrity commitments
65%
1 ev
PI1.2
Pass
System inputs are complete, accurate, and valid
100%
1 ev
P2 controls
P1.1
Not assessed
Privacy notice provided to data subjects
0%
0 ev
P1.2
Not assessed
Choice and consent obtained for data collection
0%
0 ev
Evidence chain
sig
Manifest signed · bundle verified · 2026-05-15T23:34:52.960141+00:00
Assessment
SOC 2 TSC · v2017 TSC
Polaris automated
last assessed May 15, 2026
Scope
Contoso Defense Systems
30-day scan window
run 20260515T233445Z_ad-hoc
LOW COVERAGEFramework score below 30% — assessment is preliminary. Complete remaining controls before attesting.
§ 03 · Compliance MatrixManifest · May 15, 2026
Last assessed May 15, 2026Polaris automated (self-assessment posture, not C3PAO)
CMMC 2.0 Level 2
3 controls failing · 72% not yet assessed.
Score of assessed controls
25%
26 of 93 controls scored · 67 not yet assessed
Pass23
25%
Partial0
0%
Fail3
3%
Not assessed67
72%
§ 03·A
Functions at a glance
status density by function§ 03·B
Control ledger
93 controlsControl
Status
Name
Coverage
Evidence
AC18 controls
AC.L2-3.1.6
Fail
Non-Privileged Account Use
25%
1 ev
AC.L2-3.1.3
Pass
Control CUI Flow
100%
1 ev
AC.L2-3.1.4
Pass
Separation of Duties
100%
1 ev
AC.L2-3.1.5
Pass
Least Privilege
100%
1 ev
AC.L2-3.1.7
Pass
Privileged Functions
100%
1 ev
AC.L2-3.1.8
Pass
Unsuccessful Logon Attempts
100%
1 ev
AC.L2-3.1.9
Not assessed
Privacy & Security Notices
0%
1 ev
AC.L2-3.1.10
Not assessed
Session Lock
0%
1 ev
AC.L2-3.1.11
Not assessed
Session Termination
0%
1 ev
AC.L2-3.1.12
Not assessed
Remote Access Control
0%
1 ev
AC.L2-3.1.13
Not assessed
Remote Access Encryption
0%
1 ev
AC.L2-3.1.14
Not assessed
Remote Access Routing
0%
1 ev
AC.L2-3.1.15
Not assessed
Privileged Remote Access
0%
1 ev
AC.L2-3.1.16
Not assessed
Wireless Access Authorization
0%
1 ev
AC.L2-3.1.17
Not assessed
Wireless Access Protection
0%
1 ev
AC.L2-3.1.18
Not assessed
Mobile Device Connection
0%
1 ev
AC.L2-3.1.19
Not assessed
Encrypt CUI on Mobile
0%
1 ev
AC.L2-3.1.21
Not assessed
Portable Storage Use
0%
1 ev
AT3 controls
AT.L2-3.2.1
Pass
Security Awareness
100%
1 ev
AT.L2-3.2.2
Not assessed
Role-Based Training
0%
1 ev
AT.L2-3.2.3
Not assessed
Insider Threat Awareness
0%
1 ev
AU9 controls
AU.L2-3.3.4
Fail
Audit Failure Alerting
25%
1 ev
AU.L2-3.3.1
Pass
System Auditing
100%
1 ev
AU.L2-3.3.2
Pass
User Accountability
100%
1 ev
AU.L2-3.3.8
Pass
Audit Protection
100%
1 ev
AU.L2-3.3.9
Pass
Audit Management
100%
1 ev
AU.L2-3.3.3
Not assessed
Event Review
0%
1 ev
AU.L2-3.3.5
Not assessed
Audit Correlation
0%
1 ev
AU.L2-3.3.6
Not assessed
Audit Reduction
0%
1 ev
AU.L2-3.3.7
Not assessed
Authoritative Time Source
0%
1 ev
CA4 controls
CA.L2-3.12.1
Not assessed
Security Assessments
0%
1 ev
CA.L2-3.12.2
Not assessed
Plan of Action
0%
1 ev
CA.L2-3.12.3
Not assessed
Security Control Monitoring
0%
1 ev
CA.L2-3.12.4
Not assessed
System Security Plan
0%
1 ev
CM9 controls
CM.L2-3.4.1
Pass
System Baseline Configuration
100%
1 ev
CM.L2-3.4.2
Pass
Security Configuration Enforcement
100%
1 ev
CM.L2-3.4.3
Not assessed
System Change Management
0%
1 ev
CM.L2-3.4.4
Not assessed
Security Impact Analysis
0%
1 ev
CM.L2-3.4.5
Not assessed
Access Restrictions for Change
0%
1 ev
CM.L2-3.4.6
Not assessed
Least Functionality
0%
1 ev
CM.L2-3.4.7
Not assessed
Nonessential Functionality
0%
1 ev
CM.L2-3.4.8
Not assessed
Application Allowlisting
0%
1 ev
CM.L2-3.4.9
Not assessed
User-Installed Software
0%
1 ev
IA9 controls
IA.L2-3.5.3
Fail
Multifactor Authentication
25%
1 ev
IA.L2-3.5.4
Pass
Replay-Resistant Authentication
100%
1 ev
IA.L2-3.5.7
Pass
Password Complexity
100%
1 ev
IA.L2-3.5.8
Pass
Password Reuse Prohibition
100%
1 ev
IA.L2-3.5.5
Not assessed
Identifier Reuse Prevention
0%
1 ev
IA.L2-3.5.6
Not assessed
Identifier Disabling
0%
1 ev
IA.L2-3.5.9
Not assessed
Temporary Passwords
0%
1 ev
IA.L2-3.5.10
Not assessed
Cryptographic Password Protection
0%
1 ev
IA.L2-3.5.11
Not assessed
Obscure Feedback
0%
1 ev
IR3 controls
IR.L2-3.6.1
Not assessed
Incident Handling
0%
1 ev
IR.L2-3.6.2
Not assessed
Incident Reporting
0%
1 ev
IR.L2-3.6.3
Not assessed
Incident Response Testing
0%
1 ev
MA6 controls
MA.L2-3.7.1
Not assessed
System Maintenance
0%
1 ev
MA.L2-3.7.2
Not assessed
Maintenance Controls
0%
1 ev
MA.L2-3.7.3
Not assessed
Equipment Sanitization
0%
1 ev
MA.L2-3.7.4
Not assessed
Media Inspection
0%
1 ev
MA.L2-3.7.5
Not assessed
Nonlocal Maintenance
0%
1 ev
MA.L2-3.7.6
Not assessed
Maintenance Personnel
0%
1 ev
MP8 controls
MP.L2-3.8.1
Not assessed
Media Protection
0%
1 ev
MP.L2-3.8.2
Not assessed
Media Access
0%
1 ev
MP.L2-3.8.4
Not assessed
Media Markings
0%
1 ev
MP.L2-3.8.5
Not assessed
Media Accountability
0%
1 ev
MP.L2-3.8.6
Not assessed
Portable Storage Encryption
0%
1 ev
MP.L2-3.8.7
Not assessed
Removable Media Control
0%
1 ev
MP.L2-3.8.8
Not assessed
Shared Media
0%
1 ev
MP.L2-3.8.9
Not assessed
CUI Backup Protection
0%
1 ev
PE2 controls
PE.L2-3.10.2
Not assessed
Facility Protection
0%
1 ev
PE.L2-3.10.6
Not assessed
Alternative Work Sites
0%
1 ev
PS2 controls
PS.L2-3.9.1
Not assessed
Screen Individuals
0%
1 ev
PS.L2-3.9.2
Not assessed
Personnel Actions
0%
1 ev
RA3 controls
RA.L2-3.11.2
Pass
Vulnerability Scanning
100%
1 ev
RA.L2-3.11.1
Not assessed
Risk Assessments
0%
1 ev
RA.L2-3.11.3
Not assessed
Vulnerability Remediation
0%
1 ev
SC14 controls
SC.L2-3.13.6
Pass
Network Communication by Exception
100%
1 ev
SC.L2-3.13.8
Pass
Data in Transit Encryption
100%
1 ev
SC.L2-3.13.11
Pass
CUI Encryption
100%
1 ev
SC.L2-3.13.16
Pass
Data at Rest Encryption
100%
1 ev
SC.L2-3.13.2
Not assessed
Security Engineering
0%
1 ev
SC.L2-3.13.3
Not assessed
Role Separation
0%
1 ev
SC.L2-3.13.4
Not assessed
Shared Resource Control
0%
1 ev
SC.L2-3.13.7
Not assessed
Split Tunneling Prevention
0%
1 ev
SC.L2-3.13.9
Not assessed
Connection Termination
0%
1 ev
SC.L2-3.13.10
Not assessed
Cryptographic Key Management
0%
1 ev
SC.L2-3.13.12
Not assessed
Collaborative Device Control
0%
1 ev
SC.L2-3.13.13
Not assessed
Mobile Code Control
0%
1 ev
SC.L2-3.13.14
Not assessed
Voice over IP Control
0%
1 ev
SC.L2-3.13.15
Not assessed
Communications Authenticity
0%
1 ev
SI3 controls
SI.L2-3.14.3
Pass
Security Alerts & Advisories
100%
1 ev
SI.L2-3.14.6
Pass
Monitor Communications
100%
1 ev
SI.L2-3.14.7
Pass
Identify Unauthorized Use
100%
1 ev
Evidence chain
sig
Manifest signed · bundle verified · 2026-05-15T23:34:52.960141+00:00
Assessment
CMMC 2.0 Level 2 · v2.0 L2
Polaris automated (self-assessment posture, not C3PAO)
last assessed May 15, 2026
Scope
Contoso Defense Systems
30-day scan window
run 20260515T233445Z_ad-hoc
What it requires
Make cybersecurity risk part of how the organization understands its mission, stakeholders, and legal obligations — not a side function.
Why it matters
If leadership does not explicitly tie security to the mission, security decisions get deprioritized during budget cycles and strategic shifts.
How Polaris measures it
- charter — Cybersecurity charter or policy references the company mission by name and identifies internal/external stakeholders.
- board cadence — Cybersecurity reported to the board at least quarterly.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Govern — establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Govern — establish and monitor the organization's cybersecurity risk management strategy, expectations, and policy.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Maintain a live inventory of every physical device connected to the network — laptops, servers, network gear, IoT, printers.
Why it matters
Unknown devices are the easiest way for an attacker to maintain persistence.
How Polaris measures it
- coverage — >=98% of devices appearing in DHCP logs matched to an inventory record within 24h.
- freshness — Inventory age < 7 days for in-use assets.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identify — understand the organization's assets, risks, and context so security decisions are informed by business reality.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identify — understand the organization's assets, risks, and context so security decisions are informed by business reality.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identify — understand the organization's assets, risks, and context so security decisions are informed by business reality.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identify — understand the organization's assets, risks, and context so security decisions are informed by business reality.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Every user and service has a unique, verified identity before being given access. No shared accounts.
Why it matters
Shared credentials destroy accountability — once they leak, there is no way to tell which human did what.
How Polaris measures it
- uniqueness — Zero accounts marked 'shared' in directory; every privileged action attributable to a named person.
- lifecycle — Joiner/mover/leaver automated in >=95% of cases with evidence of verification.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Grant the smallest set of permissions people need to do their job, and review them regularly. Revoke access the moment it is no longer needed.
Why it matters
Accounts with excess privilege are the primary vehicle for lateral movement after an initial breach.
How Polaris measures it
- least-priv — Privileged role count <=0.5% of total user count.
- reviews — Access reviews completed quarterly for privileged roles; evidence retained 2 years.
- MFA — MFA enforced on 100% of privileged role assignments.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect — apply safeguards to ensure delivery of critical services and limit the impact of a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Segment networks, protect them from unauthorized access, and monitor traffic for anomalies.
Why it matters
A flat network turns a foothold on one laptop into a breach of the whole business.
How Polaris measures it
- segmentation — Production workloads isolated from corporate LAN via enforced firewalls.
- exposure — Zero high-risk ports (RDP/3389, SMB/445) exposed to the public internet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Detect — discover cybersecurity events in a timely manner.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Detect — discover cybersecurity events in a timely manner.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Detect — discover cybersecurity events in a timely manner.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Detect — discover cybersecurity events in a timely manner.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Respond — take action when a cybersecurity event is detected.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Respond — take action when a cybersecurity event is detected.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Recover — restore capabilities or services that were impaired due to a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Recover — restore capabilities or services that were impaired due to a cybersecurity event.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain Detailed Enterprise Asset Inventory. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Address Unauthorized Assets. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Software Inventory. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Ensure Authorized Software is Currently Supported. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Address Unauthorized Software. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Data Management Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Data Inventory. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configure data-access ACLs so only the people who need a dataset can reach it.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Enforce Data Retention. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Encrypt Data on End-User Devices. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Secure Configuration Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configure Automatic Session Locking on Enterprise Assets. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Manage Default Accounts on Enterprise Assets and Software. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Keep a current list of user and service accounts across all systems, including what each one can access.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Use Unique Passwords. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Disable Dormant Accounts. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Keep administrative privileges on dedicated admin accounts separate from day-to-day accounts.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish an Access Granting Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish an Access Revoking Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Require MFA for Externally-Exposed Applications. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Require MFA for any remote access into the environment.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Require MFA on every administrator account, every sign-in.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Vulnerability Management Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Remediation Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Deploy OS patches automatically on a defined schedule instead of manually per server.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain an Audit Log Management Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Collect Audit Logs. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Ensure Adequate Audit Log Storage. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Ensure Use of Only Fully Supported Browsers and Email Clients. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Use DNS Filtering Services. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Deploy and maintain anti-malware software across managed endpoints.
[paraphrased — see source]Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configure Automatic Anti-Malware Signature Updates. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Disable Autorun and Autoplay for Removable Media. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Data Recovery Process. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Perform Automated Backups. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Protect Recovery Data. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain an Isolated Instance of Recovery Data. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Centralize Security Event Alerting. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Establish and Maintain a Security Awareness Program. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Train Workforce Members to Recognize Social Engineering Attacks. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Train Workforce Members on Authentication Best Practices. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Train Workforce Members on Data Handling Best Practices. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Train Workforce Members on Causes of Unintentional Data Exposure. This control is tracked in CIS v8 IG2 but has no plain-language summary in the Polaris catalog yet.
Official source: CIS Controls v8
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Demonstrates commitment to integrity and ethical values. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Board exercises oversight of internal controls. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Obtains and uses relevant quality information. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Specifies objectives and identifies risks. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identifies and assesses risks to objectives. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Logical access security over information assets. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access restricted to authorized personnel. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security of access credentials. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Implement logical access controls — authentication, authorization, and access restriction — to prevent unauthorized access to information assets.
[paraphrased — see source]Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Encryption of data in transit. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Additions, modifications, and removals of user access to systems are authorized and tracked.
[paraphrased — see source]Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security measures against threats to infrastructure. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Restricts transmission and movement of data. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Monitor system components for anomalies and indicators of compromise.
[paraphrased — see source]Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Detects and reports security incidents. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Evaluates and responds to security incidents. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Responds to identified security incidents. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Authorize, test, document, and approve changes to infrastructure, software, and procedures before production.
[paraphrased — see source]Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Maintains availability commitments and system requirements. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Environmental protections and recovery mechanisms. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Tests recovery plan procedures. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identifies and maintains confidential information. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Disposes of confidential information per policy. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Obtains and communicates processing integrity commitments. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System inputs are complete, accurate, and valid. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Privacy notice provided to data subjects. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Choice and consent obtained for data collection. This control is tracked in SOC 2 TSC but has no plain-language summary in the Polaris catalog yet.
Official source: SOC 2 TSC
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Privileged accounts (domain admins, cloud admins, root) are issued only when necessary, used only for privileged tasks, and never used for routine work like email.
Why it matters
The single most-cited CMMC Level 2 finding. Abuse of privileged accounts is the primary ransomware path from foothold to domain takeover.
How Polaris measures it
- separation — Admin accounts have no mailbox, no internet browsing, no office suite entitlements.
- usage audit — Privileged session logs retained 1 year with tamper-evident storage.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Remote access into the environment (VPN, RDP, SSH gateways) is monitored, authenticated with MFA, and tightly controlled.
Why it matters
Remote access is the primary initial-access vector in nation-state actor playbooks.
How Polaris measures it
- exposure — Zero direct RDP/SSH exposure to the public internet.
- MFA gate — Remote access requires phishing-resistant MFA at the gateway.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Access Control — CMMC practices limiting system access to authorized users, processes, and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security Awareness. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Role-Based Training. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Insider Threat Awareness. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security-relevant events are logged, retained, and protected from tampering.
Why it matters
Logs are the auditor's primary evidence source. Missing logs during an assessment routinely become automatic findings.
How Polaris measures it
- retention — Audit logs retained >=1 year; tamper-evident storage (WORM or append-only).
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Log review is not one-system-at-a-time — events from different sources are correlated to detect multi-stage attacks.
Why it matters
Modern attacks span identity, endpoint, and network. Siloed log review misses them by design.
How Polaris measures it
- SIEM rules — Documented correlation rules for lateral movement, privilege escalation, and data exfiltration.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Audit & Accountability — CMMC practices ensuring system activity is logged and accountable.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security Assessments. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Plan of Action. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Security Control Monitoring. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System Security Plan. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Every system class has a documented baseline configuration (OS image, service set, firewall rules), and deviations from the baseline are reviewed.
Why it matters
You cannot detect drift without a baseline to drift from.
How Polaris measures it
- baselines — Golden images for Windows workstation, Windows server, Linux server, container base; reviewed yearly.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Systems are actively kept at their secure configuration — drift is detected and reverted, not just logged.
Why it matters
Static baselines are useless if operators silently loosen them. The 'enforce' verb is deliberate.
How Polaris measures it
- enforcement — Config-management tool (DSC, Ansible, Chef, GPO) applied on a <24h cycle with drift reporting.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Systems run only the software and open only the ports they actually need. Everything else is removed or disabled.
Why it matters
Attack surface reduction is cheaper and more durable than detection.
How Polaris measures it
- inventory — Software inventory per system class; weekly scan for deviations.
- ports — External attack-surface scan shows only documented ports.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Configuration Management — CMMC practices establishing and maintaining secure system configurations.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
MFA is required for every privileged account and for every network-level access (including VPN). No exceptions for service accounts without a documented compensating control.
Why it matters
CMMC treats MFA as the minimum acceptable authentication for anything touching CUI.
How Polaris measures it
- privileged MFA — 100% of privileged sign-ins pass MFA challenge; evidence via directory audit logs.
- network MFA — VPN / remote-access gateways require MFA at session establishment.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Passwords meet modern complexity requirements (length > composition), and users cannot cycle back to recently-used passwords.
Why it matters
Weak and reused passwords make MFA fatigue and credential-stuffing attacks trivially successful.
How Polaris measures it
- policy — Min-length >=14 for standard users, >=16 for admins; breached-password check on set.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
When users change their password, the system prevents them from picking one they have used in the recent past.
Why it matters
Password rotation without reuse prevention is theatre — users rotate between two favorites.
How Polaris measures it
- history — Domain policy prevents reuse of last 24 passwords.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Identification & Authentication — CMMC practices verifying the identity of users and devices.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Incident Handling. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Incident Reporting. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Incident Response Testing. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System Maintenance. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Maintenance Controls. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Equipment Sanitization. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Media Inspection. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Nonlocal Maintenance. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Maintenance Personnel. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Media Protection. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Media Access. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Media Markings. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Media Accountability. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Portable Storage Encryption. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Removable Media Control. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Shared Media. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
CUI Backup Protection. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Facility Protection. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Alternative Work Sites. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Screen Individuals. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Personnel Actions. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Risk Assessments. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Vulnerability Scanning. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Vulnerability Remediation. This control is tracked in CMMC 2.0 Level 2 but has no plain-language summary in the Polaris catalog yet.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Controlled Unclassified Information is encrypted whenever it crosses a network, using approved cryptographic mechanisms.
Why it matters
Plaintext CUI in transit is an immediate CMMC blocker.
How Polaris measures it
- TLS — TLS 1.2+ with approved cipher suites on every service handling CUI.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
When cryptography is used to protect CUI, the implementation is FIPS 140-2 (or 140-3) validated — not just 'compliant'.
Why it matters
DoD distinguishes 'compliant' (follows the standard) from 'validated' (lab-tested and certificated). Only the latter is acceptable for CUI.
How Polaris measures it
- cert numbers — Every CUI-protecting crypto module has a current FIPS 140 certificate number on file.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Communications Protection — CMMC practices protecting system and communications integrity.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
CUI sitting on disk — in databases, file shares, backups, laptops — is encrypted.
Why it matters
Device theft, cloud storage misconfiguration, and backup exposure are all addressed by this single control.
How Polaris measures it
- at-rest — BitLocker/FileVault on endpoints; cloud storage encrypted with customer-managed keys; backups encrypted.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Information Integrity — CMMC practices identifying and correcting flaws and protecting against malicious code.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
Systems are monitored for attacks and indicators of compromise — not just for uptime.
Why it matters
CMMC assessors look for specific IOC feeds integrated with SIEM.
How Polaris measures it
- IOC feeds — Curated IOC feed (commercial or ISAC) integrated with SIEM; alerts triaged within SLA.
Linked findings · 0
✓No active findings against this control in the current scan window.
What it requires
System & Information Integrity — CMMC practices identifying and correcting flaws and protecting against malicious code.
Linked findings · 0
✓No active findings against this control in the current scan window.
NIST CSF 2.0NIST501025GV.OC-01GV.RM-01GV.SC-01ID.AM-01ID.AM-02ID.AM-05ID.RA-01ID.RA-02PR.AA-01PR.AA-02PR.AA-03PR.AA-05PR.DS-01PR.DS-02PR.DS-10PR.PS-01PR.IR-01DE.CM-01DE.CM-03DE.CM-06DE.AE-02RS.MA-01RS.AN-03RC.RP-01RC.RP-03CIS v8 IG2CIS7233431.11.22.12.22.33.13.23.33.43.64.14.34.75.15.25.35.46.16.26.36.46.57.17.27.38.18.28.39.19.210.110.210.311.111.211.311.413.114.114.214.314.414.5SOC 2 TSCSOC2561627CC1.1CC1.2CC2.1CC3.1CC3.2CC5.1CC5.2CC5.3CC6.1CC6.2CC6.3CC6.6CC6.7CC7.1CC7.2CC7.3CC7.4CC8.1A1.1A1.2A1.3C1.1C1.2PI1.1PI1.2P1.1P1.2CMMC 2.0 Level 2CMMC252693AC.L2-3.1.3AC.L2-3.1.4AC.L2-3.1.5AC.L2-3.1.6AC.L2-3.1.7AC.L2-3.1.8AC.L2-3.1.9AC.L2-3.1.10AC.L2-3.1.11AC.L2-3.1.12AC.L2-3.1.13AC.L2-3.1.14AC.L2-3.1.15AC.L2-3.1.16AC.L2-3.1.17AC.L2-3.1.18AC.L2-3.1.19AC.L2-3.1.21AT.L2-3.2.1AT.L2-3.2.2AT.L2-3.2.3AU.L2-3.3.1AU.L2-3.3.2AU.L2-3.3.3AU.L2-3.3.4AU.L2-3.3.5AU.L2-3.3.6AU.L2-3.3.7AU.L2-3.3.8AU.L2-3.3.9CA.L2-3.12.1CA.L2-3.12.2CA.L2-3.12.3CA.L2-3.12.4CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.3CM.L2-3.4.4CM.L2-3.4.5CM.L2-3.4.6CM.L2-3.4.7CM.L2-3.4.8CM.L2-3.4.9IA.L2-3.5.3IA.L2-3.5.4IA.L2-3.5.5IA.L2-3.5.6IA.L2-3.5.7IA.L2-3.5.8IA.L2-3.5.9IA.L2-3.5.10IA.L2-3.5.11IR.L2-3.6.1IR.L2-3.6.2IR.L2-3.6.3MA.L2-3.7.1MA.L2-3.7.2MA.L2-3.7.3MA.L2-3.7.4MA.L2-3.7.5MA.L2-3.7.6MP.L2-3.8.1MP.L2-3.8.2MP.L2-3.8.4MP.L2-3.8.5MP.L2-3.8.6MP.L2-3.8.7MP.L2-3.8.8MP.L2-3.8.9PE.L2-3.10.2PE.L2-3.10.6PS.L2-3.9.1PS.L2-3.9.2RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3SC.L2-3.13.2SC.L2-3.13.3SC.L2-3.13.4SC.L2-3.13.6SC.L2-3.13.7SC.L2-3.13.8SC.L2-3.13.9SC.L2-3.13.10SC.L2-3.13.11SC.L2-3.13.12SC.L2-3.13.13SC.L2-3.13.14SC.L2-3.13.15SC.L2-3.13.16SI.L2-3.14.3SI.L2-3.14.6SI.L2-3.14.7On-Prem: Windows Firewall Disabled on One or More ProfilesCritical Security Configuration Gaps Require ActionNSG Rules Allow All Inbound TrafficLegacy Authentication Still Allowed40 Users Not Covered by MFA Policy2 High-Risk User Accounts Detected3 Active Security Alerts (2 High, 1 Medium)Safe Links Protection DisabledSafe Attachments Protection DisabledAnti-Phishing Controls Are Not Fully EnabledEmail Threat Detection/Containment Rate Is Below TargetFIDO2 / Passkey Authentication Not EnabledFailed and Risky Sign-In Volume Exceeds BaselinePrivileged High-Risk Administrative Operations Require ReviewSharePoint External Sharing Is Enabled on Collaboration SitesSecure Score Recommendation Backlog Is AccumulatingThird-Party Application Consents Include Elevated-Risk IntegrationsStrong Authentication Method Adoption Is Below TargetThreat Pulse Indicates Elevated Active Alert BacklogNetwork Security Groups Allow Unrestricted Inbound AccessStorage Accounts Allow Public Blob AccessSecurity Configuration Gaps Require RemediationHigh-Severity Vulnerabilities Require Short-Term RemediationOrphaned Cloud Resources Incurring WasteAD: Privileged Admin Footprint ControlledAD: LDAP Signing/Channel Binding GapOn-Prem: RDP Exposed Broadly Across NetworksOn-Prem: High-Risk Listening Ports ExposedOn-Prem: Windows Update Not Configured or CurrentOn-Prem: Certificates Expiring Within 30 DaysOn-Prem: Password Policy Below Minimum StrengthToo Many Global AdministratorsPIM Not Utilized for Privileged RolesLegacy Authentication Sign-Ins DetectedManaged Devices Missing Disk EncryptionNo Device Compliance Policies DefinedHigh Endpoint Vulnerability BacklogNo DLP Policies ConfiguredExcessive Third-Party App PermissionsSensitive Email Encryption Not EnabledExternal Email Forwarding Rules DetectedNo Outbound Spam Policy EnabledMail Flow Rules Bypass Security FilteringAuto-Forward to External Addresses DetectedMultiple Domains Without DMARCManaged Devices Missing BitLocker or Device EncryptionDefender Tamper Protection DisabledUnsupported Operating Systems in Managed FleetPrivileged Identity Management Not Protecting Admin RolesRisky Sign-Ins Not InvestigatedEmergency Access Accounts Not Ready for Lockout RecoveryNo Effective Network Segmentation DetectedStorage Accounts Allow HTTPAnonymous Storage Access EnabledKey Vault Recovery Protections DisabledAzure Secure Score Below TargetIncident Response Plan Not DocumentedSIEM Not Connected3 Users Authenticating with Legacy ProtocolsExcessive Global Administrators (7 accounts)Microsoft Sentinel SIEM Not Configured2 Apps with High-Risk OAuth Permissions1 Service Principal with High-Risk Permissions30 Guest Users Require Access Review (20.0% of user base)Trusted Named Locations Coverage Is Too NarrowDefault Domain Password Expiration Policy Increases Credential RiskTeams Guest Access Requires Stronger Collaboration GovernanceDevice Configuration Baseline Policy Depth Is LimitedDevice Compliance Policy Coverage Is IncompleteRetention Policy Coverage Is Partial Across M365 WorkloadsPublic IP Addresses With Exposure RisksMedium-Severity Vulnerabilities Require Planned RemediationUnused License Spend DetectedAzure Advisor Savings Not Yet RealizedOversized VM Fleet Increasing Compute SpendCloud Budget Alerts MissingUnlicensed Users Consuming Paid Service CapacityUnderutilized Premium License PortfolioAD: Legacy Authentication ActiveAD: Domain Controller Patch Baseline GapOn-Prem: USB Storage Policy Not EnforcedOn-Prem: Security Audit Log Retention Below 1 GBOn-Prem: Certificates Using Weak Algorithms (SHA1/MD5)On-Prem: Stale Computer Accounts DetectedExcessive Guest Users in DirectoryRisky Sign-Ins from Unknown LocationsSMS-Based MFA Still in Significant UseStale Device Sync Older Than 30 DaysOutdated Endpoint Operating System VersionsNo Device Configuration Policies AppliedSharePoint Sites Permit External SharingUnassociated Public IP Addresses DetectedNo Attack Simulation Campaigns ExecutedDMARC Record Missing Aggregate ReportingSPF Record Too PermissiveDMARC Policy Not Yet Set to RejectMailbox Auditing Disabled for Some or All MailboxesEmail Quarantine Workflow Not ConfiguredAnti-Impersonation Coverage Below TargetOS Versions Not CurrentStale Devices with No Sync > 90 DaysDefender Attack Surface Reduction Rules Not EnforcedDefender Onboarding Coverage Below 80%Defender EDR Block Mode DisabledeDiscovery Response Workflows Not ConfiguredExternal Sharing Unrestricted on SharePoint SitesOneDrive External Sharing OpenRetention Period Below Compliance BaselineNo Access Reviews ConfiguredOAuth Consent Policy Allows User ConsentSQL Servers Without Azure AD AuthenticationKey Vault Secrets Not RotatedNo Private Endpoints for PaaS ResourcesCritical Azure Resources Missing Diagnostic LoggingNo Azure Policy Assignments DetectedNo Analytic Rules for Critical Threat ScenariosBackup Restore Testing Stale929 Email Threat Detections Observed in Last 30 DaysSensitivity Labels Configured but Under-AdoptedDuplicate Security Tools DetectedDisabled Accounts Are Not Being RemovedNo Passwordless Authentication AdoptionRecords Management Controls DisabledTeams Without Assigned OwnersNo Named Locations ConfiguredExternal Sender Warning Banner DisabledWindows Autopilot Profiles Not ConfiguredInformation Barriers Not Configured for Restricted CommunicationsNo Sensitivity Label Auto-Labeling PoliciesCloud Resource Ownership Tags Missing at ScaleNo Recent Security Tabletop ExercisesCMMC AC.L2-3.1.6: Non-Privileged Account Use (Fail)CMMC IA.L2-3.5.3: Multifactor Authentication (Fail)CMMC SC.L2-3.13.2: Security Engineering (Partial)CMMC AU.L2-3.3.4: Audit Failure Alerting (Fail)CMMC CM.L2-3.4.5: Access Restrictions for Change (Partial)CMMC SI.L2-3.14.2: Malicious Code Protection (Partial)CMMC SI.L2-3.14.5: Advanced Persistent Threat Protection (Fail)CMMC IR.L2-3.6.1: Incident Handling (Partial)External trust to legacy-supplier.example has SID filtering disabledEdinburgh DC replication lag exceeds 4h threshold2 Domain Admins without MFAkrbtgt password age 247 days exceeds 180-day thresholdAdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendorAdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendorProtected Users group has zero membersDefault Domain Password Policy minimum length is 12 (CMMC L2 gap)DAL-PRINT01 has unconstrained Kerberos delegationHSV-FILE02 has unconstrained Kerberos delegation14 Kerberoastable service accountsService account svc_legacy_ctip_connector is AS-REP roastableService account svc_mes_ctl is AS-REP roastable34 accounts still accept RC4 Kerberos encryptionADCS template certifies domain controllers without signature (ESC1)ADCS template CorpUserSmartcard is ESC1 vulnerableADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerableEnterprise Issuing CA certificate expires in 57 daysSMB server signing is not required domain-wideLegacy SMBv1 enabled on 47 endpointsLDAP signing is optional (LDAPServerIntegrity=1)PowerShell script-block logging disabled across 203 hostsLSA Protection (RunAsPPL) is not enabledLegacy NTLMv1 authentication is still allowedSYSVOL permissions hardened (no action required)
Compliance Posture
Posture is mixed, and lack of assessment coverage is still the main constraint.
Header metrics reflect evidence-backed CMMC control coverage. Framework rows below separate assessed posture from coverage so failing, partial, and not assessed do not collapse into one number.
Collection Gaps
9
1 unresolved input groups
In-Scope CMMC Controls
110
The control population used for evidence-backed CMMC coverage.
Assessed Coverage
22%
24 assessed / 110 in scope
Assessed Posture
67%
16 passing, 4 partial, 4 failing on the assessed set
Not Assessed
86
Coverage or manual evidence is still missing.
Assessed Posture
67%
Passing 16 • Partial 4 • Failing 4
Not Assessed
86
controlsCoverage or manual evidence is still missing.
PASSING
Evidence-backed.
PARTIAL
Proof gaps remain.
FAILING
Not currently met.
NOT ASSESSED
Coverage missing.
PASSING
Evidence-backed
PARTIAL
Proof gaps remain
FAILING
Not currently met
NOT ASSESSED
Coverage missing
Confidence Context
Compliance
Coverage
100%
Freshness
May 15, 2026 23:34 UTC
Source
Snapshot-based evidence
Bias / Limits
1 unresolved input groups still drive Not Assessed controls and limit posture certainty.
Framework Workspace
Choose a framework
Stay inside the framework that matters for this audience without mixing mapped posture from unrelated standards into the first read.
Stay inside one framework at a time.
Framework View
Framework Posture Summary
Each row separates assessed posture from coverage so mapped framework summaries do not overstate certainty.
CMMC L2
24/110 assessed • 86 not assessed
24/110 assessed • 86 not assessed
16 pass
4 partial
4 fail
22% coverage
16 passing
4 partial
4 failing
86 not assessed
Coverage
22%
24/110 assessed
Pass rate 67%
CIS Controls v8
18/18 assessed • 0 not assessed
18/18 assessed • 0 not assessed
9 pass
9 partial
0 fail
100% coverage
9 passing
9 partial
0 failing
0 not assessed
Coverage
100%
18/18 assessed
Pass rate 50%
NIST CSF
22/23 assessed • 1 not assessed
22/23 assessed • 1 not assessed
6 pass
16 partial
0 fail
96% coverage
6 passing
16 partial
0 failing
1 not assessed
Coverage
96%
22/23 assessed
Pass rate 27%
SOC 2
27/33 assessed • 6 not assessed
27/33 assessed • 6 not assessed
18 pass
9 partial
0 fail
82% coverage
18 passing
9 partial
0 failing
6 not assessed
Coverage
82%
27/33 assessed
Pass rate 67%
Assessment Gaps
Coverage constraints that explain why some controls remain not assessed.
Collection gap
No live collection or usable manual artifact was available for this input.
Unlocks: the missing evidence needed to move controls out of Not Assessed.
Examples access_review_summary, terms_of_use_summary, lifecycle_summary
9
open gapsDetail Explorer
Evidence-backedControl Directory
Browse every in-scope control, including not-assessed rows. Open any control for exact evidence detail.
Directory
CMMC L2 110 controlsOne working list for passing, partial, failing, and gap controls.
Showing 110 of 110 controls
Directory
CIS Controls v8 18 controlsOne working list for passing, partial, failing, and gap controls.
Showing 18 of 18 controls
Directory
NIST CSF 23 controlsOne working list for passing, partial, failing, and gap controls.
Showing 23 of 23 controls
Directory
SOC 2 33 controlsOne working list for passing, partial, failing, and gap controls.
Showing 33 of 33 controls
Secondary Support
Mapping Support
These mappings show where findings touch frameworks. They do not represent framework posture or pass rates by themselves.
Finding-to-framework mappings
Expand only when you need traceability from a finding to its mapped frameworks.
expand_more
Finding-to-framework mappings
Expand only when you need traceability from a finding to its mapped frameworks.
hub Finding-to-Framework Mappings
Traceability support only. A checkmark indicates mapping coverage, not assessed posture.
| Finding ID | Title | Severity | CIS | NIST | SOC2 | ISO | CMMC |
|---|---|---|---|---|---|---|---|
| OnPremInfra-ONPREM-FW-001 | On-Prem: Windows Firewall Disabled on One or More Profiles | Critical | — | check_circle | — | — | check_circle |
| Device-015 | Critical Security Configuration Gaps Require Action | Critical | check_circle | check_circle | check_circle | check_circle | — |
| Network-010 | NSG Rules Allow All Inbound Traffic | Critical | check_circle | check_circle | check_circle | check_circle | — |
| Identity-005 | Legacy Authentication Still Allowed | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-008 | 40 Users Not Covered by MFA Policy | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-010 | 2 High-Risk User Accounts Detected | High | check_circle | check_circle | check_circle | check_circle | — |
| Security-001 | 3 Active Security Alerts (2 High, 1 Medium) | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-005 | Safe Links Protection Disabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-006 | Safe Attachments Protection Disabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-007 | Anti-Phishing Controls Are Not Fully Enabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-008 | Email Threat Detection/Containment Rate Is Below Target | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-014 | FIDO2 / Passkey Authentication Not Enabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Security-002 | Failed and Risky Sign-In Volume Exceeds Baseline | High | check_circle | check_circle | check_circle | check_circle | — |
| Governance-002 | Privileged High-Risk Administrative Operations Require Review | High | check_circle | check_circle | check_circle | check_circle | — |
| DataProtection-010 | SharePoint External Sharing Is Enabled on Collaboration Sites | High | check_circle | check_circle | check_circle | check_circle | — |
| Governance-003 | Secure Score Recommendation Backlog Is Accumulating | High | check_circle | check_circle | check_circle | check_circle | — |
| Application-006 | Third-Party Application Consents Include Elevated-Risk Integrations | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-017 | Strong Authentication Method Adoption Is Below Target | High | check_circle | check_circle | check_circle | check_circle | — |
| Security-003 | Threat Pulse Indicates Elevated Active Alert Backlog | High | check_circle | check_circle | check_circle | check_circle | — |
| Infrastructure-001 | Network Security Groups Allow Unrestricted Inbound Access | High | check_circle | check_circle | check_circle | check_circle | — |
| Infrastructure-002 | Storage Accounts Allow Public Blob Access | High | check_circle | check_circle | check_circle | check_circle | — |
| Vulnerability-001 | Security Configuration Gaps Require Remediation | High | check_circle | check_circle | check_circle | check_circle | — |
| Vulnerability-002 | High-Severity Vulnerabilities Require Short-Term Remediation | High | check_circle | check_circle | check_circle | check_circle | — |
| Cost-001 | Orphaned Cloud Resources Incurring Waste | High | check_circle | check_circle | check_circle | check_circle | — |
| ActiveDirectory-003 | AD: Privileged Admin Footprint Controlled | High | check_circle | check_circle | check_circle | check_circle | — |
| ActiveDirectory-006 | AD: LDAP Signing/Channel Binding Gap | High | check_circle | check_circle | check_circle | check_circle | — |
| OnPremInfra-ONPREM-FW-003 | On-Prem: RDP Exposed Broadly Across Networks | High | — | check_circle | — | — | check_circle |
| OnPremInfra-ONPREM-NET-001 | On-Prem: High-Risk Listening Ports Exposed | High | — | check_circle | — | — | check_circle |
| OnPremInfra-ONPREM-EP-005 | On-Prem: Windows Update Not Configured or Current | High | — | check_circle | — | — | check_circle |
| OnPremInfra-ONPREM-CERT-001 | On-Prem: Certificates Expiring Within 30 Days | High | — | check_circle | — | — | check_circle |
| OnPremInfra-ONPREM-AD-011 | On-Prem: Password Policy Below Minimum Strength | High | — | check_circle | — | — | check_circle |
| Identity-025 | Too Many Global Administrators | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-026 | PIM Not Utilized for Privileged Roles | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-027 | Legacy Authentication Sign-Ins Detected | High | check_circle | check_circle | check_circle | check_circle | — |
| Device-010 | Managed Devices Missing Disk Encryption | High | check_circle | check_circle | check_circle | check_circle | — |
| Device-013 | No Device Compliance Policies Defined | High | check_circle | check_circle | check_circle | check_circle | — |
| Device-016 | High Endpoint Vulnerability Backlog | High | check_circle | check_circle | check_circle | check_circle | — |
| DataProtection-013 | No DLP Policies Configured | High | check_circle | check_circle | check_circle | check_circle | — |
| DataProtection-017 | Excessive Third-Party App Permissions | High | check_circle | check_circle | check_circle | check_circle | — |
| Network-013 | Sensitive Email Encryption Not Enabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-009 | External Email Forwarding Rules Detected | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-012 | No Outbound Spam Policy Enabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-013 | Mail Flow Rules Bypass Security Filtering | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-014 | Auto-Forward to External Addresses Detected | High | check_circle | check_circle | check_circle | check_circle | — |
| Email-016 | Multiple Domains Without DMARC | High | check_circle | check_circle | check_circle | check_circle | — |
| Endpoint-007 | Managed Devices Missing BitLocker or Device Encryption | High | check_circle | check_circle | check_circle | check_circle | — |
| Endpoint-011 | Defender Tamper Protection Disabled | High | check_circle | check_circle | check_circle | check_circle | — |
| Endpoint-013 | Unsupported Operating Systems in Managed Fleet | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-018 | Privileged Identity Management Not Protecting Admin Roles | High | check_circle | check_circle | check_circle | check_circle | — |
| Identity-020 | Risky Sign-Ins Not Investigated | High | check_circle | check_circle | check_circle | check_circle | — |
Appendix
Assessment Method and Input Coverage
Secondary reference material for assessability rules, input coverage, and existing POA&M items.
expand_more
Appendix
Assessment Method and Input Coverage
Secondary reference material for assessability rules, input coverage, and existing POA&M items.
Status Model
Implemented
Evidence supports implementation of the requirement.
In Progress
Some implementation exists, but proof or execution gaps remain.
Not Implemented
Evidence shows the requirement is not currently met.
Not Assessed
Evidence was not sufficient to determine implementation.
Assessment Gap Reasons
License gap
Required licensing or product capability was not available for collection.
Consent missing
Tenant consent or connector authorization blocked automated collection.
Collection failure
Automated collection failed or returned unusable results.
Manual review required
This requirement depends on document or interview evidence, not just telemetry.
Out of scope
The source input is not applicable to the scoped environment.
Collection gap
No live collection or usable manual artifact was available for this input.
Assessment Inputs
| Dataset | State | Reason | Last Collected |
|---|---|---|---|
| access_review_summary | Gap | Collection gap | — |
| pim_role_settings | Assessed | Assessed | — |
| directory_roles | Assessed | Assessed | — |
| terms_of_use_summary | Gap | Collection gap | — |
| lifecycle_summary | Gap | Collection gap | — |
| sharepoint_sharing_settings | Gap | Collection gap | — |
| teams_policies | Assessed | Assessed | — |
| bitlocker_recovery_keys | Gap | Collection gap | — |
| records_management | Assessed | Assessed | — |
| retention_policies | Assessed | Assessed | — |
| data_governance_summary | Gap | Collection gap | — |
| risk_detection_summary | Gap | Collection gap | — |
| entra_recommendations | Gap | Collection gap | — |
| ca_whatif_results | Gap | Collection gap | — |
| arm_network_nsgs | Assessed | Assessed | — |
| arm_storage_accounts | Assessed | Assessed | — |
| arm_key_vaults | Assessed | Assessed | — |
| arm_sql_servers | Assessed | Assessed | — |
Existing POA&M Items
| ID | Weakness | Milestone |
|---|---|---|
| AC.L2-3.1.6 | Non-Privileged Account Use | 180 days |
| SC.L2-3.13.2 | Security Engineering | 180 days |
| AU.L2-3.3.4 | Audit Failure Alerting | 180 days |
| CM.L2-3.4.5 | Access Restrictions for Change | 180 days |
Skip to main contentRetry Purview collectionResolve Network Security coverage Collection sources54 collected · 0 partial Permissions exercised2121 granted · 0 denied Telemetry coverage77 observed · 0 inferred
⚠Synthetic demo dataFindings, identities, controls and metrics are fictional. Do not treat values as a real assessment or extract names or domains.
Polaris·Security Assessment · § 04 Technical Evidence
Contoso Defense Systems
MANIFESTManifest-only bundle. Provenance is reviewable; per-artifact signatures are not embedded.
Generated May 15, 2026, 7:34 PM ET · trailing 30d
manifest only
§ 04 · Technical Evidence · Evidence Bundle
165 evidence envelopes, manifest verified · manifest-only provenance.
bundle · 20260515T233445Z_ad-hoc
run · 20260515T233445Z_ad-hoc · window — → May 15, 2026
run · 20260515T233445Z_ad-hoc · window — → May 15, 2026
Manifest root · SHA-256Manifest hash not embedded
SignerPolaris Platformkey not embedded
SignedManifest onlyDetached signature not embedded
Envelopes165from 5 collectors
Bundle size—deterministic
SignatureUnavailableNo embedded signature
Key fingerprint—public key
§ 04.1
Integrity
five dimensions of bundle integrity✓
Manifest verified
165 / 165 envelope hashes match
✓
Collectors pinned
5 / 5 at pinned versions
✓
Chain intact
collect → normalize → hash → bundle → sign → publish
✕
Bundle signature
Detached signature not embedded
✕
Collection gap
5 collectors failed output · envelopes not received
§ 04.2
Verify it yourself
The bundle is a signed, deterministic artifact. Any reviewer can reproduce the manifest root offline and compare the signature against the — printed in the masthead of every page. No Polaris backend required.
# verify-it-yourself · bundle signature + manifest integrity
polaris verify ./polaris-20260515T233445Z_ad-hoc.tar.zst \
--pubkey polaris-signing.pub \
--expect-sig —
# expected output
[ok] signature verified
[ok] manifest_root match
[ok] envelopes 165 / 165 hashes match
[ok] collectors 5 / 5 at pinned versions
[ok] chain_of_custody collect → normalize → hash → bundle → sign → publishPublic signing key
—
Notary receipt
—
Reproducibility
deterministic manifest hashing · re-bundle of same inputs produces byte-identical output
§ 04.1b
Improve report coverage
2 coverage items · highest severity: mediumCoverage unlock ledger
2 gapsAPI error - Polaris retry
Purview retention labels
What is incompleteRetention label evidence may be incomplete because the retention labels API returned an error.
Retry Purview retention labels, then handle Records Management consent if needed
This is not an Azure Reader issue. Microsoft Graph lists Purview retention labels through a delegated Records Management permission path. Polaris should retry first; if Microsoft still returns an authorization error, the customer Purview or records-management admin must approve RecordsManagement.Read.All for the delegated collection path.
OwnerPolaris first; customer Entra or Purview records-management admin if authorization is missing
Access/artifact neededMicrosoft Graph delegated RecordsManagement.Read.All for retention label reads
Customer actionIf the retry still fails with authorization, approve the delegated Records Management read path.
Polaris actionRetry the endpoint and show the exact Microsoft status code/message if it still fails.
- Rerun the Purview retention-label collector.
- If the endpoint still errors, record the Microsoft status code and message in Technical Evidence.
- If the error is authorization-related, request delegated RecordsManagement.Read.All approval from the customer's Purview or Entra admin.
After rerunUnlocked after rerun: retention-label evidence in Data Protection, Compliance Matrix, and Technical Evidence.
Microsoft lists this endpoint as delegated-only for work or school accounts. It is not fixed by Azure RBAC Reader.
Unlocks after rerunData Protection, Compliance Matrix, Technical Evidence
Technical source: Microsoft Graph / security labels retentionLabels
1 metric · 3 sections
Evidence not provided
Network Security
What is incompleteNetwork Security coverage is 0%. This means the report is missing evidence for that domain; it is not a clean result.
Confirm whether network security is in scope
Network Security is either not in scope yet or missing the source needed to assess it. Do not read 0% coverage as a clean network result.
OwnerCustomer Azure/network admin with Polaris support
Access/artifact neededAzure RBAC Reader for cloud network inventory, or firewall/network evidence for non-Azure scope
Customer actionEither mark Network Security out of scope with a reason, or grant/provide the network evidence source.
Polaris actionIf in scope, rerun Azure Resource Graph or ingest the network evidence and link it to findings.
- Decide whether cloud and/or on-prem network security belongs in this assessment.
- For Azure network evidence, assign Azure RBAC Reader to Polaris on each subscription.
- For non-Azure network evidence, upload firewall, segmentation, or network-control exports.
- If excluded, document the out-of-scope reason so the report does not imply a clean result.
After rerunUnlocked after rerun: NSG, public exposure, firewall, segmentation, and network-control evidence.
Out of scope is acceptable when intentional. Missing source data should be fixed or explicitly excluded.
Unlocks after rerunNetwork Security
Technical source: data_quality_by_domain
1 metric · 1 section
§ 04.3
Collection provenance
Paths, permissions, and measured source confidenceCollection provenance
These cards explain what fed the report, which permissions constrained collection, and how much of the evidence is directly observed versus inferred.
Collection sources
5 paths · 4 collected · 0 partialCISA ScubaGear CollectorNot CollectedMicrosoft 365 baseline hardening findings and federal-baseline appendix material · No Scuba baseline upload was detected in this run.
Method Upload `Invoke-ScubaGearCollector.ps1` output
Coverage Microsoft 365 baseline hardening findings and federal-baseline appendix material
Feeds Findings · Measurement Map · Federal Baseline appendix (Word)
Next action Run ScubaGear if you need Microsoft 365 baseline policy proof beyond native Graph coverage.
Azure Resource Manager (Reader RBAC)CollectedAzure infrastructure · exposure · key vault · ARM collection not enabled
Method Automatic after Azure RBAC Reader is granted on each subscription
Coverage Azure infrastructure, exposure, key vault, SQL, backup, and recovery posture
Feeds Azure Infrastructure and ARM Coverage · Coverage Unlock Matrix · Measurement Map
Next action Keep subscription Reader scope current and validate accessible subscriptions before release.
Microsoft Graph APICollectedIdentity · endpoint · collaboration · 21/21 endpoint checks returned cloud telemetry.
Method Automatic after Graph admin consent
Coverage Identity, endpoint, collaboration, security, and permission telemetry
Feeds Overview KPIs · Findings · Measurement Map · Permission Collection Status · Coverage Unlock Matrix
Next action Use as the primary cloud evidence lane for this report.
On-Prem AD CollectorCollectedTier-0 groups · LDAP signing · NTLM · 0 on-prem AD coverage items landed in the dedicated AD/Tier-0 path.
Method Upload `Invoke-ADOnPremCollector.ps1` output
Coverage Tier-0 groups, LDAP signing, NTLM, trusts, ACLs, and on-prem AD hygiene
Feeds On-Prem Active Directory Assessment · Tier-0 Privileged Groups · Coverage Unlock Matrix · Measurement Map
Next action Treat this as the authoritative lane for the dedicated on-prem AD report sections.
PowerShell Security Collection UploadCollectedAD · firewall · endpoint · 24 evidence-backed controls across 14 evidence domains.
Method Upload `Invoke-SecurityCollection.ps1` output
Coverage AD, firewall, endpoint, audit, backup, and certificate evidence for compliance scoring
Feeds CMMC Evidence Snapshot · Evidence Summary · Coverage Unlock Matrix · Measurement Map
Next action Use this lane for evidence-backed compliance coverage, not for dedicated AD narrative sections.
Permission Collection Status21 / 21 granted0 denied · 0 partial · all granted endpoints pulled
Expand to inspect the full per-endpoint grid (21 rows)
| Endpoint | Permission | Domain | Status |
|---|---|---|---|
| Device Compliance | DeviceManagementManagedDevices.Read.All | Endpoint | granted_and_pulled |
| Risky Users | IdentityRiskyUser.Read.All | Identity | granted_and_pulled |
| Conditional Access | Policy.Read.All | Identity | granted_and_pulled |
| Backup Health | Reader (ARM) | Infrastructure | granted_and_pulled |
| Backup Jobs | Reader (ARM) | Infrastructure | granted_and_pulled |
| Backup Vaults | Reader (ARM) | Infrastructure | granted_and_pulled |
| Key Vaults | Reader (ARM) | Infrastructure | granted_and_pulled |
| Network Security Groups | Reader (ARM) | Network | granted_and_pulled |
| Recovery Readiness | Reader (ARM) | Infrastructure | granted_and_pulled |
| SQL Servers | Reader (ARM) | Infrastructure | granted_and_pulled |
| Storage Accounts | Reader (ARM) | Infrastructure | granted_and_pulled |
| MFA Coverage | Reports.Read.All | Identity | granted_and_pulled |
| Privileged Accounts | RoleManagement.Read.All | Identity | granted_and_pulled |
| Secure Score | SecurityEvents.Read.All | Security | granted_and_pulled |
| Secure Score Controls | SecurityEvents.Read.All | Security | granted_and_pulled |
| Security Alerts | SecurityEvents.Read.All | Security | granted_and_pulled |
| Vulnerability Assessment | SecurityEvents.Read.All | Vulnerability Management | granted_and_pulled |
| Defender TVM Recommendations | SecurityRecommendation.Read.All (WindowsDefenderATP) | Vulnerability Management | granted_and_pulled |
| Defender Software Inventory | Software.Read.All (WindowsDefenderATP) | Vulnerability Management | granted_and_pulled |
| User Summary | User.Read.All | Identity | granted_and_pulled |
| Defender TVM Vulnerabilities | Vulnerability.Read.All (WindowsDefenderATP) | Vulnerability Management | granted_and_pulled |
Telemetry coverage
7 metrics · 7 observed · 0 inferred| Metric | Source | Permission | Confidence |
|---|---|---|---|
| — | Microsoft Graph Reports | Reports.Read.All | OBSERVED |
| — | Microsoft Graph Reports | Reports.Read.All | OBSERVED |
| — | Microsoft Graph Policies | Policy.Read.All | OBSERVED |
| — | Microsoft Graph Conditional Access | Policy.Read.All | OBSERVED |
| — | Identity Protection | IdentityRiskEvent.Read.All | OBSERVED |
| — | Microsoft Defender Secure Score | SecurityEvents.Read.All | OBSERVED |
| — | Microsoft Intune | DeviceManagementManagedDevices.Read.All | OBSERVED |
Chain of custody
collect → normalize → hash → bundle → sign → publish
1
Collect
raw queries to source APIs + agents
—
collector fleet · raw payloads
2
Normalize
map to polaris-schema
—
envelopes produced
3
Hash
sha-256 per envelope · canonical JSON
—
leaf hashes → merkle root
4
Bundle
deterministic frame · manifest + payloads
—
manifest assembled
5
Sign
HMAC/ed25519 over manifest root
—·—·—
unsigned · halt
6
Publish
append-only object store
—
receipt recorded
§ 04.4
Collector fleet
5 modules · pinned version and runtime output shown separately| Collector | Scope | Host | Runtime | Records | Module hash | Status |
|---|---|---|---|---|---|---|
| network.topologyv1.0.0 | on-prem | DAL-DC01.corp.contoso.local | 0.0s | 31 | — | failed output |
| ad.tier_0v1.0.0 | on-prem | DAL-DC01.corp.contoso.local | 0.0s | 6 | — | failed output |
| ad.attack_pathv1.0.0 | on-prem | DAL-DC01.corp.contoso.local | 0.0s | 24 | — | failed output |
| adcs.pkiv1.0.0 | on-prem | DAL-CA01.corp.contoso.local | 0.0s | 10 | — | failed output |
| gpo.securityv1.0.0 | on-prem | DAL-DC01.corp.contoso.local | 0.0s | 7 | — | failed output |
0 verified5 failed output78 records0.0s total runtime
§ 04.5
Envelope stream
Showing 6 of 12 · click to expand payloadShowing 6 of 12
Collection gap reflected in §04.1 integrity · affected envelopes were not received
otherartifact_manifest · collectedhash f8ad9f06ef77f8646bc9a079e6f39e9c24ed0392529ea94a3fbe78042f2d23baMay 15, 23:34▾ hide
payload · 109 bytesother
artifact: On-Prem: Windows Firewall Disabled on One or More Profiles.txt type: collected bytes: 0 sha256: —
Envelope hash
f8ad9f06ef77f8646bc9a079e6f39e9c24ed0392529ea94a3fbe78042f2d23ba
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 0e7b601962ccae8da856694f515f0b2319e5a982a1d21922df99c57fd60dbb0bMay 15, 23:34▶ show
payload · 102 bytesother
artifact: Critical Security Configuration Gaps Require Action.txt type: collected bytes: 0 sha256: —
Envelope hash
0e7b601962ccae8da856694f515f0b2319e5a982a1d21922df99c57fd60dbb0b
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 122363e7ddb94a9c35014107c591fbfc10f7df54432ad3959a07def6be4bf7eaMay 15, 23:34▶ show
payload · 86 bytesother
artifact: NSG Rules Allow All Inbound Traffic.txt type: collected bytes: 0 sha256: —
Envelope hash
122363e7ddb94a9c35014107c591fbfc10f7df54432ad3959a07def6be4bf7ea
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 0c25378937e972a4499004deb945b9c044957bc61d418ece01410e3360781ecbMay 15, 23:34▶ show
payload · 86 bytesother
artifact: Legacy Authentication Still Allowed.txt type: collected bytes: 0 sha256: —
Envelope hash
0c25378937e972a4499004deb945b9c044957bc61d418ece01410e3360781ecb
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash deecd0a84d2d8c1517d7ea70a348d2d77bef9434a3036a3df189e18efda37d2bMay 15, 23:34▶ show
payload · 85 bytesother
artifact: 40 Users Not Covered by MFA Policy.txt type: collected bytes: 0 sha256: —
Envelope hash
deecd0a84d2d8c1517d7ea70a348d2d77bef9434a3036a3df189e18efda37d2b
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 76009adabff43655322f26ac4d9c90cdf7232e535f35800c3cf0e479121e5bbbMay 15, 23:34▶ show
payload · 85 bytesother
artifact: 2 High-Risk User Accounts Detected.txt type: collected bytes: 0 sha256: —
Envelope hash
76009adabff43655322f26ac4d9c90cdf7232e535f35800c3cf0e479121e5bbb
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 59705735513052caebce05999c1c0ae0b2717715bdfd4a5f7b55f9508c7f1285May 15, 23:34▶ show
payload · 94 bytesother
artifact: 3 Active Security Alerts (2 High, 1 Medium).txt type: collected bytes: 0 sha256: —
Envelope hash
59705735513052caebce05999c1c0ae0b2717715bdfd4a5f7b55f9508c7f1285
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 4cbddeba5b9173c3c331e84a9488f3ed390bfa745a51a82bc805e9ddcabde138May 15, 23:34▶ show
payload · 81 bytesother
artifact: Safe Links Protection Disabled.txt type: collected bytes: 0 sha256: —
Envelope hash
4cbddeba5b9173c3c331e84a9488f3ed390bfa745a51a82bc805e9ddcabde138
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash e93b254b5e57fe0f6c8015420edea2170291fc460135ef9e4eb33017abec4a2eMay 15, 23:34▶ show
payload · 87 bytesother
artifact: Safe Attachments Protection Disabled.txt type: collected bytes: 0 sha256: —
Envelope hash
e93b254b5e57fe0f6c8015420edea2170291fc460135ef9e4eb33017abec4a2e
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash ee6a03240d7dc53ad89f3a481c6bf45e5fc71107b335db9c9b06babc8b5d2059May 15, 23:34▶ show
payload · 95 bytesother
artifact: Anti-Phishing Controls Are Not Fully Enabled.txt type: collected bytes: 0 sha256: —
Envelope hash
ee6a03240d7dc53ad89f3a481c6bf45e5fc71107b335db9c9b06babc8b5d2059
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 5d8331871f67e3885c62a2dcc58f7ae60319476b69016d225b3fb1fd8ed6fabdMay 15, 23:34▶ show
payload · 106 bytesother
artifact: Email Threat Detection/Containment Rate Is Below Target.txt type: collected bytes: 0 sha256: —
Envelope hash
5d8331871f67e3885c62a2dcc58f7ae60319476b69016d225b3fb1fd8ed6fabd
Source
collected
Supports findings
no findings · reference material
otherartifact_manifest · collectedhash 823d4e7463616925b3f5a03e451eb82a805ecda7e6c1554f4a4087d38033507dMay 15, 23:34▶ show
payload · 93 bytesother
artifact: FIDO2 / Passkey Authentication Not Enabled.txt type: collected bytes: 0 sha256: —
Envelope hash
823d4e7463616925b3f5a03e451eb82a805ecda7e6c1554f4a4087d38033507d
Source
collected
Supports findings
no findings · reference material
§ 04.6
Artifact manifest
80 artifacts · manifest-only modeManifest-only bundle80 artifacts in this bundlePer-artifact hashes and byte sizes are not embedded; verify the manifest root and custody chain above.
§ 04.7
Visual evidence
Browser screenshot gallery not included in this artifact setBrowser screenshots were not packaged with this run. The report content above remains valid; this artifact set simply does not include a screenshot gallery.
network.topology—ad.tier_0—ad.attack_path—adcs.pki—gpo.security—artifact-01f8ad9f06ef77f8646bc9a079e6f39e9c24ed0392529ea94a3fbe78042f2d23baartifact-020e7b601962ccae8da856694f515f0b2319e5a982a1d21922df99c57fd60dbb0bartifact-03122363e7ddb94a9c35014107c591fbfc10f7df54432ad3959a07def6be4bf7eaartifact-040c25378937e972a4499004deb945b9c044957bc61d418ece01410e3360781ecbartifact-05deecd0a84d2d8c1517d7ea70a348d2d77bef9434a3036a3df189e18efda37d2bartifact-0676009adabff43655322f26ac4d9c90cdf7232e535f35800c3cf0e479121e5bbbartifact-0759705735513052caebce05999c1c0ae0b2717715bdfd4a5f7b55f9508c7f1285artifact-084cbddeba5b9173c3c331e84a9488f3ed390bfa745a51a82bc805e9ddcabde138artifact-09e93b254b5e57fe0f6c8015420edea2170291fc460135ef9e4eb33017abec4a2eartifact-10ee6a03240d7dc53ad89f3a481c6bf45e5fc71107b335db9c9b06babc8b5d2059artifact-115d8331871f67e3885c62a2dcc58f7ae60319476b69016d225b3fb1fd8ed6fabdartifact-12823d4e7463616925b3f5a03e451eb82a805ecda7e6c1554f4a4087d38033507d————————————————————————————————————————————————————————————————————————————————
Tenant Identity and Consent Completeness
Technical Evidence
Use this workspace to verify tenant identity, consent completeness, and the current telemetry baseline before digging into the detailed evidence sections below.
scheduleMay 15, 2026 23:34 UTC
Tenant Name
Contoso Defense Systems
Tenant ID
a1b2c3d4-e5f6-7890-abcd-ef1234567890
Consent Completeness
Consent completeness: Complete (11/11 report-scope permissions granted and collected).
admin_panel_settingsopen_in_newRe-authorize in Azure
Coverage Unlock
Expand Assessment Coverage
Grant additional Microsoft 365 permissions to unlock more data sources and deeper analysis.
Deeper app-risk coverage
Full auth-method detail
More Exchange telemetry
Fewer evidence gaps
Tenant Baseline
Tenant Overview
This baseline should orient the rest of the evidence tab.
group
Total Users
150
admin_panel_settings
Admins
7
devices
Managed Devices
150
shield
Secure Score
56.7%
verified_user
MFA Coverage
94.0%
dns
Verified Domains
3
MFA Coverage Detail
User MFA
94.0%
Admin MFA
100.0%
Users With MFA
0
Users Without MFA
0
Collection Health
Total Endpoints
49
Successful
49
Failed
0
| Endpoint | Status | Objects | Permission |
|---|---|---|---|
| Secure Score | Collected | — | SecurityEvents.Read.All |
| MFA Coverage | Collected | — | Reports.Read.All |
| Risky Users | Collected | — | IdentityRiskyUser.Read.All |
| Privileged Accounts | Collected | — | RoleManagement.Read.All |
| Conditional Access | Collected | — | Policy.Read.All |
| Device Compliance | Collected | — | DeviceManagementManagedDevices.Read.All |
| Security Alerts | Collected | — | SecurityEvents.Read.All |
| User Summary | Collected | — | User.Read.All |
| Secure Score Controls | Collected | — | SecurityEvents.Read.All |
| Network Security Groups | Collected | — | Reader (ARM) |
| Storage Accounts | Collected | — | Reader (ARM) |
| Key Vaults | Collected | — | Reader (ARM) |
| SQL Servers | Collected | — | Reader (ARM) |
| Backup Health | Collected | — | Reader (ARM) |
| Backup Vaults | Collected | — | Reader (ARM) |
| Backup Jobs | Collected | — | Reader (ARM) |
| Recovery Readiness | Collected | — | Reader (ARM) |
| Vulnerability Assessment | Collected | — | SecurityEvents.Read.All |
| Defender TVM Vulnerabilities | Collected | — | Vulnerability.Read.All (WindowsDefenderATP) |
| Defender TVM Recommendations | Collected | — | SecurityRecommendation.Read.All (WindowsDefenderATP) |
| Defender Software Inventory | Collected | — | Software.Read.All (WindowsDefenderATP) |
Data Collection Paths and Landing Zones
Collection Paths
5
Collected
4
Partial
0
Not Collected
1
This is the direct operator answer to "where does the data go?" Each collection lane lists the report sections it feeds and the next action needed to improve coverage.
Collected
Microsoft Graph API
Automatic after Graph admin consent
What It Feeds
Identity, endpoint, collaboration, security, and permission telemetry
21/21 endpoint checks returned cloud telemetry.
Report Sections
- Overview KPIs
- Findings
- Measurement Map
- Permission Collection Status
- Coverage Unlock Matrix
Next Action
Use as the primary cloud evidence lane for this report.
Collected
Azure Resource Manager (Reader RBAC)
Automatic after Azure RBAC Reader is granted on each subscription
What It Feeds
Azure infrastructure, exposure, key vault, SQL, backup, and recovery posture
ARM collection not enabled
Report Sections
- Azure Infrastructure and ARM Coverage
- Coverage Unlock Matrix
- Measurement Map
Next Action
Keep subscription Reader scope current and validate accessible subscriptions before release.
Collected
PowerShell Security Collection Upload
Upload `Invoke-SecurityCollection.ps1` output
Modules: ActiveDirectory, NetworkFirewall, EndpointSecurity, AuditConfig, BackupStatus, CertificateStore
What It Feeds
AD, firewall, endpoint, audit, backup, and certificate evidence for compliance scoring
24 evidence-backed controls across 14 evidence domains.
Report Sections
- CMMC Evidence Snapshot
- Evidence Summary
- Coverage Unlock Matrix
- Measurement Map
Next Action
Use this lane for evidence-backed compliance coverage, not for dedicated AD narrative sections.
Collected
On-Prem AD Collector
Upload `Invoke-ADOnPremCollector.ps1` output
What It Feeds
Tier-0 groups, LDAP signing, NTLM, trusts, ACLs, and on-prem AD hygiene
0 on-prem AD coverage items landed in the dedicated AD/Tier-0 path.
Report Sections
- On-Prem Active Directory Assessment
- Tier-0 Privileged Groups
- Coverage Unlock Matrix
- Measurement Map
Next Action
Treat this as the authoritative lane for the dedicated on-prem AD report sections.
Not Collected
CISA ScubaGear Collector
Upload `Invoke-ScubaGearCollector.ps1` output
What It Feeds
Microsoft 365 baseline hardening findings and federal-baseline appendix material
No Scuba baseline upload was detected in this run.
Report Sections
- Findings
- Measurement Map
- Federal Baseline appendix (Word)
Next Action
Run ScubaGear if you need Microsoft 365 baseline policy proof beyond native Graph coverage.
Azure Infrastructure and ARM Coverage
Subscription scope, infrastructure coverage, and recovery evidence stay separate here so Azure posture is not overstated.
ARM Access Model
Azure RBAC on each customer subscription is required before infrastructure posture can be treated as complete.
Required Role
Reader
Accessible Subscriptions
0
Collection Failures
0
Subscriptions
0
NSGs
1
Storage
1
Key Vaults
1
Public IPs
2
ARM collection not enabled
ARM Subscription Scope
| Subscription | Subscription ID | State |
|---|---|---|
| No Azure subscriptions were enumerated in this run. Grant Reader on each target subscription before treating Azure posture as complete. | ||
ARM Security Summary
Is LiveTrue
Statusnot_assessed
Network Security Groups
| Name | Resource Group | Rules Count |
|---|---|---|
| nsg-edge-westus2 | — | — |
Key Vaults
| Name | Resource Group | SKU |
|---|---|---|
| kv-prod | — | — |
SQL Servers
| Name | Resource Group | State |
|---|---|---|
| sql-prod | — | — |
Storage Accounts
| Name | Resource Group | Kind |
|---|---|---|
| stapp01 | — | — |
Public IPs
| Name | IP Address | Allocation |
|---|---|---|
| — | 52.160.14.27 | — |
| — | 20.45.71.11 | — |
Backup Vaults
| Name | Resource Group | Type |
|---|---|---|
| contoso-rsv-prod-eastus | rg-backup-prod | — |
| contoso-rsv-dr-westus | rg-backup-dr | — |
Backup Jobs
| Name | Status | Start Time |
|---|---|---|
| — | Completed | 2026-05-15T20:09:51.299207+00:00 |
| — | Completed | 2026-05-15T19:29:51.299207+00:00 |
| — | Completed | 2026-05-15T18:24:51.299207+00:00 |
Recovery Readiness
Is LiveTrue
Overall Statushealthy
Rto Target Hours24
Rto Actual Hours8
Rpo Target Hours4
Rpo Actual Hours1
Rto Statushealthy
Rpo Statushealthy
Device Inventory
devices
Device Compliance
150 managed devices
96.7%
Total
150
Compliant
145
Non-Compliant
4
Device Inventory Detail
| Device | OS | Status |
|---|---|---|
| — | Windows | — |
| — | macOS | — |
| — | iOS | — |
| — | Total | — |
Privileged Accounts
No data collected for Privileged Accounts.
Conditional Access Policies
Total Policies
12
Enforced
0
Report Only
0
Disabled
0
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
Unnamed PolicyEnforced
On-Prem Active Directory Assessment
Domain
—
AD Score
0.0
Domain Controllers
DC-01 (Windows Server 2022, current)DC-02 (Windows Server 2019, 1 update pending)
Tier 0 Groups
Domain Admins (4)Enterprise Admins (2)Schema Admins (1)Administrators (6)Account Operators (0)Backup Operators (2)Server Operators (0)
| Control | Status | Severity |
|---|---|---|
| AD Connect Sync Healthy | Pass | High |
| Legacy Authentication Active | Fail | High |
| Privileged Admin Footprint Controlled | Partial | Medium |
| Brute-Force Activity Monitored | Pass | High |
| Risky Sign-In Pressure Controlled | Pass | Medium |
| LDAP Signing/Channel Binding Gap | Fail | High |
| NTLMv1 Disabled | Pass | Medium |
| Domain Controller Patch Baseline Gap | Partial | High |
Forest Topology
Static map of the on-prem Active Directory forest assembled from the PowerShell collector bundles. Sites sit on the top band, domain controllers below them, certificate authorities across the bottom. Crimson halos mark nodes carrying open findings; a gold ring marks Global Catalog DCs; dashed crimson arcs flag trusts with SID filtering disabled.
View the interactive tactical map →Sites
4
Domain Controllers
9
Certificate Authorities
2
Trusts
4
Findings
25
SiteDomain ControllerCertificate AuthorityGlobal Catalog ringFinding haloUnsafe trust (SID filtering off)
Risky Users
Total Risky
0
High Risk
0
Medium Risk
0
| User | Risk Level | Detail |
|---|---|---|
| Marcus Williams | High | — |
| Jennifer Park | High | — |
| Emily Rodriguez | Medium | — |
| James Okafor | Medium | — |
| Rachel Kim | Medium | — |
| Thomas Bergstrom | Low | — |
Guest Users
person_add
External Guest Summary
Total Guests
30
Inactive Guests
0
Dataset Actionability Matrix
Assessed
29/41
Not Assessed
8
Not Consented
4
| Dataset Key | Dataset Name | Domain | Status | Next Action |
|---|---|---|---|---|
| oauth_grants_summary | OAuth Permission Grants | Identity / Apps | Assessed | Review findings |
| oauth_risk | OAuth App Permissions | Identity / Apps | Assessed | Review findings |
| log_analytics_summary | Log Analytics / Sentinel | Monitoring | Assessed | Review findings |
| service_principal_summary | Service Principal Audit | Identity / Apps | Assessed | Review findings |
| sharepoint_sites | SharePoint Sites (Raw) | Collaboration / Data | Assessed | Review findings |
| sharepoint_summary | SharePoint Summary | Collaboration / Data | Assessed | Review findings |
| sharepoint_sharing_settings | SharePoint Sharing Settings | Collaboration / Data | Not Consented | Grant consent |
| teams_inventory_summary | Teams Inventory | Collaboration | Assessed | Review findings |
| teams_summary | Teams Summary | Collaboration | Assessed | Review findings |
| named_locations_summary | Named Locations | Identity | Assessed | Review findings |
| sign_in_summary | Sign-In Analysis | Identity | Assessed | Review findings |
| retention_policies | Retention Policies | Data Protection | Assessed | Review findings |
| admin_operations_summary | High-Risk Admin Operations | Monitoring | Assessed | Review findings |
| high_risk_operations | High-Risk Operations Timeline | Monitoring | Assessed | Review findings |
| arm_public_ips | ARM Public IP Inventory | Infrastructure | Assessed | Review findings |
| configuration_status | Assessment Configuration Health | Platform | Not Assessed | Enable collection |
| secure_score_recommendations | Secure Score Recommendations | Security | Assessed | Review findings |
| vulnerability_data | Vulnerability Evidence (Detailed) | Endpoint | Assessed | Review findings |
| vulnerability_summary | Vulnerability Summary | Endpoint | Assessed | Review findings |
| guest_users_list | Guest Users | Identity / Collaboration | Assessed | Review findings |
| backup_health | Backup Security Posture | Resilience | Assessed | Review findings |
| backup_jobs | Backup Jobs | Resilience | Assessed | Review findings |
| backup_vaults | Backup Vaults | Resilience | Assessed | Review findings |
| recovery_readiness | Recovery Readiness | Resilience | Assessed | Review findings |
| bitlocker_recovery_keys | BitLocker Recovery Key Coverage | Endpoint | Not Consented | Grant consent |
| exchange_transport_rules | Exchange Transport Rules | Not Consented | Grant consent | |
| intune_app_protection | Intune App Protection | Endpoint | Assessed | Review findings |
| managed_app_policies | Managed App Policies | Endpoint | Assessed | Review findings |
| pim_role_settings | PIM Role Settings | Identity | Assessed | Review findings |
| teams_policies | Teams Policies | Collaboration | Assessed | Review findings |
| defender_tvm_detail | Defender TVM — CVE Detail | Vulnerability | Not Assessed | Enable collection |
| attack_simulation_campaigns | Attack Simulation Campaigns | Awareness | Not Assessed | Enable collection |
| auth_methods_policy | Authentication Methods Policy | Identity | Assessed | Review findings |
| device_posture_rollup | Device Posture Rollup | Endpoint | Assessed | Review findings |
| purview_labels | Purview Sensitivity Labels | Data Protection | Not Assessed | Enable collection |
| purview_policies | Purview DLP Policies | Data Protection | Not Assessed | Enable collection |
| accesspackage_summary | Entra Access Package Summary | Identity Governance | Not Assessed | Enable collection |
| entitlement_reviews | Entitlement Reviews | Identity Governance | Not Assessed | Enable collection |
| entra_recommendations | Entra Recommendations | Identity | Not Consented | Grant consent |
| lifecycle_summary_deep | Entra Lifecycle Workflows — Detail | Identity Governance | Not Assessed | Enable collection |
| onprem_operations | On-Prem Operations (Collector Bundles) | On-Prem Infrastructure | Assessed | Review findings |
Security Feature Scorecard
No data collected for Security Feature Scorecard.
Coverage Unlock Matrix
All permissions are granted. No coverage gaps detected.
Permission Collection Status
Granted
21
Not Granted
0
| Endpoint | Permission | Status | Domain |
|---|---|---|---|
| Device Compliance | DeviceManagementManagedDevices.Read.All | Granted + Pulled | Endpoint |
| Risky Users | IdentityRiskyUser.Read.All | Granted + Pulled | Identity |
| Conditional Access | Policy.Read.All | Granted + Pulled | Identity |
| Backup Health | Reader (ARM) | Granted + Pulled | Infrastructure |
| Backup Jobs | Reader (ARM) | Granted + Pulled | Infrastructure |
| Backup Vaults | Reader (ARM) | Granted + Pulled | Infrastructure |
| Key Vaults | Reader (ARM) | Granted + Pulled | Infrastructure |
| Network Security Groups | Reader (ARM) | Granted + Pulled | Network |
| Recovery Readiness | Reader (ARM) | Granted + Pulled | Infrastructure |
| SQL Servers | Reader (ARM) | Granted + Pulled | Infrastructure |
| Storage Accounts | Reader (ARM) | Granted + Pulled | Infrastructure |
| MFA Coverage | Reports.Read.All | Granted + Pulled | Identity |
| Privileged Accounts | RoleManagement.Read.All | Granted + Pulled | Identity |
| Secure Score | SecurityEvents.Read.All | Granted + Pulled | Security |
| Secure Score Controls | SecurityEvents.Read.All | Granted + Pulled | Security |
| Security Alerts | SecurityEvents.Read.All | Granted + Pulled | Security |
| Vulnerability Assessment | SecurityEvents.Read.All | Granted + Pulled | Vulnerability Management |
| Defender TVM Recommendations | SecurityRecommendation.Read.All (WindowsDefenderATP) | Granted + Pulled | Vulnerability Management |
| Defender Software Inventory | Software.Read.All (WindowsDefenderATP) | Granted + Pulled | Vulnerability Management |
| User Summary | User.Read.All | Granted + Pulled | Identity |
| Defender TVM Vulnerabilities | Vulnerability.Read.All (WindowsDefenderATP) | Granted + Pulled | Vulnerability Management |
Integration Status
cloudConnected
Azure Resource Manager
ARM subscription security, public IPs, and resource inventory
backupConnected
Azure Backup & DR
Backup vaults, job status, and recovery readiness
bug_reportLimited
Defender Vulnerability
Secure Score configuration recommendations; Defender TVM CVE data not collected
policyConnected
Microsoft Purview
DLP policies, retention, and compliance posture
monitorConnected
Log Analytics / Sentinel
Log ingestion, workspace health, and SIEM coverage
Environment Snapshot & License Detail
| Property | Value |
|---|---|
| Tenant ID | a1b2c3d4-e5f6-7890-abcd-ef1234567890 |
| Tenant Name | Contoso Defense Systems |
| Primary Domains | contoso.onmicrosoft.com, contoso.com, contoso.mail.onmicrosoft.com |
| Run ID | 20260515T233445Z_ad-hoc |
| Collector Version | fffea76 |
| SKU Name | Assigned | Total | Utilization |
|---|---|---|---|
| SPB | 120 | 130 | 92.3% |
| EXCHANGESTANDARD | 5 | 5 | 100.0% |
| FLOW_FREE | 28 | 10000 | 0.3% |
| POWER_BI_STANDARD | 4 | 50 | 8.0% |
Measurement Map
| Metric | Data Source | Permission Required | Confidence |
|---|---|---|---|
| MFA coverage % | Microsoft Graph Reports | Reports.Read.All | Observed |
| Admin MFA coverage % | Microsoft Graph Reports | Reports.Read.All | Observed |
| Legacy auth blocked | Microsoft Graph Policies | Policy.Read.All | Observed |
| Enabled CA policy count | Microsoft Graph Conditional Access | Policy.Read.All | Observed |
| Risky sign-ins (count) | Identity Protection | IdentityRiskEvent.Read.All | Observed |
| Secure Score % | Microsoft Defender Secure Score | SecurityEvents.Read.All | Observed |
| Device compliance % | Microsoft Intune | DeviceManagementManagedDevices.Read.All | Observed |
Data Coverage Audit
Collected
60
Missing
2
Total Audited
62
Data Collected
check_circleTenant Overview
check_circleBaseline Metrics
check_circleDevice Compliance
check_circlePrivileged Accounts
check_circleCa Policy Summary
check_circleOnprem Ad Assessment
check_circleOnprem Ad Technical
check_circleSecurity Feature Scorecard
check_circlePermission Collection Status
check_circleEnvironment Snapshot
check_circleLicense Overview
check_circleLicense Utilization
check_circleMeasurement Map
check_circleIntegrations
check_circleFindings
check_circleOauth Grants Summary
check_circleLog Analytics Summary
check_circleService Principal Summary
check_circleSharepoint Sites
check_circleSharepoint Summary
check_circleTeams Inventory Summary
check_circleTeams Summary
check_circleNamed Locations Summary
check_circleRetention Policies
check_circleAdmin Operations Summary
check_circleArm Public Ips
check_circleSecure Score Recommendations
check_circleVulnerability Data
check_circleVulnerability Summary
check_circleGuest Users List
check_circleBackup Jobs
check_circleBackup Vaults
check_circleRecovery Readiness
check_circleExchange Transport Rules
check_circleIntune App Protection
check_circleManaged App Policies
check_circlePim Role Settings
check_circleTeams Policies
check_circleArm Security Summary
check_circlePurview Summary
check_circleDlp Summary
check_circlePositive Findings
check_circleThreat Pulse Summary
check_circleConditional Access
check_circleMfa Coverage
check_circleDevice Inventory
check_circleDevice Configuration Policies
check_circleSecure Score
check_circleSecure Score Controls
check_circleAd Tier0 Groups
check_circleAd Controls
check_circleAd Security Score
check_circleAd Metrics
check_circleAd Domain Controllers
check_circleGuest Summary
check_circleRisky Users Summary
check_circleOnprem Ad Environment
check_circleEvidence Controls
check_circleEvidence Poam
check_circleEvidence Sprs Score
Data Missing
cancelRisky Users
cancelGuest Users
Full Data Explorer
data_objectData manifest (225 top-level keys) — click to expand
{
"_html_security": {"type": "dict", "size": "3 keys"}
"_report_mode": {"type": "str", "size": "11 chars"}
"accesspackage_summary": {"type": "dict", "size": "0 keys"}
"action_items": {"type": "list", "size": "11 items"}
"ad_action_plan": {"type": "list", "size": "4 items"}
"ad_assessment_available": {"type": "bool", "size": "bool"}
"ad_collection_status": {"type": "str", "size": "0 chars"}
"ad_connect_health": {"type": "dict", "size": "4 keys"}
"ad_controls": {"type": "list", "size": "8 items"}
"ad_coverage_items": {"type": "list", "size": "0 items"}
"ad_domain_controllers": {"type": "list", "size": "3 items"}
"ad_findings": {"type": "list", "size": "3 items"}
"ad_kerberos": {"type": "dict", "size": "3 keys"}
"ad_ldap_signing": {"type": "dict", "size": "2 keys"}
"ad_metrics": {"type": "dict", "size": "6 keys"}
"ad_ntlm_telemetry": {"type": "dict", "size": "3 keys"}
"ad_security_score": {"type": "dict", "size": "6 keys"}
"ad_tier0_groups": {"type": "list", "size": "7 items"}
"ad_trusts": {"type": "list", "size": "0 items"}
"admin_operations_summary": {"type": "dict", "size": "5 keys"}
"app_registrations_summary": {"type": "dict", "size": "14 keys"}
"arm_collection_status": {"type": "SafeString", "size": "12 chars"}
"arm_diagnostic_settings": {"type": "dict", "size": "1 keys"}
"arm_key_vaults": {"type": "list", "size": "1 items"}
"arm_network_nsgs": {"type": "list", "size": "1 items"}
"arm_policy_assignments": {"type": "dict", "size": "1 keys"}
"arm_private_endpoints": {"type": "dict", "size": "0 keys"}
"arm_public_ips": {"type": "list", "size": "2 items"}
"arm_public_paas_count": {"type": "int", "size": "int"}
"arm_resource_tags": {"type": "dict", "size": "1 keys"}
"arm_security_summary": {"type": "dict", "size": "3 keys"}
"arm_sql_servers": {"type": "list", "size": "1 items"}
"arm_storage_accounts": {"type": "list", "size": "1 items"}
"artifact_contract_validation": {"type": "dict", "size": "4 keys"}
"artifacts": {"type": "list", "size": "0 items"}
"assessment_period": {"type": "dict", "size": "2 keys"}
"assessment_ready": {"type": "bool", "size": "bool"}
"assessment_ref": {"type": "SafeString", "size": "36 chars"}
"attack_simulation_campaigns": {"type": "dict", "size": "0 keys"}
"auth_methods_detail": {"type": "dict", "size": "4 keys"}
"auth_methods_policy": {"type": "dict", "size": "5 keys"}
"auth_methods_summary": {"type": "dict", "size": "4 keys"}
"backup_dashboard": {"type": "dict", "size": "8 keys"}
"backup_health": {"type": "dict", "size": "4 keys"}
"backup_jobs": {"type": "list", "size": "3 items"}
"backup_status": {"type": "dict", "size": "0 keys"}
"backup_vaults": {"type": "list", "size": "2 items"}
"baseline_gap_actions": {"type": "list", "size": "1 items"}
"baseline_metrics": {"type": "dict", "size": "16 keys"}
"bitlocker_recovery_keys": {"type": "dict", "size": "3 keys"}
"branding": {"type": "dict", "size": "11 keys"}
"ca_gap_analysis": {"type": "dict", "size": "5 keys"}
"ca_mfa_coverage": {"type": "dict", "size": "8 keys"}
"ca_policy_summary": {"type": "dict", "size": "5 keys"}
"ca_whatif_results": {"type": "dict", "size": "5 keys"}
"cis_v8_assessment": {"type": "dict", "size": "5 keys"}
"collection_gaps": {"type": "dict", "size": "8 keys"}
"collection_health_summary": {"type": "dict", "size": "12 keys"}
"combined_posture": {"type": "dict", "size": "8 keys"}
"compliance_context": {"type": "dict", "size": "5 keys"}
"compliance_data_quality": {"type": "dict", "size": "5 keys"}
"compliance_decision_queue": {"type": "list", "size": "10 items"}
"compliance_denominators": {"type": "dict", "size": "6 keys"}
"compliance_evidence_inventory": {"type": "list", "size": "18 items"}
"compliance_framework_controls": {"type": "dict", "size": "4 keys"}
"compliance_policies_summary": {"type": "dict", "size": "3 keys"}
"compliance_probe_audit": {"type": "list", "size": "18 items"}
"compliance_probe_audit_summary": {"type": "dict", "size": "6 keys"}
"composite_rating": {"type": "dict", "size": "8 keys"}
"conditional_access": {"type": "dict", "size": "6 keys"}
"configuration_status": {"type": "dict", "size": "0 keys"}
"consent_completeness": {"type": "dict", "size": "6 keys"}
"consent_completeness_line": {"type": "SafeString", "size": "86 chars"}
"contract_contradiction_dashboard": {"type": "dict", "size": "3 keys"}
"contradiction_dashboard": {"type": "dict", "size": "3 keys"}
"cost_summary": {"type": "dict", "size": "6 keys"}
"current_permission_health": {"type": "dict", "size": "8 keys"}
"data_governance_summary": {"type": "dict", "size": "8 keys"}
"data_quality_by_domain": {"type": "list", "size": "11 items"}
"data_quality_gate": {"type": "dict", "size": "4 keys"}
"data_status_semantics": {"type": "dict", "size": "3 keys"}
"decision_points": {"type": "list", "size": "1 items"}
"defender_summary": {"type": "dict", "size": "7 keys"}
"defender_tvm_detail": {"type": "dict", "size": "0 keys"}
"device_compliance": {"type": "dict", "size": "14 keys"}
"device_configuration_policies": {"type": "dict", "size": "5 keys"}
"device_inventory": {"type": "list", "size": "4 items"}
"device_inventory_footnote": {"type": "SafeString", "size": "34 chars"}
"device_posture_rollup": {"type": "dict", "size": "6 keys"}
"directory_roles": {"type": "dict", "size": "3 keys"}
"dlp_summary": {"type": "dict", "size": "4 keys"}
"domain_stats": {"type": "dict", "size": "11 keys"}
"domain_validations": {"type": "dict", "size": "7 keys"}
"email_security": {"type": "dict", "size": "27 keys"}
"entitlement_reviews": {"type": "dict", "size": "0 keys"}
"entra_recommendations": {"type": "dict", "size": "6 keys"}
"environment_snapshot": {"type": "dict", "size": "10 keys"}
"evidence_assessment_available": {"type": "bool", "size": "bool"}
"evidence_assessment_results": {"type": "dict", "size": "6 keys"}
"evidence_controls": {"type": "list", "size": "24 items"}
"evidence_coverage": {"type": "dict", "size": "7 keys"}
"evidence_domain_rollup": {"type": "dict", "size": "14 keys"}
"evidence_findings": {"type": "list", "size": "8 items"}
"evidence_manifest": {"type": "dict", "size": "1 keys"}
"evidence_poam": {"type": "list", "size": "4 items"}
"evidence_sprs_score": {"type": "dict", "size": "4 keys"}
"exchange_transport_rules": {"type": "dict", "size": "4 keys"}
"expanded_domain_rollup": {"type": "dict", "size": "17 keys"}
"failed_endpoints": {"type": "list", "size": "0 items"}
"findings": {"type": "list", "size": "164 items"}
"findings_by_domain": {"type": "dict", "size": "11 keys"}
"findings_generation_status": {"type": "SafeString", "size": "2 chars"}
"generated_at": {"type": "SafeString", "size": "32 chars"}
"guest_detail_inventory": {"type": "dict", "size": "3 keys"}
"guest_summary": {"type": "dict", "size": "11 keys"}
"guest_users_list": {"type": "list", "size": "5 items"}
"high_risk_operations": {"type": "dict", "size": "5 keys"}
"implicit_actions": {"type": "list", "size": "11 items"}
"inferred_findings": {"type": "list", "size": "0 items"}
"integrations": {"type": "dict", "size": "3 keys"}
"interleaved_action_plan": {"type": "list", "size": "15 items"}
"intune_app_protection": {"type": "dict", "size": "3 keys"}
"legacy_auth_summary": {"type": "dict", "size": "5 keys"}
"legacy_auth_users": {"type": "dict", "size": "6 keys"}
"license_overview": {"type": "dict", "size": "10 keys"}
"license_summary": {"type": "dict", "size": "6 keys"}
"license_utilization": {"type": "dict", "size": "4 keys"}
"lifecycle_summary": {"type": "dict", "size": "6 keys"}
"lifecycle_summary_deep": {"type": "dict", "size": "0 keys"}
"log_analytics_summary": {"type": "dict", "size": "13 keys"}
"managed_app_policies": {"type": "dict", "size": "3 keys"}
"managed_devices_summary": {"type": "dict", "size": "3 keys"}
"mde_summary": {"type": "dict", "size": "18 keys"}
"measurement_map": {"type": "list", "size": "7 items"}
"mfa_coverage": {"type": "dict", "size": "12 keys"}
"named_locations_summary": {"type": "dict", "size": "4 keys"}
"next_7_days_actions": {"type": "list", "size": "10 items"}
"nist_csf_assessment": {"type": "dict", "size": "6 keys"}
"oauth_audit": {"type": "dict", "size": "1 keys"}
"oauth_grants_summary": {"type": "dict", "size": "4 keys"}
"oauth_risk": {"type": "dict", "size": "5 keys"}
"oauth_risk_rollup": {"type": "dict", "size": "7 keys"}
"observed_findings": {"type": "list", "size": "139 items"}
"onedrive_usage": {"type": "dict", "size": "0 keys"}
"onprem_ad_assessment": {"type": "dict", "size": "10 keys"}
"onprem_ad_environment": {"type": "dict", "size": "17 keys"}
"onprem_ad_technical": {"type": "dict", "size": "17 keys"}
"onprem_collector_bundles": {"type": "list", "size": "5 items"}
"onprem_compliance_fanout": {"type": "dict", "size": "3 keys"}
"onprem_infra_assessment": {"type": "dict", "size": "7 keys"}
"onprem_operations": {"type": "dict", "size": "7 keys"}
"org_slug": {"type": "SafeString", "size": "4 chars"}
"organization_info": {"type": "dict", "size": "8 keys"}
"overview_drilldowns": {"type": "dict", "size": "3 keys"}
"password_policies": {"type": "dict", "size": "3 keys"}
"permission_collection_status": {"type": "dict", "size": "15 keys"}
"permission_status": {"type": "dict", "size": "0 keys"}
"pim_role_settings": {"type": "dict", "size": "3 keys"}
"pim_summary": {"type": "dict", "size": "0 keys"}
"positive_findings": {"type": "list", "size": "6 items"}
"prior_snapshot": {"type": "str", "size": "0 chars"}
"prior_snapshots": {"type": "list", "size": "0 items"}
"privileged_access_rollup": {"type": "dict", "size": "7 keys"}
"privileged_accounts": {"type": "list", "size": "7 items"}
"purview_labels": {"type": "dict", "size": "0 keys"}
"purview_policies": {"type": "dict", "size": "0 keys"}
"purview_summary": {"type": "dict", "size": "9 keys"}
"recovery_readiness": {"type": "dict", "size": "8 keys"}
"remediation": {"type": "dict", "size": "3 keys"}
"renderable_detail_datasets": {"type": "dict", "size": "3 keys"}
"report_metadata": {"type": "dict", "size": "9 keys"}
"report_mode": {"type": "SafeString", "size": "10 chars"}
"report_schema_version": {"type": "SafeString", "size": "5 chars"}
"report_scope_audit": {"type": "list", "size": "15 items"}
"report_scope_audit_summary": {"type": "dict", "size": "6 keys"}
"reporting_contract_validation": {"type": "dict", "size": "6 keys"}
"retention_policies": {"type": "dict", "size": "3 keys"}
"risk_detection_summary": {"type": "dict", "size": "0 keys"}
"risky_sign_ins_30d": {"type": "dict", "size": "6 keys"}
"risky_signins_summary": {"type": "dict", "size": "6 keys"}
"risky_users_summary": {"type": "dict", "size": "5 keys"}
"rule_catalog": {"type": "list", "size": "135 items"}
"run_id": {"type": "SafeString", "size": "23 chars"}
"runbook": {"type": "dict", "size": "6 keys"}
"secure_score": {"type": "dict", "size": "10 keys"}
"secure_score_benchmarks": {"type": "dict", "size": "5 keys"}
"secure_score_controls": {"type": "dict", "size": "4 keys"}
"secure_score_recommendations": {"type": "dict", "size": "3 keys"}
"security_alerts_summary": {"type": "dict", "size": "9 keys"}
"security_feature_scorecard": {"type": "dict", "size": "5 keys"}
"sensitivity_labels_summary": {"type": "dict", "size": "3 keys"}
"service_principal_summary": {"type": "dict", "size": "5 keys"}
"sharepoint_sharing_settings": {"type": "dict", "size": "2 keys"}
"sharepoint_sites": {"type": "dict", "size": "5 keys"}
"sharepoint_summary": {"type": "dict", "size": "4 keys"}
"sign_in_summary": {"type": "dict", "size": "7 keys"}
"snapshot_metrics": {"type": "dict", "size": "4 keys"}
"soc2_assessment": {"type": "dict", "size": "5 keys"}
"software_inventory_summary": {"type": "dict", "size": "6 keys"}
"source_coverage": {"type": "dict", "size": "10 keys"}
"source_data": {"type": "dict", "size": "16 keys"}
"source_provenance": {"type": "dict", "size": "12 keys"}
"sp_audit": {"type": "dict", "size": "9 keys"}
"sprs_score": {"type": "int", "size": "int"}
"subscribed_skus": {"type": "dict", "size": "3 keys"}
"tactical_lists": {"type": "dict", "size": "5 keys"}
"teams_inventory_summary": {"type": "dict", "size": "5 keys"}
"teams_policies": {"type": "dict", "size": "3 keys"}
"teams_summary": {"type": "dict", "size": "3 keys"}
"tenant_display_name": {"type": "SafeString", "size": "23 chars"}
"tenant_identity_issues": {"type": "list", "size": "0 items"}
"tenant_overview": {"type": "dict", "size": "16 keys"}
"tenant_overview_checklist": {"type": "list", "size": "7 items"}
"terms_of_use_summary": {"type": "dict", "size": "4 keys"}
"third_party_summary": {"type": "dict", "size": "4 keys"}
"threat_hunting": {"type": "dict", "size": "3 keys"}
"threat_pulse_summary": {"type": "dict", "size": "7 keys"}
"topology_collection_status": {"type": "dict", "size": "10 keys"}
"trend_summary": {"type": "dict", "size": "3 keys"}
"trust_layer": {"type": "dict", "size": "3 keys"}
"unknowns_register": {"type": "list", "size": "1 items"}
"value_model": {"type": "dict", "size": "5 keys"}
"vulnerability_data": {"type": "dict", "size": "11 keys"}
"vulnerability_rollup": {"type": "dict", "size": "8 keys"}
"vulnerability_summary": {"type": "dict", "size": "16 keys"}
}Skip to main contentDNS zones33 AD-integrated · corp.contoso.local, research.contoso.local DHCP scopes44 sites covered · DAL-Corp, HSV-Corp Replication links3slowest DAL-EDI · 180m · lagging
⚠Synthetic demo dataFindings, identities, controls and metrics are fictional. Do not treat values as a real assessment or extract names or domains.
Polaris·Security Assessment · § 05 Forest Topology
Contoso Defense Systems
Generated May 15, 2026, 7:34 PM ET · trailing 30d
manifest only
9 DCs across 4 sites · 1 trust bypass SID filtering.
Sites
4
2 countries
Domain controllers
9
3 FSMO holders · 3 GC
Cert authorities
2
4 ADCS findings
Trusts
4
1 sidFilter off
Findings
52
27 placed · 25 unplaced
Drift · 30d
Baseline pending
trend unlocks at next scan
Sites & replication context3 DNS zones · 4 DHCP scopes · 3 site links
Dallas-HQ
3 DCs
Dallas · US
4 subnets · 1 DHCP · 3 site links
Huntsville
4 DCs
Huntsville · US
3 subnets · 1 DHCP · 1 site links
Crystal-City
1 DCs
Arlington · US
2 subnets · 1 DHCP · 1 site links
Edinburgh
1 DCs
Edinburgh · GB
2 subnets · 1 DHCP · 1 site links
Topology digest9 DCs · 4 sites · 4 DHCP · 3 links · 52 findings
Domains
- corp.contoso.local7 DCs
- research.contoso.local2 DCs
Sites
- Dallas-HQ3 DCs · US
- Huntsville4 DCs · US
- Crystal-City1 DCs · US
- Edinburgh1 DCs · GB
Infrastructure
- 3 DNS zoneszone inventory
- 4 DHCP scopessite coverage
- 3 site linksreplication paths
Risky trusts
- legacy-supplier.examplesidFilter off
Placement
- 27 placedmapped to graph nodes
- 25 unplacedneeds asset binding
● tip · click any node to see linked findings · ctrl+scroll to zoom · press
? for shortcutsLegend
- Tier-0 DC
- Tier-1 DC
- Global catalog
- P0 alert
- Cert authority
- Trust · safe
- Trust · risky
ctrl+scroll zoom · drag pan · r reset
——
—
Topology findings · 52
27 placed · 25 unplaced · click row to highlight on map
Showing 20 of 52
| ID | Sev | Title | Node | Domain | Control |
|---|---|---|---|---|---|
| PHASE5-AD04-FSMO-dal-dc01.corp.contoso.local | P1 | FSMO concentration: dal-dc01.corp.contoso.local holds 3/5 roles — single point of failure | dal-dc01.corp.contoso.local | corp.contoso.local | AD-04 |
| PHASE5-AD04-FSMO-res-dc01.research.contoso.local | P1 | FSMO concentration: res-dc01.research.contoso.local holds 5/5 roles — single point of failure | res-dc01.research.contoso.local | research.contoso.local | AD-04 |
| OnPrem-NET-SIDFILTER-LEGACY | P0 | External trust to legacy-supplier.example has SID filtering disabled | dal-dc01.corp.contoso.local | — | — |
| OnPrem-NET-EDI-REPL-LAG | P1 | Edinburgh DC replication lag exceeds 4h threshold | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-DA-MFA | P0 | 2 Domain Admins without MFA | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-KRBTGT-247 | P0 | krbtgt password age 247 days exceeds 180-day threshold | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-ADMINSDHOLDER-PKI | P0 | AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-ADMINSDHOLDER-BACKUP | P1 | AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-PROTECTED-USERS-EMPTY | P1 | Protected Users group has zero members | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AD-T0-PASSWORD-POLICY | P1 | Default Domain Password Policy minimum length is 12 (CMMC L2 gap) | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-UNCONSTRAINED-PRINT | P0 | DAL-PRINT01 has unconstrained Kerberos delegation | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-UNCONSTRAINED-FILE | P0 | HSV-FILE02 has unconstrained Kerberos delegation | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-KERBEROASTABLE-14 | P1 | 14 Kerberoastable service accounts | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-ASREP-LEGACY | P1 | Service account svc_legacy_ctip_connector is AS-REP roastable | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-ASREP-MES | P1 | Service account svc_mes_ctl is AS-REP roastable | dal-dc01.corp.contoso.local | — | — |
| OnPrem-AP-RC4-PERMITTED | P2 | 34 accounts still accept RC4 Kerberos encryption | dal-dc01.corp.contoso.local | — | — |
| OnPrem-ADCS-ESC1-DC | P0 | ADCS template certifies domain controllers without signature (ESC1) | dal-ca01.corp.contoso.local | — | — |
| OnPrem-ADCS-ESC1-SMARTCARD | P0 | ADCS template CorpUserSmartcard is ESC1 vulnerable | dal-ca01.corp.contoso.local | — | — |
| OnPrem-ADCS-ESC4-WORKSTATION | P1 | ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable | dal-ca01.corp.contoso.local | — | — |
| OnPrem-ADCS-CA-EXPIRY-57D | P1 | Enterprise Issuing CA certificate expires in 57 days | dal-ca01.corp.contoso.local | — | — |
| OnPrem-GPO-SMB-SIGN | P0 | SMB server signing is not required domain-wide | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-SMB1-47 | P1 | Legacy SMBv1 enabled on 47 endpoints | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-LDAP-SIGN | P1 | LDAP signing is optional (LDAPServerIntegrity=1) | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-PS-LOGGING-203 | P2 | PowerShell script-block logging disabled across 203 hosts | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-LSA-PROTECT | P2 | LSA Protection (RunAsPPL) is not enabled | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-NTLMV1 | P2 | Legacy NTLMv1 authentication is still allowed | dal-dc01.corp.contoso.local | — | — |
| OnPrem-GPO-SYSVOL-ACL | P3 | SYSVOL permissions hardened (no action required) | dal-dc01.corp.contoso.local | — | — |
| Findings not yet placed on topology · 25 unknown-kind or unresolved asset | |||||
| OnPrem-a838cee6bbdebeade5b6f87e45bd47bf | P0 | External trust to legacy-supplier.example has SID filtering disabled | Unplaced | infrastructure | — |
| OnPrem-bb5a9d6f577335e859fca4309670b184 | P1 | Edinburgh DC replication lag exceeds 4h threshold | Unplaced | infrastructure | — |
| OnPrem-b2f1b05d8a827a2e5c84fa24de42f482 | P0 | 2 Domain Admins without MFA | Unplaced | identity | — |
| OnPrem-bed89eaf2193e46f4ff4e32592dae478 | P0 | krbtgt password age 247 days exceeds 180-day threshold | Unplaced | identity | — |
| OnPrem-16f7917e737ec4706ddf063523c83342 | P0 | AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor | Unplaced | identity | — |
| OnPrem-a44af409d7d11e59c1493a0dbe64697b | P1 | AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor | Unplaced | identity | — |
| OnPrem-f0f7d0c50d45e6b1a1ec9b4d31aa74e3 | P1 | Protected Users group has zero members | Unplaced | identity | — |
| OnPrem-196a963ef20ace8c875acdb6bd3cd146 | P1 | Default Domain Password Policy minimum length is 12 (CMMC L2 gap) | Unplaced | identity | — |
| OnPrem-8ca006d6163ddcbbaba1e7966c2eadbf | P0 | DAL-PRINT01 has unconstrained Kerberos delegation | Unplaced | identity | — |
| OnPrem-fa9a1cc45e2cca28fe8473c0489bcad6 | P0 | HSV-FILE02 has unconstrained Kerberos delegation | Unplaced | identity | — |
| OnPrem-973c8114634333ec705572385c76c6a8 | P1 | 14 Kerberoastable service accounts | Unplaced | identity | — |
| OnPrem-115a403197926fcf3729afc5e5c88fd4 | P1 | Service account svc_legacy_ctip_connector is AS-REP roastable | Unplaced | identity | — |
| OnPrem-2e376a0ca89c5193bc5bbd75360d2e4d | P1 | Service account svc_mes_ctl is AS-REP roastable | Unplaced | identity | — |
| OnPrem-97a5bcd3de1156ed22b2c2c6bf46b7c4 | P2 | 34 accounts still accept RC4 Kerberos encryption | Unplaced | identity | — |
| OnPrem-4aa38d65ce3032519d1f521931c464da | P0 | ADCS template certifies domain controllers without signature (ESC1) | Unplaced | identity | — |
| OnPrem-76680815350c3b60af20b49eed10bff4 | P0 | ADCS template CorpUserSmartcard is ESC1 vulnerable | Unplaced | identity | — |
| OnPrem-0f0e6181ecd6d31732ee82cce27690dd | P1 | ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable | Unplaced | identity | — |
| OnPrem-ec4b457d71895584370f8701340b7c3a | P1 | Enterprise Issuing CA certificate expires in 57 days | Unplaced | identity | — |
| OnPrem-2481dae51698953372cf8077e7873270 | P0 | SMB server signing is not required domain-wide | Unplaced | identity | — |
| OnPrem-ad9235417f447a7ed15961e756550e6e | P1 | Legacy SMBv1 enabled on 47 endpoints | Unplaced | identity | — |
| OnPrem-a249894fcd65540f5d07fd99f55e1c4b | P1 | LDAP signing is optional (LDAPServerIntegrity=1) | Unplaced | identity | — |
| OnPrem-d9410d7869f255a0fec2355e9aefcf99 | P2 | PowerShell script-block logging disabled across 203 hosts | Unplaced | identity | — |
| OnPrem-0f77e63ab314918dcaf223a564609ca8 | P2 | LSA Protection (RunAsPPL) is not enabled | Unplaced | identity | — |
| OnPrem-42f2c00314d0c3e902ae242f5915f138 | P2 | Legacy NTLMv1 authentication is still allowed | Unplaced | identity | — |
| OnPrem-2033c52168ea3ca38362f4cc45adf8dd | P3 | SYSVOL permissions hardened (no action required) | Unplaced | identity | — |
P1PHASE5-AD04-FSMO-dal-dc01.corp.contoso.local
FSMO concentration: dal-dc01.corp.contoso.local holds 3/5 roles — single point of failure
- Node
- dal-dc01.corp.contoso.local
- Domain
- corp.contoso.local
- Control
- AD-04
P1PHASE5-AD04-FSMO-res-dc01.research.contoso.local
FSMO concentration: res-dc01.research.contoso.local holds 5/5 roles — single point of failure
- Node
- res-dc01.research.contoso.local
- Domain
- research.contoso.local
- Control
- AD-04
P0OnPrem-NET-SIDFILTER-LEGACY
External trust to legacy-supplier.example has SID filtering disabled
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-NET-EDI-REPL-LAG
Edinburgh DC replication lag exceeds 4h threshold
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-AD-T0-DA-MFA
2 Domain Admins without MFA
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-AD-T0-KRBTGT-247
krbtgt password age 247 days exceeds 180-day threshold
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-AD-T0-ADMINSDHOLDER-PKI
AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AD-T0-ADMINSDHOLDER-BACKUP
AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AD-T0-PROTECTED-USERS-EMPTY
Protected Users group has zero members
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AD-T0-PASSWORD-POLICY
Default Domain Password Policy minimum length is 12 (CMMC L2 gap)
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-AP-UNCONSTRAINED-PRINT
DAL-PRINT01 has unconstrained Kerberos delegation
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-AP-UNCONSTRAINED-FILE
HSV-FILE02 has unconstrained Kerberos delegation
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AP-KERBEROASTABLE-14
14 Kerberoastable service accounts
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AP-ASREP-LEGACY
Service account svc_legacy_ctip_connector is AS-REP roastable
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-AP-ASREP-MES
Service account svc_mes_ctl is AS-REP roastable
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P2OnPrem-AP-RC4-PERMITTED
34 accounts still accept RC4 Kerberos encryption
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-ADCS-ESC1-DC
ADCS template certifies domain controllers without signature (ESC1)
- Node
- dal-ca01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-ADCS-ESC1-SMARTCARD
ADCS template CorpUserSmartcard is ESC1 vulnerable
- Node
- dal-ca01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-ADCS-ESC4-WORKSTATION
ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable
- Node
- dal-ca01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-ADCS-CA-EXPIRY-57D
Enterprise Issuing CA certificate expires in 57 days
- Node
- dal-ca01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-GPO-SMB-SIGN
SMB server signing is not required domain-wide
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-GPO-SMB1-47
Legacy SMBv1 enabled on 47 endpoints
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P1OnPrem-GPO-LDAP-SIGN
LDAP signing is optional (LDAPServerIntegrity=1)
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P2OnPrem-GPO-PS-LOGGING-203
PowerShell script-block logging disabled across 203 hosts
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P2OnPrem-GPO-LSA-PROTECT
LSA Protection (RunAsPPL) is not enabled
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P2OnPrem-GPO-NTLMV1
Legacy NTLMv1 authentication is still allowed
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P3OnPrem-GPO-SYSVOL-ACL
SYSVOL permissions hardened (no action required)
- Node
- dal-dc01.corp.contoso.local
- Domain
- —
- Control
- —
P0OnPrem-a838cee6bbdebeade5b6f87e45bd47bf
External trust to legacy-supplier.example has SID filtering disabled
- Node
- Unplaced
- Domain
- infrastructure
- Control
- —
P1OnPrem-bb5a9d6f577335e859fca4309670b184
Edinburgh DC replication lag exceeds 4h threshold
- Node
- Unplaced
- Domain
- infrastructure
- Control
- —
P0OnPrem-b2f1b05d8a827a2e5c84fa24de42f482
2 Domain Admins without MFA
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-bed89eaf2193e46f4ff4e32592dae478
krbtgt password age 247 days exceeds 180-day threshold
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-16f7917e737ec4706ddf063523c83342
AdminSDHolder ACL contains unexpected GenericWrite ACE for PKI vendor
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-a44af409d7d11e59c1493a0dbe64697b
AdminSDHolder ACL contains unexpected WriteDACL ACE for backup vendor
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-f0f7d0c50d45e6b1a1ec9b4d31aa74e3
Protected Users group has zero members
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-196a963ef20ace8c875acdb6bd3cd146
Default Domain Password Policy minimum length is 12 (CMMC L2 gap)
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-8ca006d6163ddcbbaba1e7966c2eadbf
DAL-PRINT01 has unconstrained Kerberos delegation
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-fa9a1cc45e2cca28fe8473c0489bcad6
HSV-FILE02 has unconstrained Kerberos delegation
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-973c8114634333ec705572385c76c6a8
14 Kerberoastable service accounts
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-115a403197926fcf3729afc5e5c88fd4
Service account svc_legacy_ctip_connector is AS-REP roastable
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-2e376a0ca89c5193bc5bbd75360d2e4d
Service account svc_mes_ctl is AS-REP roastable
- Node
- Unplaced
- Domain
- identity
- Control
- —
P2OnPrem-97a5bcd3de1156ed22b2c2c6bf46b7c4
34 accounts still accept RC4 Kerberos encryption
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-4aa38d65ce3032519d1f521931c464da
ADCS template certifies domain controllers without signature (ESC1)
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-76680815350c3b60af20b49eed10bff4
ADCS template CorpUserSmartcard is ESC1 vulnerable
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-0f0e6181ecd6d31732ee82cce27690dd
ADCS template ContoWorkstationAuth is ESC4 (weak ACL) vulnerable
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-ec4b457d71895584370f8701340b7c3a
Enterprise Issuing CA certificate expires in 57 days
- Node
- Unplaced
- Domain
- identity
- Control
- —
P0OnPrem-2481dae51698953372cf8077e7873270
SMB server signing is not required domain-wide
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-ad9235417f447a7ed15961e756550e6e
Legacy SMBv1 enabled on 47 endpoints
- Node
- Unplaced
- Domain
- identity
- Control
- —
P1OnPrem-a249894fcd65540f5d07fd99f55e1c4b
LDAP signing is optional (LDAPServerIntegrity=1)
- Node
- Unplaced
- Domain
- identity
- Control
- —
P2OnPrem-d9410d7869f255a0fec2355e9aefcf99
PowerShell script-block logging disabled across 203 hosts
- Node
- Unplaced
- Domain
- identity
- Control
- —
P2OnPrem-0f77e63ab314918dcaf223a564609ca8
LSA Protection (RunAsPPL) is not enabled
- Node
- Unplaced
- Domain
- identity
- Control
- —
P2OnPrem-42f2c00314d0c3e902ae242f5915f138
Legacy NTLMv1 authentication is still allowed
- Node
- Unplaced
- Domain
- identity
- Control
- —
P3OnPrem-2033c52168ea3ca38362f4cc45adf8dd
SYSVOL permissions hardened (no action required)
- Node
- Unplaced
- Domain
- identity
- Control
- —
Keyboard
- g Geographic layout
- h Hierarchical layout
- f Force-directed layout
- r Ring layout
- a Toggle attack-flow overlay
- d Toggle drift drawer
- 1-4 Filter by severity
- ? Show this help
- esc Close detail panel / drawer