Test name

Test description

Test logic

CRM User Accounts Are Attributable To A Named Individual

Checks that every CRM user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank, and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

User Groups Are Named And Their Purpose Is Documented

Checks that every user group has a name and flags groups without a description so their purpose and membership can be reviewed.

Every record must satisfy: Name is not blank. A record is sent for review when: Description is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value, and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that remain unresolved, revealing aging work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank, and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value, Job Title has a value, and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Rejected Job Applications Record A Reject Reason

Flags job applications that were rejected without a documented reason for the rejection.

A record is marked failed when: Rejected Date has a value and Reject Reason is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Deleted ATS Accounts Are Deactivated

Flags user accounts that the source system reports as deleted but that are still marked active.

A record is marked failed when: Deleted is true and Active is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - EC2 Instance Inventory Records Are Complete

Checks that every EC2 instance reported by Systems Manager inventory records an instance ID, host name, IP address, and operating system name and version.

Every record must satisfy: Instance ID has a value, Computer Name has a value, IP Address has a value, Platform has a value, and Platform Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - Systems Manager Managed Instances Report A Healthy Agent

Checks that every inventoried EC2 instance has a management agent installed, reporting a well-formed version, and has not lost its connection to the management service.

Every record must satisfy: Agent Type has a value and Agent Version matches the pattern "^[0-9]{1,6}(\.[0-9]{1,6}){2,3}$" and Instance Status does not equal "ConnectionLost". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

RDS and DocumentDB daily backups enabled

Confirm backup Retention Period >= 1 and automated Backups Enabled = true

Every record must satisfy: Backup Job ID has a value and Status equals "COMPLETED". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - S3 Bucket Object Lock Enabled With A Default Retention Period

Checks that every S3 bucket has Object Lock enabled with a default retention period configured.

Every record must satisfy: Bucket has a value, Object lock status equals "Enabled," and Retention Period has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

S3 Bucket Policy Status confirms restricted access

Examine: Bucket policy JSON documents

Every record must satisfy: Bucket has a value, and Policy Type equals "Not Public". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Aurora Cluster Backup Retention Meets Minimum

Checks that every Amazon RDS/Aurora cluster in the evidence retains automated backups for at least seven days.

Every record must satisfy: Cluster Identifier has a value, and Cluster Backup Retention Period is 7 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Aurora Cluster Storage Encrypted At Rest

Checks that storage encryption is enabled on every Amazon RDS/Aurora cluster listed in the evidence.

Every record must satisfy: Cluster Identifier has a value, and Cluster Storage Encrypted is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Security Hub Aggregates Findings From Linked Regions

Confirms Security Hub cross-region finding aggregation is configured and that each linked region is recorded against an aggregation region.

Every record must satisfy: Home Region has a value, and Linked Region has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Security Hub Active Findings Have No Failed Compliance Checks

Flags active Security Hub findings whose compliance check failed and that have not been resolved or suppressed.

A record is marked failed when: Status equals "FAILED" and Record State equals "ACTIVE" and Workflow Status is none of "RESOLVED" or "SUPPRESSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - Security Hub High And Critical Findings Remediated Within 30 Days

Flags active high and critical Security Hub findings that have gone unresolved for more than 30 days.

A record is marked failed when: Severity is one of "CRITICAL" or "HIGH" and Record State equals "ACTIVE" and Workflow Status is none of "RESOLVED" or "SUPPRESSED" and Age (Days) is greater than 30. The test passes only if every record passes.

Security Hub Low Findings Remediated Within 180 Days

Flags active LOW severity Security Hub findings older than 180 days that have not been resolved or suppressed.

A record is marked failed when: Severity equals "LOW" and Record State equals "ACTIVE" and Workflow Status is none of "RESOLVED" or "SUPPRESSED" and Age (Days) is greater than 180. A record is marked failed when: Severity equals "LOW" and Record State equals "ACTIVE" and Workflow Status is empty and Age (Days) is greater than 180. The test passes only if every record passes.

Security Hub Medium Findings Remediated Within 90 Days

Flags active MEDIUM severity Security Hub findings older than 90 days that have not been resolved or suppressed.

A record is marked failed when: Severity equals "MEDIUM" and Record State equals "ACTIVE" and Workflow Status is none of "RESOLVED" or "SUPPRESSED" and Age (Days) is greater than 90. A record is marked failed when: Severity equals "MEDIUM" and Record State equals "ACTIVE" and Workflow Status is empty and Age (Days) is greater than 90. The test passes only if every record passes.

Test name

Test description

Test logic

AWS - IAM Account Password Policy Enforces A 14 Character Minimum

Checks that each AWS account enforces a custom IAM password policy with a strong minimum length.

Every record must satisfy: Policy equals "Custom password policy" and Minimum password length is 14 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - IAM Account Password Policy Prevents Reuse Of The Last 24 Passwords

Checks that each AWS account's IAM password policy prevents reuse of recent passwords.

Every record must satisfy: Policy equals "Custom password policy" and Count of passwords to remember to prevent reuse has a value and Count of passwords to remember to prevent reuse is 24 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - RDS Instance Backup Retention Meets Minimum

Checks that every Amazon RDS database instance in the evidence retains automated backups for at least seven days.

Every record must satisfy: Instance Identifier has a value and Instance Backup Retention Period is 7 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - RDS Instance Storage Encrypted At Rest

Checks that every Amazon RDS database instance in the proof has storage encryption enabled.

Every record must satisfy: Instance Identifier has a value, and Instance Storage Encrypted is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Security Hub Findings Integrations Are Identified

Confirms the account has enabled product integrations feeding findings into Security Hub, and that each one is identified by product and vendor.

A record is sent for review when: Name is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - IAM Active Access Keys Rotated Within 90 Days

Checks that active IAM user access keys have been rotated within the last 90 days.

A record is sent for review when: Creation Time is empty. A record is marked failed when: Status equals "Active" and Creation Time is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - IAM Active Access Keys Unused For 45 Days Are Disabled

Checks that active IAM user access keys which are unused or have never been used are not left enabled.

A record is marked failed when: Status equals "Active" and Last Used Date is more than 45 days in the past. A record is marked failed when: Status equals "Active" and Last Used Date is empty and Creation Time is more than 45 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - WAF Web ACLs Are Associated With A Protected Resource

Highlights WAF web ACLs that are not associated with any protected resource, so unused or orphaned ACLs get reviewed.

A record is sent for review when: Resources is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - WAF Web ACLs Enforce A Block Default Action

Checks that each WAF web ACL blocks requests by default, so traffic reaches the protected application only by explicit rule.

Every record must satisfy: Default Action equals "Block". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Backup Plans Have Executed At Least Once

Checks that every AWS Backup plan is named and has actually run at least once, so a defined plan is not silently producing no backups.

Every record must satisfy: Backup Plan Name has a value and Last Runtime has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS Backup Plans Have Executed Within The Last 35 Days

Flags AWS Backup plans that have not run in the last 35 days, and routes plans that have never run to review.

A record is marked failed when: Last Runtime is more than 35 days in the past. A record is sent for review when: Last Runtime is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - Client VPN Endpoints Use Private Client CIDR Ranges

Checks that each AWS Client VPN endpoint assigns connecting clients addresses from a private, non-internet-routable IP range.

Every record must satisfy: Client CIDR matches the pattern "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Lambda Functions Do Not Run On Deprecated Runtimes

Flags serverless functions running on a vendor-deprecated language runtime.

A record is marked failed when: Runtime matches the pattern "^(nodejs|nodejs4\.3(-edge)?|nodejs6\.10|nodejs8\.10|nodejs(10|12|14|16|18|20)\.x|python2\.7|python3\.[6-9]|ruby2\.[57]|ruby3\.2|java8|go1\.x|provided|provided\.al2|dotnetcore(1\.0|2\.0|2\.1|3\.1)|dotnet(5\.0|6|7))$". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - Lambda Functions Have Been Updated Within The Last Year

Flags serverless functions whose code has not been redeployed within the last year.

A record is sent for review when: Last Modified is empty. A record is sent for review when: Last Modified is more than 365 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - ECS Container Instances Are Not Inactive Or Failed Registration

Checks that registered ECS container instances are in a usable, active state.

A record is marked failed when: Status is one of "INACTIVE" or "REGISTRATION_FAILED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - ECS Container Instances Report Host Identity And Docker Engine Version

Checks that registered ECS container instances report the host identity and container runtime details needed to attribute workloads.

Every record must satisfy: EC2 Instance ID has a value and Docker Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - EKS Clusters Are Healthy And Not Running An End Of Support Kubernetes Version

Checks that each EKS cluster reports status ACTIVE and a Kubernetes version that is still within vendor support. Only ACTIVE passes: a cluster in CREATING, DELETING, PENDING or UPDATING does not evidence a healthy running cluster and is flagged too.

Every record must satisfy: Name has a value and Status equals "ACTIVE" and Kubernetes version has a value and Kubernetes version does not match the pattern "^1\.([0-9]|1[0-9]|2[0-9]|30)([^0-9]|$)". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - IAM Groups Avoid Inline Policies And Have Members

Checks that IAM groups grant permissions through managed policies rather than inline policies, and flags groups that have no members.

A record is marked failed when: Inline Policy is true. A record is sent for review when: Users equals 0. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - IAM Role Maximum Session Duration Is Not Excessive

Checks that IAM roles do not permit an excessive maximum session duration.

A record is marked failed when: Session Duration matches the pattern "^([89]|1[0-2]) hours". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - IAM Roles Do Not Trust Wildcard Principals

Checks that IAM role trust policies do not allow wildcard principals to assume the role.

A record is marked failed when: Trusted Entities contains "*". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - IAM SAML Provider Metadata Is Not Expired Or Expiring

Checks that SAML identity provider metadata documents in IAM have a valid expiration date and are not expired or close to expiring.

A record is marked failed when: Expiration Time is less than 30 days in the future. A record is sent for review when: Expiration Time is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - EC2 AMIs Are Not Publicly Shared

Checks that no AWS EC2 machine image owned by the account is shared publicly with all other AWS accounts.

Every record must satisfy: Visibility equals "Private". The test passes only if every record passes. If the proof contains no records, the test is marked passed.

AWS - EC2 AMIs Use EBS-Backed Root Volumes

Checks that every AWS EC2 machine image boots from an EBS-backed root volume, which unlike ephemeral local disk can be encrypted at rest.

Every record must satisfy: Root Device Type equals "ebs". The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

AWS - EC2 Instances Stopped For More Than 90 Days

Flags EC2 instances that have been sitting in a stopped state for more than 90 days so dormant compute can be reviewed or decommissioned.

A record is sent for review when: State equals "stopped" and State Transition Time is empty. A record is marked failed when: State equals "stopped" and State Transition Time is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - Running EC2 Instances Do Not Expose Public IPv4 Addresses

Flags running EC2 instances that have a public IPv4 address so internet-reachable compute is reviewed and justified.

A record is marked failed when: State equals "running" and Public IP Address has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Running EC2 Instances Do Not Expose Public IPv6 Addresses

Flags running EC2 instances that carry a globally routable IPv6 address.

A record is marked failed when: State equals "running" and IPv6 Address has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - Aurora Instances Are Attached To A VPC

Checks that Aurora database instances are attached to a VPC.

Every record must satisfy: Instance Identifier has a value and VPC has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - Aurora Instances Report An Available Status

Checks that Aurora database instances report an available operational status.

Every record must satisfy: Instance Identifier has a value and Status equals "Available". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - RDS Instance Inventory Complete And VPC-Attached

Checks that each Amazon RDS database instance record identifies its engine, size and VPC so the database inventory is complete.

Every record must satisfy: Instance Identifier has a value and Engine has a value and Size has a value and VPC has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - RDS Instances Configured For Multi-AZ

Checks that every Amazon RDS database instance in the evidence is deployed with Multi-AZ redundancy.

Every record must satisfy: Instance Identifier has a value and Multi-AZ is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - WAF Rule Groups Are Fully Identified In Inventory

Confirms every WAF rule group in the evidence carries a name, an identifier, and a well-formed ARN so the inventory is complete and traceable.

Every record must satisfy: Name has a value and Rule Group ID has a value and Rule Group ARN matches the pattern "^arn:aws[a-z-]*:wafv2:". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Inventory maintained for EC2, EKS, RDS, Lambda, and more

Examine: Inventory records for infrastructure components

Every record must satisfy: Instance ID has a value and Instance Type has a value and Availability Zone has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Default Security Group Denies All Inbound Traffic

Flags any default security group that still carries inbound rules, so unassigned resources cannot inherit permissive network access.

A record is marked failed when: Security Group Name equals "default" and Inbound Rules is greater than 0. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - Security Group Inventory Attributes Are Complete

Checks that every security group records an ID, name, owning account, parent network, and a description explaining its purpose.

Every record must satisfy: Security Group ID has a value and Security Group Name has a value and VPC ID has a value and Description has a value and Owner has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Default Security Group Denies All Outbound Traffic

Flags a VPC default security group that still has outbound rules attached.

A record is marked failed when: Security Group Name equals "default" and Outbound Rules is greater than 0. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - EBS Snapshots Are Encrypted At Rest

Checks that every block storage snapshot in the report is encrypted at rest and carries a snapshot identifier.

Every record must satisfy: Snapshot ID has a value and Encryption is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - EBS Snapshots Completed Successfully

Checks that every block storage snapshot in the report reached a completed state and records the time it was started.

Every record must satisfy: Snapshot ID has a value and Status equals "completed" and Started has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Identity Center SSO Users Carry A User Name And User Id

Checks that every IAM Identity Center SSO user record carries both a user name and a unique user identifier so access reviews can be completed.

Every record must satisfy: User Name has a value and User ID has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

CIDR ranges reviewed

Examine: CIDR assignments and VPC/subnet allocation documentation

Every record must satisfy: Subnet ID has a value and State equals "available" and VPC ID has a value and IPv4 CIDR has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Public/private subnet separation enforced

Checks that every subnet returned carries a subnet id, its parent VPC id and an IPv4 CIDR block, so each subnet in the proof is identifiable and attributable to a VPC. Does not establish that every subnet in the account was collected. Does not determine whether a subnet is public or private: the proof does not expose mapPublicIpOnLaunch or route table associations.

Every record must satisfy: Subnet ID has a value and VPC ID has a value and IPv4 CIDR has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Routing tables reviewed

Examine: Route table configurations and change control documentation

Every record must satisfy: Subnet ID has a value and IPv4 CIDR has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

VPC configurations documented per region

Checks that every subnet returned carries a subnet id, its parent VPC id and an IPv4 CIDR block across the collected regions.

Every record must satisfy: Subnet ID has a value and VPC ID has a value and IPv4 CIDR has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - IAM Users With Console Passwords Unused For 90 Days

Flags AWS IAM users whose console password has not been used in the last 90 days so dormant accounts can be reviewed, disabled, or removed.

A record is sent for review when: Password Last Used is empty. A record is marked failed when: Password Last Used is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - IAM Users Do Not Rely On SMS MFA

Flags AWS IAM users enrolled in SMS text-message MFA, which is weaker than app-based or hardware security key authenticators.

A record is marked failed when: MFA Devices contains "SMS". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS - IAM Users Have An MFA Device Enrolled

Checks that every AWS IAM user in the evidence has at least one multi-factor authentication device enrolled.

Every record must satisfy: MFA equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

MFA enabled for all users with console or privileged access

Confirm MFA is enforced via IAM policies or service control policies (SCPs) for all users with console or privileged access

Every record must satisfy: MFA contains "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - EBS Volumes Are Encrypted At Rest

Checks that every block storage volume in the report is encrypted at rest and records its identifier and lifecycle state.

Every record must satisfy: Volume ID has a value and State has a value and Encryption is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

VPC flow logging enabled

Verify that flow logging is enabled for all VPCs and traffic is directed to a secure destination (e.g., CloudWatch, S3)

Every record must satisfy: VPC ID has a value and State equals "available". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - EKS Deployments Have Available Pods And No Unavailable Replicas

Checks that every deployed workload has at least one available pod and reports zero failed replicas at the time evidence was collected.

Every record must satisfy: Name has a value and Pod Count is greater than 0 and Status matches the pattern "(^|[^0-9])0 Failed". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - EKS Workloads Are Not Deployed In The Default Namespace

Checks that every Kubernetes workload runs in a purpose-named namespace instead of the default namespace, so resources stay separated and policy can be scoped.

Every record must satisfy: Name has a value and Namespace has a value and Namespace does not equal "default". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - Lambda Deployment Packages Are Encrypted With A Customer Managed KMS Key

Checks that serverless function deployment packages are encrypted with a customer managed key.

Every record must satisfy: Encryption equals "Yes" and AWS KMS Key has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - Lambda Execution Roles Do Not Use Broadly Privileged Role Names

Flags serverless functions whose execution role name indicates broad or administrative privilege.

A record is sent for review when: IAM Role matches the pattern ":role/.*(Administrator|PowerUser|FullAccess)". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS - Backup Restore Test Jobs Completed Successfully

Checks that every restore test job run during the reporting period finished in a completed state with a recorded completion time.

Every record must satisfy: Restore Job Id has a value and Status equals "COMPLETED" and Completion Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - Backup Restore Test Validation Did Not Fail

Checks that no restore test job reported a failed or timed-out validation result, so restored data is confirmed usable and not just recoverable.

A record is sent for review when: Validation Status equals "VALIDATING". Every record must satisfy: Restore Job Id has a value and Validation Status is none of "FAILED" or "TIMED_OUT". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

S3 bucket ACLs are private or restrictive

Examine: S3 ACL configurations and AWS Config rules

Every record must satisfy: Grantee ID has a value and Grantee Type equals "CanonicalUser" and Permission has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

S3 buckets encrypted at rest using AWS-managed or customer-managed KMS keys

Verifies that S3 buckets are encrypted at rest using AWS-managed or customer-managed KMS keys. Verify that BucketEncryption is enabled and SSEAlgorithm is either aws:kms or AES256.

Every record must satisfy: Bucket has a value and Encryption Key Type has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS - S3 Bucket Lifecycle Rules Are Enabled

Checks that every S3 bucket lifecycle rule in the proof is in an enabled state rather than disabled.

Every record must satisfy: Bucket has a value and Status equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS - S3 Lifecycle Rules Do Not Expire Current Objects Within 90 Days

Flags S3 lifecycle rules that expire current object versions in fewer than 90 days.

A record is marked failed when: Status equals "Enabled" and Action equals "Expire" and Applies to equals "Current Objects" and Days to Transition is less than 90. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

If used for backup, S3 replication configuration supports contingency

Examine: S3 replication rules and target regions

Every record must satisfy: Bucket has a value and Replication Rule Name has a value and Status equals "Enabled" and Destination Bucket has a value. The test passes if at least 50% of records pass. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

S3 bucket versioning configuration documented

Examine: S3 configuration and versioning policy

Every record must satisfy: Bucket has a value and Bucket Versioning equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - Backup Plan Rules Copy To A Secondary Vault

Checks that each backup plan rule copies backups to a secondary vault so a single vault is not the only copy.

Every record must satisfy: Destination Backup Vault ARN has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS (Single Account) - Backup Plan Rules Target A Vault And Cover Resources

Checks that each backup plan rule names a destination vault and that the plan has at least one resource selection assigned.

Every record must satisfy: Backup Plan Name has a value and Rule Name has a value and Target Backup Vault Name has a value and Backup Selections does not equal "[]". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS IAM Password Policy Enforces Character Complexity

Verifies the account password policy requires uppercase, lowercase, number, and symbol characters (NIST 800-53 Rev5 IA-5(1)). Checks booleanField.requireUppercase/requireLowercase/requireNumbers/requireSymbols.

Every record must satisfy: Require Uppercase is true and Require Lowercase is true and Require Numbers is true and Require Symbols is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS IAM Password Policy Prevents Reuse Of Last 24 Passwords

Verifies the account password policy prevents reuse of at least the previous 24 passwords (NIST 800-53 Rev5 IA-5(1); CIS AWS Foundations 1.9). Checks numberField.passwordReuseCount; an unset reuse count yields NeedsReview at threshold 1.0.

Every record must satisfy: Password Reuse Count is 24 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS IAM Password Policy Requires 14+ Character Minimum Length

Verifies the account password policy enforces a minimum length of at least 14 characters (NIST 800-53 Rev5 IA-5(1); CIS AWS Foundations 1.8). Checks numberField.minPasswordLength.

Every record must satisfy: Minimum Password Length is 14 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

IAM Password Policy Enforces Complexity And Reuse Prevention

CIS AWS 1.9 / NIST 800-53 Rev5 IA-5(1): verify the IAM account password policy requires symbols, numbers, uppercase and lowercase characters, and prevents reuse of the last 24 passwords. Fields: requireSymbols, requireNumbers, requireUppercase, requireLowercase, passwordReuseCount.

Every record must satisfy: Require Symbols is true and Require Numbers is true and Require Uppercase is true and Require Lowercase is true and Password Reuse Count is 24 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS RDS Instances Have Storage Encryption Enabled

Verifies every RDS database instance has storage encryption enabled at rest (NIST 800-53 Rev5 SC-28; CIS AWS Foundations 2.3.1).

Every record must satisfy: Storage Encrypted is true. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

AWS (Single Account) - Backup Plans Have Executed Within The Last 35 Days

Flags backup plans that have not run in more than 35 days, so gaps in backup coverage are caught before they matter.

A record is marked failed when: Last Execution Date is more than 35 days in the past. A record is sent for review when: Last Execution Date is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - Client VPN Endpoints Are Documented And Use Private Client CIDR Ranges

Checks that every Client VPN endpoint records a description of its purpose and issues client addresses from a private, non-internet-routable range.

A record is marked failed when: Description is empty. A record is marked failed when: Client CIDR does not match the pattern "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS EC2 Instances Report An Active SSM Inventory Agent

Verifies every inventoried EC2 instance has an Active SSM agent so patch and configuration state can be managed and reported (NIST 800-53 Rev5 CM-8/SI-2). Checks textField.instanceStatus equals the display value 'Active'.

Every record must satisfy: Instance Status equals "Active". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - EC2 AMIs Are Not Publicly Shared

Verifies no EC2 Amazon Machine Image is shared publicly, which could expose baked-in secrets or data (NIST 800-53 Rev5 AC-3/SC-7). Checks textField.visibility equals the display value 'private'.

Every record must satisfy: Visibility equals "private". The test passes only if every record passes. If the proof contains no records, the test is marked passed.

AWS EC2 AMIs Rebuilt Within The Last Year

Flags AMIs that have not been rebuilt in the last year, since an image bakes in the patch level it was created with.

A record is sent for review when: Creation Date is empty. A record is marked failed when: Creation Date is more than 365 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - Running EC2 Instances Do Not Expose Public IPv4 Addresses

Flags running EC2 instances that carry a public IPv4 address.

A record is marked failed when: IP Address has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS EC2 Instances Have Detailed Monitoring Enabled

Verifies each running EC2 instance has detailed CloudWatch monitoring enabled to support continuous monitoring and anomaly detection (NIST 800-53 Rev5 SI-4/AU-12). Checks textField.monitoring equals the display value 'enabled'.

Every record must satisfy: Monitoring equals "enabled". The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

EC2 Security Groups Are VPC Scoped And Documented

NIST 800-53 Rev5 CM-8 SC-7: verify every EC2 security group belongs to a VPC (no legacy EC2-Classic) and carries a non-empty description for inventory/attack-surface governance. Fields: vpcID, description.

Every record must satisfy: VPC ID has a value and Description has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS EBS Snapshots Are Encrypted At Rest

Verifies every EBS snapshot is encrypted at rest (NIST 800-53 Rev5 SC-28). Checks booleanField.encryption is true.

Every record must satisfy: Encryption is true. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

AWS EBS Snapshots Completed Successfully

Flags EBS snapshots that did not reach the completed state.

A record is marked failed when: Status equals "error". A record is sent for review when: Status does not equal "completed". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS EBS Volumes Are Encrypted At Rest

Verifies every EBS volume is encrypted at rest (NIST 800-53 Rev5 SC-28; CIS AWS Foundations 2.2.1). Checks booleanField.encryption is true.

Every record must satisfy: Encryption is true. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

EC2 EBS Volumes Encrypted At Rest

CIS AWS 2.2.1 / NIST 800-53 Rev5 SC-28: verify every EBS volume is encrypted at rest. Fields: encryption (boolean), id.

Every record must satisfy: Encryption is true and Volume Id has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - EKS Clusters Are Active And Not Running An End Of Life Kubernetes Version

Confirms each Kubernetes cluster is in an active state and is not running a release that has reached end of life.

Every record must satisfy: Status equals "ACTIVE" and Kubernetes Version has a value and Kubernetes Version does not match the pattern "^1\.([12][0-9]|30)$". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS IAM Groups Do Not Use Inline Policies

Verifies IAM groups attach managed policies rather than inline policies, supporting least-privilege review and reuse (NIST 800-53 Rev5 AC-6; CIS AWS Foundations 1.15). Checks booleanField.inlinePolicy is false.

Every record must satisfy: Inline Policy is false. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

AWS (Single Account) - IAM Role Maximum Session Duration Is Not Excessive

Flags IAM roles whose maximum session duration is eight hours or longer.

A record is marked failed when: Session Duration matches the pattern "^([89]|1[0-2]) hours". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS (Single Account) - IAM Roles Do Not Trust Wildcard Principals

Flags IAM roles whose trust policy can be assumed by any principal, so overly open role access can be found and corrected.

A record is marked failed when: Trusted Entity contains "*". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - IAM SAML Provider Federation Metadata Is Not Expired

Checks that each SAML identity provider used for federated sign-in has valid metadata that is not expired or expiring within 30 days.

A record is sent for review when: Expiration Time is empty. A record is marked failed when: Expiration Time is less than 30 days in the future. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - IAM Console Credentials Unused For More Than 90 Days

Flags IAM users whose console password has not been used in more than 90 days so dormant credentials can be reviewed and disabled.

A record is sent for review when: Password Last Used is empty. A record is marked failed when: Password Last Used is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS IAM Users Have MFA Enabled

Verifies every IAM user with console access has an MFA device enrolled (NIST 800-53 Rev5 IA-2(1); CIS AWS Foundations 1.10). Checks textField.mfa contains the display value 'MFA Enabled'.

Every record must satisfy: MFA contains "MFA Enabled". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - IAM Users Enrolled In Phishing-Resistant MFA

Checks that IAM users are protected by a FIDO security key rather than only SMS or authenticator-app multi-factor methods.

Every record must satisfy: MFA Devices contains "U2F". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS (Single Account) - IAM Users Have An MFA Device Enrolled

Checks that every IAM user in the evidence has at least one multi-factor authentication device enrolled.

Every record must satisfy: MFA equals "MFA Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - Security Hub Finding Providers Are Enabled And Identified

Confirms Security Hub has at least one finding provider enabled for import and that each enabled provider is identified by product and vendor name.

Every record must satisfy: Product Name has a value and Company Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - Custom Network ACLs Do Not Allow Unrestricted Inbound Traffic

Flags customer-managed network ACL rules that allow inbound traffic from any IPv4 or IPv6 address.

A record is marked failed when: Default equals "No" and Rule Number contains "Inbound Rule:" and Action equals "allow" and Source/Destination matches the pattern "^(0\.0\.0\.0/0|::/0)$". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS (Single Account) - Subnet-Associated Network ACLs Do Not Allow Unrestricted Outbound Traffic

Flags customer-managed network ACLs in use on a subnet that allow outbound traffic to any IPv4 or IPv6 destination.

A record is marked failed when: Default equals "No" and Associated With is 1 or more and Rule Number contains "Outbound Rule:" and Action equals "allow" and Source/Destination matches the pattern "^(0\.0\.0\.0/0|::/0)$". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Security Hub Findings Are Triaged

NIST 800-53 Rev5 IR-4 CA-7: verify no active Security Hub finding is left in the untriaged NEW workflow state. A row is a violation (Failed) when recordState is ACTIVE and workflowStatus is NEW. Fields: recordState, workflowStatus (WorkflowState).

A record is marked failed when: Record State equals "ACTIVE" and Workflow Status equals "NEW". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS Security Hub Has No Critical Or High Severity Findings

Verifies Security Hub reports no CRITICAL or HIGH severity findings, indicating vulnerabilities are remediated within SLA (NIST 800-53 Rev5 RA-5/SI-2). Checks textField.severity is neither 'CRITICAL' nor 'HIGH'.

Every record must satisfy: Severity is none of "CRITICAL" or "HIGH". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

No Active Failed Security Hub Findings

NIST 800-53 Rev5 RA-5 CA-7: verify no Security Hub finding is both an active record and a failed compliance check. A row is a violation (Failed) when recordState is ACTIVE and status is FAILED. Fields: status (Compliance.Status), recordState.

A record is marked failed when: Status equals "FAILED" and Record State equals "ACTIVE". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - IAM Identity Center SSO Users Are Individually Identifiable

Flags single sign-on accounts that use a generic or shared name such as admin, root, or service instead of identifying an individual person.

A record is sent for review when: User Name is empty. A record is marked failed when: User Name matches the pattern "^([Aa][Dd][Mm][Ii][Nn]([Ii][Ss][Tt][Rr][Aa][Tt][Oo][Rr])?|[Rr][Oo][Oo][Tt]|[Gg][Uu][Ee][Ss][Tt]|[Ss][Hh][Aa][Rr][Ee][Dd]|[Ss][Vv][Cc]|[Ss][Ee][Rr][Vv][Ii][Cc][Ee]|[Tt][Ee][Ss][Tt])[-_.0-9]*(@[^@]*)?$". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS (Single Account) - Subnets Are Available And Mapped To A Parent VPC

Checks that every subnet is in the available state and records the subnet ID, parent VPC, and IPv4 CIDR block it belongs to.

Every record must satisfy: State equals "available" and Subnet Id has a value and VPC ID has a value and IPv4 CIDR has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS (Single Account) - Subnets Use Private RFC 1918 IPv4 CIDR Ranges

Checks that every subnet is carved from a private, non-internet-routable IPv4 range rather than public address space.

Every record must satisfy: IPv4 CIDR matches the pattern "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - Default VPC Does Not Exist

Checks that no virtual private cloud in the selected regions is the provider-created default VPC, so network boundaries rest on purpose-built, reviewed networks. DescribeVpcs reports only whether a VPC is the default; it says nothing about whether workloads use it.

Every record must satisfy: Default equals "No". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS (Single Account) - VPC IPv4 CIDR Blocks Use Private Address Space

Checks that each virtual private cloud's primary IPv4 CIDR block falls within private, non-internet-routable address space.

Every record must satisfy: IPv4 CIDR matches the pattern "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.)". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - S3 Bucket ACL Contains Only A Canonical-User FULL_CONTROL Grant

Checks that every entry in a bucket's access control list is a canonical-user FULL_CONTROL grant with no email grantee - the ACL shape left behind when Object Ownership is set to BucketOwnerEnforced. The grant rows carry no bucket-owner identity, so a cross-account canonical-user grant is not distinguishable here.

Every record must satisfy: Permission equals "FULL_CONTROL" and Grantee ID has a value and Grantee Email is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS S3 Buckets Use Default Server-Side Encryption

Verifies each S3 bucket has default server-side encryption set to AES256, aws:kms, or aws:kms:dsse (NIST 800-53 Rev5 SC-28; CIS AWS Foundations 2.1.1). Checks textField.keyType against the valid SSE algorithms.

A record is marked failed when: SSE Algorithm is empty. A record is marked failed when: SSE Algorithm is none of "AES256", "aws:kms" or "aws:kms:dsse". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

S3 Buckets Encrypted With KMS Keys

NIST 800-53 Rev5 SC-28(1) / SC-12: verify S3 buckets use SSE-KMS (aws:kms) with a real KMS key managed for the bucket, rather than SSE-S3 only. Fields: keyType, kmsKey (kmsKey is 'NA' when no KMS key is bound).

Every record must satisfy: SSE Algorithm equals "aws:kms" and KMS Key ID does not equal "NA". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - S3 Lifecycle Actions Trigger On Object Age Not A Fixed Date

Confirms S3 lifecycle actions are triggered by how old an object is rather than a fixed calendar date, so the schedule keeps applying instead of firing once and stopping.

Every record must satisfy: Transition Date is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS (Single Account) - S3 Lifecycle Rules Are Named And Enabled

Confirms each S3 bucket lifecycle rule is named and in an enabled state, so the retention and cleanup schedule is actually being applied to objects in the bucket.

Every record must satisfy: Rule has a value and Status equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS S3 Buckets Have Object Lock Enabled

Verifies each S3 bucket has Object Lock enabled to provide write-once-read-many (WORM) immutability for retained data (NIST 800-53 Rev5 AU-9/CP-9). Checks textField.enabled equals the display value 'Enabled'.

Every record must satisfy: Enabled equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

AWS S3 Object Lock Is Enabled With A Default Retention Period

Flags buckets with Object Lock enabled but no default retention period configured.

A record is marked failed when: Enabled equals "Enabled" and Retention Period equals "NA". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AWS S3 Buckets Are Not Publicly Accessible

Verifies each S3 bucket's policy status is Private, not Public (NIST 800-53 Rev5 AC-3/SC-7; CIS AWS Foundations 2.1.5). Checks textField.policyType equals the display value 'Private'.

Every record must satisfy: Policy Type equals "Private". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - S3 Bucket Replication Rule Is Enabled With A Destination Bucket

Confirms the bucket has a named replication rule that is enabled and points at a destination bucket, so a second copy of the data is being maintained.

Every record must satisfy: Replication Rule Name has a value and Status equals "Enabled" and Destination Bucket has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS S3 Buckets Have Versioning Enabled

Verifies each S3 bucket has object versioning enabled to protect against accidental or malicious deletion (NIST 800-53 Rev5 CP-9/SI-1; CIS AWS Foundations 2.1.2). Checks textField.status equals the display value 'Enabled'.

Every record must satisfy: Bucket Versioning equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

S3 Bucket MFA Delete Enabled

NIST 800-53 Rev5 CP-9 SC-28: verify MFA Delete is Enabled on versioned S3 buckets so object/version deletion requires MFA. Field: mfa (Enabled | Disabled | Never Enabled).

Every record must satisfy: Multifactor Authentication Delete equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

AWS (Single Account) - Default Security Group Does Not Permit Traffic

Flags any traffic rule configured on a default security group, which should not permit inbound or outbound traffic.

A record is marked failed when: Security Group Name equals "default" and Network Rules has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AWS (Single Account) - Security Group Inbound Rules Do Not Expose Non-Web Ports To The Internet

Flags security group inbound rules that are open to the entire internet on ports other than the standard web ports.

A record is marked failed when: Network Rules matches the pattern "^Inbound:.*"destination":"(0\.0\.0\.0/0|::/0)".*$" and Network Rules does not match the pattern "^Inbound:.*"portRange":"(80|443)".*$". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Activity Log Entries Are Within Retention Window

Verifies Azure activity-log entries are present and were recorded within the last 90 days, evidencing that management-plane logging is active and retained (NIST 800-53 Rev5 AU-2 / AU-11); checks timeStamp is not more than 90 days ago.

A record is sent for review when: Timestamp is empty. A record is marked failed when: Timestamp is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Firewall Boundary Devices Are Fully Identified in the Inventory

Checks that every row of the Azure Firewall evidence is a real firewall resource with a name and an owning resource group.

Every record must satisfy: Type equals "Microsoft.Network/azureFirewalls" and Name has a value and Resource Group has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure SQL Database Uses Geo-Redundant Backup Storage

Verifies Azure SQL databases use geo-redundant backup storage so backups survive a regional outage (NIST 800-53 Rev5 CP-6 / CP-9); checks backupStorageRedundancy contains Geo.

Every record must satisfy: Backup Storage Redundancy contains "Geo". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure SQL Databases Retain Backups for at Least Seven Days

NIST SP 800-53 CP-9: conduct system backups and retain them to support recovery. Verifies every Azure SQL database short-term backup retention policy keeps backups for at least 7 days.

Every record must satisfy: Backup Retention Days is 7 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure SQL Databases Retain Point-in-Time Backups for at Least 30 Days

NIST SP 800-53 CP-9: conduct and retain system backups sufficient for recovery. Verifies every Azure SQL database short-term (point-in-time restore) retention policy keeps backups for at least 30 days.

Every record must satisfy: Backup Retention Days is 30 or more. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure Firewall Policies Enable Threat Intelligence Filtering

NIST SP 800-53 SC-7: monitor and control communications at external boundaries. Verifies every Azure Firewall policy enables threat intelligence-based filtering (threat intel mode is not Off).

Every record must satisfy: Threat Intel Mode does not equal "Off". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure Firewall IDPS Signatures Actively Block Traffic

Verifies Azure Firewall Premium IDPS signatures are set to block (deny) rather than alert-only so intrusions are prevented, not just logged (NIST 800-53 Rev5 SI-4 / SC-7); checks the alertOnly flag is false.

Every record must satisfy: Alert Only is false. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Defender Security Alerts Have Been Triaged

Verifies Microsoft Defender for Cloud security alerts are not left in an Active state (must be Resolved or Dismissed) evidencing incident handling (NIST 800-53 Rev5 IR-4 / SI-4); checks alert status.

A record is marked failed when: Status is none of "Resolved" or "Dismissed". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure App Configuration Stores Are Located in United States Regions

Checks that every Azure App Configuration store is deployed in a United States region, which is where its configuration data resides.

Every record must satisfy: Location matches the pattern "^(eastus|westus|centralus|northcentralus|southcentralus|westcentralus|usgov|usdod|usnat|ussec)|(^| )US( |$|[0-9])|^United States". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure App Configuration Stores Use a SKU That Supports Private Link

Checks that every Azure App Configuration store runs on a pricing tier that supports private endpoints, so store traffic does not have to traverse a public endpoint.

Every record must satisfy: Pricing Tier does not equal "Free" and Pricing Tier has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure Backup Jobs Complete Successfully

NIST SP 800-53 CP-9: system backup. Verifies every Azure backup job in the proof period finished with a Completed status, confirming backups are running successfully.

Every record must satisfy: Status equals "Completed". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure Backup Jobs Did Not Fail

NIST SP 800-53 CP-9: ensure backups run reliably. Verifies no Azure backup job in the proof period ended in a Failed status (Completed, CompletedWithWarnings, and InProgress are acceptable), surfacing backup failures for follow-up.

Every record must satisfy: Status does not equal "Failed". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure Backup Policies Are Scheduled at Least Daily

Checks that every backup policy in the Recovery Services vault runs on a daily or hourly schedule rather than weekly or less often.

Every record must satisfy: Frequency is none of "Weekly" or "Monthly" and Frequency has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure MySQL Server Backup Completed Recently

Verifies each Azure MySQL server backup completed within the last 8 days so restore points stay current (NIST 800-53 Rev5 CP-9); checks completedTime is not more than 8 days ago.

Every record must satisfy: Time of Completion has a value. A record is marked failed when: Time of Completion is more than 8 days in the past. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure PostgreSQL Flexible Server Backup Completed Recently

Verifies each Azure PostgreSQL flexible-server backup completed within the last 8 days so restore points stay current (NIST 800-53 Rev5 CP-9); checks completedTime is not more than 8 days ago.

Every record must satisfy: Time of Completion has a value. A record is marked failed when: Time of Completion is more than 8 days in the past. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure MySQL Servers Run A Supported Major Version

Verifies Azure MySQL servers run a supported major version (8.x); 5.7 and earlier are end-of-life and unpatched (NIST 800-53 Rev5 SI-2 / CM-6); checks the version starts with 8.

Every record must satisfy: Version matches the pattern "^8\.". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Azure PostgreSQL Servers Run A Supported Major Version

Verifies Azure PostgreSQL flexible servers run a supported major version (13 or newer); versions 12 and earlier are end-of-life (NIST 800-53 Rev5 SI-2 / CM-6); checks the version major number.

Every record must satisfy: Version matches the pattern "^(1[3-9]|[2-9][0-9])". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Azure SQL Databases Enable Infrastructure Encryption

NIST SP 800-53 SC-28: protect the confidentiality and integrity of information at rest. Verifies every Azure SQL database has infrastructure (double) encryption enabled.

Every record must satisfy: Encrypted is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure SQL Databases Located Outside United States Regions

Flags Azure SQL databases located outside United States regions.

A record is marked failed when: Location has a value and Location does not match the pattern "^(eastus|westus|centralus|northcentralus|southcentralus|westcentralus|usgov|usdod|usnat|ussec)|(^| )US( |$|[0-9])|^United States". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Azure SQL Databases Run a Supported Engine Version

NIST SP 800-53 CM-2 / SI-2: maintain supported, patched software baselines. Verifies every Azure SQL database reports a v12.0 engine generation (the current supported Azure SQL Database version family).

Every record must satisfy: Version contains "v12.0". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Azure Managed Disks Are Encrypted With Customer-Managed Keys

NIST SP 800-53 SC-12 / SC-28(1): manage cryptographic keys under organizational control. Verifies every Azure managed disk uses a customer-managed key, either alone (EncryptionAtRestWithCustomerKey) or alongside the platform key (EncryptionAtRestWithPlatformAndCustomerKeys), rather than only a platform-managed key.

A record is marked failed when: Encryption Type is none of "EncryptionAtRestWithCustomerKey" or "EncryptionAtRestWithPlatformAndCustomerKeys". A record is marked failed when: Encryption Type is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure Managed Disks Report an Encryption Type

NIST SP 800-53 SC-28: protect the confidentiality and integrity of information at rest. Verifies every Azure managed disk reports a configured at-rest encryption type.

Every record must satisfy: Encryption Type has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure Managed Disks Use a Recognized At-Rest Encryption Type

NIST SP 800-53 SC-28: protect information at rest with approved encryption. Verifies every Azure managed disk reports a recognized server-side encryption type (platform-managed key, customer-managed key, or platform-and-customer key), confirming at-rest encryption is in a known-good configuration.

A record is marked failed when: Encryption Type is none of "EncryptionAtRestWithPlatformKey", "EncryptionAtRestWithCustomerKey" or "EncryptionAtRestWithPlatformAndCustomerKeys". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Managed Disks Are Encrypted At Rest

Verifies every Azure managed disk has server-side encryption at rest enabled (NIST 800-53 Rev5 SC-28); checks the encryptionEnabled flag.

Every record must satisfy: Encrypted is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Critical Resources Protected By Management Lock

Verifies resources carry a CanNotDelete or ReadOnly management lock to prevent accidental or unauthorized deletion/modification (NIST 800-53 Rev5 CM-3 / CP-9); checks the lock level (Delete / Read only).

A record is marked failed when: Lock Type is none of "Delete" or "Read only". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Network Security Groups Are Inventoried And Scoped To A Resource Group

Checks that the network security group inventory is not empty and that every group is attributed to the resource group that owns it.

Every record must satisfy: Resource Group has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Resource Groups Located Outside United States Regions

Flags any resource group whose region falls outside the United States, so workloads placed in unintended geographies are surfaced.

A record is marked failed when: Location has a value and Location does not match the pattern "US|United States". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Retired Azure Classic Deployment Model Resources Are Not In Use

Flags Azure resources still using the retired classic deployment model, which modern access control and policy governance cannot manage.

A record is marked failed when: Resource has a value and Resource Type matches the pattern "^Microsoft\.Classic". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Owner Role Assignments Are Reviewed

Routes Azure RBAC assignments of the built-in Owner role to review as privileged access.

A record is sent for review when: Role equals "Owner". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Azure RBAC Assignments Resolve To A Known Principal

Verifies every Azure role assignment resolves to a known principal type (User, Group, ServicePrincipal, ForeignGroup, or Device) rather than an orphaned/Unknown identity left behind by a deleted account (NIST 800-53 Rev5 AC-2 / AC-3); checks principalType.

A record is marked failed when: Type is none of "User", "Group", "ServicePrincipal", "ForeignGroup" or "Device". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Virtual Machines Have Secure Boot Enabled

Verifies each Azure VM has Secure Boot enabled to protect against boot-level rootkits and unsigned firmware (NIST 800-53 Rev5 SI-7 / CM-6); checks the secureBootEnabled field.

Every record must satisfy: Secure Boot Enabled equals "Yes". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure VPN Gateways Use Route-Based Connections

Verifies virtual network gateways use the RouteBased VPN type, which supports modern IKEv2/strong ciphers unlike legacy PolicyBased gateways (NIST 800-53 Rev5 SC-7 / SC-8); checks the gateway type.

Every record must satisfy: Type contains "RouteBased". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure PostgreSQL Server Logs Are Recently Collected

Verifies Azure PostgreSQL server log files were collected within the last 30 days, evidencing that database logging is enabled and current (NIST 800-53 Rev5 AU-2 / AU-4); checks lastModified is not more than 30 days ago.

A record is sent for review when: Last Modified is empty. A record is marked failed when: Last Modified is more than 30 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure MySQL Flexible Servers Enforce TLS 1.2 or Higher

NIST SP 800-53 SC-8: protect the confidentiality and integrity of transmitted information. Verifies every Azure Database for MySQL flexible server sets a minimum TLS version of 1.2 (the tls_version parameter does not permit TLS 1.0 or 1.1).

Every record must satisfy: Minimum TLS Version does not match the pattern "[Tt][Ll][Ss][Vv]?1(\.[01])?(,|$)|[Tt][Ll][Ss]1_[01](,|$)" and Minimum TLS Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure PostgreSQL Flexible Servers Require Secure Transport

NIST SP 800-53 SC-8: protect the confidentiality and integrity of transmitted information. Verifies every Azure Database for PostgreSQL flexible server enforces encrypted (TLS) connections by setting require_secure_transport to ON.

Every record must satisfy: Require Secure Transport equals "True". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Azure PostgreSQL Flexible Servers Set Minimum TLS 1.2

NIST SP 800-53 SC-8: protect the confidentiality and integrity of transmitted information. Verifies every Azure Database for PostgreSQL flexible server sets ssl_min_protocol_version to TLSv1.2 or TLSv1.3, disallowing the deprecated TLSv1 and TLSv1.1.

A record is marked failed when: Minimum TLS Version is none of "TLSv1.2" or "TLSv1.3". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Azure Defender for Cloud Recommendations Are Resolved

NIST SP 800-53 RA-5: monitor and scan for vulnerabilities and remediate findings. Verifies every Microsoft Defender for Cloud recommendation is in a completed (healthy) state.

Every record must satisfy: Status equals "Completed". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Deployment Approval Policy Names Explicit Approvers

Segregation of duties / accountability: verifies the pre-deployment approval policy lists named approvers rather than an empty/automated approver set. Maps to NIST 800-53 Rev5 CM-5 (access restrictions for change) and AC-5, and ISO/IEC 27001:2022 Annex A A.5.3 (segregation of duties) and A.8.32. Checks textField.approvers is populated on the deploymentApprovalPolicy proof.

Every record must satisfy: Approvers has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Deployment Environment Requires Pre-Deployment Approval

Change control: verifies the release environment's pre-deployment approval gate is enabled (not fully automated). Maps to NIST 800-53 Rev5 CM-3 / CM-5, CMMC 2.0 / NIST 800-171 3.4.5, and ISO/IEC 27001:2022 Annex A A.8.32 (change management). Checks booleanField.enabled on the deploymentApprovalPolicy proof.

Every record must satisfy: Enabled is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Every Deployment Has A Recorded Approver

Change control evidence: verifies each release deployment carries a recorded approver, so no change reached the environment without approval. Maps to NIST 800-53 Rev5 CM-3 (configuration change control) and SA-11, and ISO/IEC 27001:2022 Annex A A.8.32 (change management). Checks textField.approvedBy is populated on each deployments row.

Every record must satisfy: Approved By has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Every Deployment Is Attributable To An Identity

Accountability / audit trail: verifies each deployment records who initiated it so releases are traceable to an individual or trusted automation identity. Maps to NIST 800-53 Rev5 AU-12 and CM-3, CMMC 2.0 / NIST 800-171 3.3.2 (traceability to individual users), and ISO/IEC 27001:2022 Annex A A.8.15 (logging). Checks textField.deployedBy is populated on each deployments row.

Every record must satisfy: Deployed By has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

No Organization User Account Is Inactive Beyond 90 Days

Inactive-account review: verifies every member has accessed the organization within the last 90 days, flagging dormant accounts that should be disabled. Maps to NIST 800-53 Rev5 AC-2(3) (disable inactive accounts), CMMC 2.0 / NIST 800-171 3.1.1, and ISO/IEC 27001:2022 Annex A A.5.18 (access rights review). Checks dateField.lastAccessed is not more than 90 days ago on each listOfUsers row.

A record is sent for review when: Last Accessed is empty. A record is marked failed when: Last Accessed is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Organization User Accounts Have An Identifiable Email

Account management: verifies every organization member has an email address on file, guarding against shared/anonymous accounts and supporting access recertification. Maps to NIST 800-53 Rev5 AC-2 (account management), CMMC 2.0 / NIST 800-171 3.5.1, and ISO/IEC 27001:2022 Annex A A.5.16 (identity management). Checks textField.email is populated on each listOfUsers row.

Every record must satisfy: Email has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Permission Group Members Are Attributed To A Group

Authorization records: verifies each user surfaced in the permission-group membership proof is attributed to at least one named group, giving auditors a clean least-privilege authorization record. Maps to NIST 800-53 Rev5 AC-2 / AC-6 (least privilege), CMMC 2.0 / NIST 800-171 3.1.5, and ISO/IEC 27001:2022 Annex A A.5.18 (access rights). Checks textField.memberOf is populated on each membersInPermissionGroup row.

Every record must satisfy: Member Of has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AKS API Server Is a Private Cluster

Verifies each AKS cluster is provisioned as a private cluster so the Kubernetes API server endpoint is not exposed to the public internet and is only reachable over the private network. Maps to CIS Kubernetes Benchmark / AKS hardening (restrict API server access), NIST 800-53 Rev5 SC-7 (boundary protection) and AC-17 (remote access), and ISO/IEC 27001:2022 Annex A.8.20 (networks security). Checks clustersList.enablePrivateCluster.

Every record must satisfy: Private cluster is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AKS Cluster Enforces a Network Policy Engine

Verifies each AKS cluster has a Kubernetes network policy engine (azure, calico, or cilium) configured so pod-to-pod traffic is restricted by policy rather than fully open. Maps to CIS Kubernetes Benchmark 5.3.2 (network policies), NIST 800-53 Rev5 SC-7 (boundary protection) / AC-4 (information flow enforcement), and ISO/IEC 27001:2022 Annex A.8.22 (segregation of networks). Checks clustersList.networkPolicy.

A record is marked failed when: Network Policy is none of "azure", "calico" or "cilium". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AKS Runs a Supported Kubernetes Version

Verifies each AKS cluster runs a current, vendor-supported Kubernetes minor version (1.26 or newer) so it continues to receive security patches, rather than an end-of-life version. Maps to NIST 800-53 Rev5 SI-2 (flaw remediation) and CM-8 (system component inventory), NIST 800-171 3.14.1, and ISO/IEC 27001:2022 Annex A.8.8 (management of technical vulnerabilities). Checks clustersList.kubernetesVersion with a regex on the major.minor prefix.

Every record must satisfy: Kubernetes version matches the pattern "^1\.(2[6-9]|[3-9][0-9])\.". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AKS Uses the Azure CNI Network Plugin

Verifies each AKS cluster uses the Azure CNI network plugin rather than kubenet, giving pods first-class VNet IPs so enterprise network controls (NSGs, route tables, network policy) apply directly to pod traffic. Maps to NIST 800-53 Rev5 CM-6 (configuration settings baseline) and SC-7 (boundary protection), and ISO/IEC 27001:2022 Annex A.8.20 (networks security). Checks clustersList.networkPlugin.

Every record must satisfy: Network type (plugin) equals "azure". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AKS Uses the Standard Load Balancer SKU

Verifies each AKS cluster uses the Standard load balancer SKU rather than the deprecated Basic SKU, which is the baseline required to support API-server authorized IP ranges, availability zones, and outbound rules. Maps to NIST 800-53 Rev5 CM-6 (configuration settings baseline) and CIS/SOC 2 CC7/CC8 (secure configuration). Checks clustersList.loadBalancerSku.

Every record must satisfy: Load balancer equals "standard". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

AKS Workloads Are Not Deployed to the Default Namespace

Verifies each AKS deployment runs in a purpose-named namespace rather than the shared default namespace, enabling namespace-scoped RBAC, network policy, and quota boundaries between workloads. Maps to CIS Kubernetes Benchmark 5.7.4 (the default namespace should not be used), NIST 800-53 Rev5 AC-6 (least privilege) / CM-6 (configuration settings), and NIST 800-171 3.1.5. Checks deploymentsList.namespace.

Every record must satisfy: Namespace does not equal "default". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

AKS Workloads Run With Redundant Replicas

Verifies each AKS deployment has at least two available replicas so a single pod or node failure does not take the workload offline, supporting availability and graceful failover. Maps to NIST 800-53 Rev5 CP-2 (contingency planning) / SC-6 (resource availability) and ISO/IEC 27001:2022 Annex A.8.14 (redundancy of information processing facilities). Checks deploymentsList.availableReplicas.

Every record must satisfy: Available is 2 or more. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Bitbucket - Commits Are Attributed to an Author

Enforces non-repudiation of code changes per NIST 800-53 Rev5 AU-3/SA-10: every commit must identify its author. Checks the author field.

Every record must satisfy: Author has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Bitbucket - Commits Include a Change Message

Supports change documentation per NIST 800-53 Rev5 CM-3/SA-10: every commit must include a non-empty message describing the change. Checks the message field.

Every record must satisfy: Description has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

Bitbucket - Merged Pull Requests Are Documented

Supports change documentation per NIST 800-53 Rev5 CM-3/SA-10: any pull request in the MERGED state must carry a non-empty description. Open or declined pull requests are not required to have one. Checks the state and description fields.

A record is marked failed when: Status equals "MERGED" and Description is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Bitbucket - Pull Requests Are Attributed to an Author

Enforces change accountability and non-repudiation per NIST 800-53 Rev5 CM-3/AU-3: every pull request (change record) must identify its author.

Every record must satisfy: Author has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

Bitbucket - Workspace Members Hold a Recognized Permission Level

Verifies configuration baseline for access grants per NIST 800-53 Rev5 CM-6/AC-3: every workspace member's permission field must be one of the approved values owner, collaborator, or member.

A record is marked failed when: Permission is none of "owner", "collaborator" or "member". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Bitbucket - Workspace Owner Access Is Reviewed

Routes Bitbucket workspace members holding owner permission to review as privileged access.

A record is sent for review when: Permission equals "owner". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Bitbucket Workspace Accounts Inactive Over 90 Days

Flags Bitbucket workspace user accounts that have not been accessed in the last 90 days.

A record is marked failed when: Last Login is empty. A record is marked failed when: Last Login is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Deleted ATS Accounts Are Deactivated

Flags user accounts that the source system reports as deleted but that are still marked active.

A record is marked failed when: Deleted is true and Active is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

CRM User Accounts Are Attributable To A Named Individual

Checks that every CRM user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Checkmarx One - No Critical or High Severity Findings in Scan Report

Verifies the Checkmarx One scan report contains no software-composition findings at Critical or High severity, evidencing that serious vulnerabilities are remediated. Supports NIST SP 800-53 Rev 5 RA-5 (Vulnerability Monitoring and Scanning) and SA-11 (Developer Testing and Evaluation). Checks the 'severity' field from the Create Report proof. A proof with no rows is reported as Needs Review, because it cannot distinguish a compliant state from evidence that was never collected.

Every record must satisfy: Severity is none of "Critical" or "High". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Checkmarx One - Report Findings Are Severity-Classified and Categorized

Verifies every finding in the scan report is triaged with a severity and a category, so vulnerabilities can be risk-ranked and routed for remediation. Supports NIST SP 800-53 Rev 5 SA-11 (Developer Testing and Evaluation - flaw tracking) and RA-5 (analysis of scan results). Checks 'severity' and 'category' are non-empty. A proof with no rows is reported as Needs Review, because it cannot distinguish a compliant state from evidence that was never collected.

Every record must satisfy: Severity has a value and Category has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Checkmarx One - Scan Report Evidence Is Recent

Verifies each finding in the scan report carries a scan date that is present and not more than 90 days old, so the evidence reflects a current scan rather than a stale export. Supports NIST SP 800-53 Rev 5 RA-5 (scan frequency / currency of results). Two conditions per row: 'lastScan' must be non-empty and not older than 90 days. A proof with no rows is reported as Needs Review, because it cannot distinguish a compliant state from evidence that was never collected.

Every record must satisfy: Last Scan has a value. A record is marked failed when: Last Scan is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Checkmarx One - No Projects at High or Critical Risk

Verifies that no project in the Checkmarx One inventory carries a Critical or High overall risk level, evidencing timely remediation of scanner findings. Supports NIST SP 800-53 Rev 5 RA-5 (Vulnerability Monitoring and Scanning) and SA-11 (Developer Testing and Evaluation). Checks the 'riskLevel' field from the List All Projects proof; empty inventory fails because no coverage can be demonstrated.

Every record must satisfy: Risk Level is none of "Critical" or "High". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Checkmarx One - Project Inventory Records Are Complete

Verifies each project record in the scanning inventory identifies a project name and a project id, so the SAST asset inventory is complete and traceable. Supports NIST SP 800-53 Rev 5 CM-8 (System Component Inventory) and SA-11 (scoping of testing). Checks 'projectName' and 'projectId' are non-empty. Empty inventory fails because no assets are enrolled in scanning.

Every record must satisfy: Project Name has a value and Project Id has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Checkmarx One - Projects Scanned Within Last 90 Days

Verifies every project has been scanned recently (lastScanDate is present and not more than 90 days ago), demonstrating an operating scan cadence. Supports NIST SP 800-53 Rev 5 RA-5 (Vulnerability Monitoring and Scanning - frequency). Two conditions per row: lastScanDate must be non-empty and must not be older than 90 days. Empty inventory fails because scan cadence cannot be demonstrated.

Every record must satisfy: Last Scan has a value. A record is marked failed when: Last Scan is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

No High-Severity Open Vulnerabilities In Scanned Projects

Verifies every scanned project's latest SCA risk report shows zero high-severity vulnerabilities, evidencing timely remediation of open findings. Maps to NIST 800-53 Rev5 RA-5 (Vulnerability Monitoring and Scanning) and SA-11 (Developer Security Testing), CMMC 2.0 RA.L2-3.11.2 / SI.L2-3.14.1 (NIST 800-171 3.11.2), and ISO/IEC 27001:2022 A.8.8 (Management of technical vulnerabilities). Checks numberField.highVulnerabilityCount.

Every record must satisfy: High Vulnerabilities equals 0. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Scanned Projects Have An Assigned Owning Team

Verifies every scanned project is assigned to at least one team, establishing accountable ownership for remediating vulnerabilities against inventoried components. Maps to NIST 800-53 Rev5 CM-8 (System Component Inventory) and RA-5, and ISO/IEC 27001:2022 A.5.9 (Inventory of information and other associated assets) and A.8.8. Checks textField.assignedTeamNames.

Every record must satisfy: Team has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Vulnerability Scans Performed Within Last 30 Days

Verifies each project has a successful SCA scan within the last 30 days so vulnerability posture is monitored at a defined frequency rather than going stale. Maps to NIST 800-53 Rev5 RA-5(2) (Update Frequency) and SA-11, CMMC 2.0 RA.L2-3.11.2 (NIST 800-171 3.11.2), and ISO/IEC 27001:2022 A.8.8 (Management of technical vulnerabilities). Checks numberField.daysSinceLastSuccessfulScan.

Every record must satisfy: Days Since Last Successful Scan is 30 or less. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

No Dormant Active User Accounts

Flags any enabled account that has not logged in for more than 90 days, evidencing timely disabling of dormant credentials. An account fails only when it is active AND its last login is more than 90 days ago. Maps to NIST 800-53 Rev5 AC-2(3) (Disable Inactive Accounts), CMMC 2.0 AC.L2-3.1.1, ISO/IEC 27001:2022 A.5.18 (Access rights review/removal), CIS Control 5.3 (Disable Dormant Accounts), and SOC 2 CC6.2/CC6.3. Checks booleanField.active and dateField.lastLoginDate.

A record is marked failed when: Active is true and Last Login Date is empty. A record is marked failed when: Active is true and Last Login Date is more than 90 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Have An Assigned Role

Verifies every Checkmarx SCA account is assigned at least one role, evidencing role-based authorization so no account holds undefined or default access. Maps to NIST 800-53 Rev5 AC-2 (Account Management) and AC-6 (Least Privilege), CMMC 2.0 AC.L2-3.1.5 (NIST 800-171 3.1.5), ISO/IEC 27001:2022 A.5.15/A.5.18 (Access control / Access rights), and SOC 2 CC6.1/CC6.3. Checks textField.roleNames.

Every record must satisfy: Roles has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Chart Of Accounts Contains No Suspense Or Uncategorized Accounts

Flags general ledger accounts named as suspense or uncategorized holding accounts, which can conceal unreconciled activity.

Every record must satisfy: Account Name does not match the pattern "[Ss][Uu][Ss][Pp][Ee][Nn][Ss][Ee]|[Uu][Nn][Cc][Aa][Tt][Ee][Gg][Oo][Rr][Ii][SsZz][Ee][Dd]|[Aa][Ss][Kk] [Mm][Yy] [Aa][Cc][Cc][Oo][Uu][Nn][Tt][Aa][Nn][Tt]". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Chart Of Accounts Entries Have An Account Number And Name

Confirms every account in the chart of accounts has both an account number and an account name.

Every record must satisfy: Account Number has a value and Account Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Supplier Master Records Have A Tax Identification Number

Flags supplier records on the vendor master list that have no tax identification number on file.

A record is marked failed when: Entity Type contains "Supplier" and Tax ID is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Vendor And Customer Master Records Are Named And Classified

Checks that every vendor or customer on the master list has a name and is classified as a supplier or a customer rather than left unidentified.

Every record must satisfy: Entity Name has a value and Entity Type does not equal "Unknown". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

User Groups Are Named And Their Purpose Is Documented

Checks that every user group has a name, and flags groups with no description so their purpose and membership can be reviewed.

Every record must satisfy: Name is not blank. A record is sent for review when: Description is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

ATS User Records Attributable And Role Assigned

Checks that every user record has a name, email, unique identifier, and an assigned access role.

Every record must satisfy: Name is not blank and Email is not blank and Remote ID is not blank and Access Role is not blank. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Deleted ATS Accounts Are Deactivated

Flags user accounts that the source system reports as deleted but that are still marked active.

A record is marked failed when: Deleted is true and Active is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

CRM User Accounts Are Attributable To A Named Individual

Checks that every CRM user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Cloudflare Firewall Rules Are Documented

NIST SP 800-53 CM-6: configuration settings must be documented so their intent can be reviewed. Verifies every Cloudflare firewall rule includes a description.

Every record must satisfy: Description has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Cloudflare Firewall Rules Are Enabled

NIST SP 800-53 SC-7: boundary protection requires that traffic-filtering rules at the network boundary are actively enforced. Verifies every Cloudflare firewall rule is enabled (not paused).

Every record must satisfy: Disabled is false. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Cloudflare Firewall Rules Enforce a Protective Action

NIST SP 800-53 SC-7: boundary protection must deny or challenge unwanted traffic, not merely observe it. Verifies every Cloudflare firewall rule takes a protective action (Block or a challenge) rather than only logging or allowing traffic.

Every record must satisfy: Action matches the pattern "^(Block|.*Challenge)$". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Cloudflare WAF Managed Rules Are Documented

NIST SP 800-53 CM-6: configuration settings must be documented so their intent can be reviewed. Verifies every Cloudflare WAF managed rule includes a description.

Every record must satisfy: Description has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Cloudflare WAF Managed Rules Are Enabled

NIST SP 800-53 SI-4: system monitoring requires that detection mechanisms are active. Verifies every Cloudflare WAF managed rule is enabled.

Every record must satisfy: Enabled equals "Yes". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Cloudflare WAF Managed Rules Enforce a Protective Action

NIST SP 800-53 SC-7: boundary protection must mitigate malicious traffic, not merely observe it. Verifies every Cloudflare WAF managed rule takes a protective action rather than only logging matching requests.

Every record must satisfy: Action does not equal "log". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

CRM User Accounts Are Attributable To A Named Individual

Checks that every CRM user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Coupa Approvals Are Approved With A Named Approver

NIST 800-53 Rev5 AC-6 / segregation-of-duties: approval records in scope must be in the approved state and attributable to a named approver, enforcing authorization accountability. Fields: status (text, raw Coupa value 'approved'), approverName (text).

Every record must satisfy: Status equals "approved" and Approval Name has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa Approvals Are In A Recognized Workflow State

Verifies every approval record is in one of Coupa's recognized workflow states (pending_approval, approved, rejected, cancelled) via a single OR condition on textField.status, confirming approval-workflow integrity and flagging records in unexpected states (NIST SP 800-53 Rev 5 AC-3 Access Enforcement / CM-3 Configuration Change Control). Uses OR with '=' (never 'in') per the text evaluator. Checks the List of Approvals proof.

A record is marked failed when: Status is none of "pending_approval", "approved", "rejected" or "cancelled". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa Approvals Have A Named Approver

Verifies every approval record identifies the approver by name (textField.approverName non-empty), so each requisition/PO/invoice approval is attributable to an accountable individual (NIST SP 800-53 Rev 5 AC-3 Access Enforcement / AU-2 Event Logging / segregation-of-duties evidence). Checks the List of Approvals proof.

Every record must satisfy: Approval Name has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Coupa Commodity Records Carry An Identifier, Name And Creation Date

Confirms every commodity record carries a valid numeric identifier, a name, and a creation date so the spend taxonomy is complete and traceable.

Every record must satisfy: Commodity ID is greater than 0 and Commodity Name has a value and Created At has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Coupa Commodity Taxonomy Contains Only Active Entries

Flags commodities that are marked inactive, surfacing retired entries left enabled in the spend classification taxonomy.

Every record must satisfy: Active is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Coupa Entities Have A Status And Type

Verifies each business entity (legal/spend hierarchy node) has a non-empty status (textField.status) and type (textField.type), enforcing organizational-structure governance so authorization boundaries and spend scopes are well-defined (NIST SP 800-53 Rev 5 CM-8 System Component Inventory / AC-3). Checks the List of Entities proof.

Every record must satisfy: Status has a value and Type has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

Coupa Catalog Items Have A Number And Name

Verifies every catalog item has a non-empty item number (textField.itemNumber) and name (textField.name), enforcing catalog integrity so procurement is limited to identified, controlled items rather than untracked spend (NIST SP 800-53 Rev 5 CM-8 System Component Inventory / CM-7 Least Functionality). Checks the List of Items proof.

Every record must satisfy: Item Number has a value and Item Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Test name

Test description

Test logic

Coupa Risk Evaluations Are Completed And Rated

NIST 800-53 Rev5 RA-3 risk assessment: supplier/entity risk evaluations in scope must be Completed and carry a final risk rating, so no assessment is left unresolved. Fields: status (text, vlookup display 'Completed'), riskRating (text).

Every record must satisfy: Status equals "Completed" and Risk Rating has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa Supplier Risk Assessments Have A Rating And Score

Verifies each supplier risk assessment has a non-empty final rating (textField.riskRating) and a final score (numberField.riskScore), so third-party risk evaluations reach a scored, ratable conclusion; assessments left without a rating/score fail cleanly via !isEmpty and are surfaced for follow-up (NIST SP 800-53 Rev 5 RA-3 Risk Assessment / SR-6 Supplier Assessments and Reviews). Checks the List of Risks proof.

Every record must satisfy: Risk Rating has a value and Risk Score has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Coupa Suppliers Are Active

NIST 800-53 Rev5 SR-6 / PM-30 supply-chain and vendor management: suppliers in scope must be in an active status, so inactive or deprovisioned vendors are not transacting. Fields: status (text, raw Coupa value 'active').

Every record must satisfy: Status equals "active". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa Suppliers Have A Defined Payment Method

Verifies every supplier has a defined payment method (textField.paymentMethod non-empty). A supplier with no payment method indicates incomplete onboarding and a disbursement-control gap; a blank value fails cleanly via !isEmpty (NIST SP 800-53 Rev 5 AC-3 Access Enforcement / SA-9 External System Services). Checks the List of Suppliers proof.

Every record must satisfy: Payment Method has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Coupa Suppliers Have A Supplier Number

Verifies every supplier record carries a non-empty supplier number (textField.number), enforcing vendor-master integrity so that payments and purchase orders trace to an onboarded, uniquely identified supplier (NIST SP 800-53 Rev 5 CM-8 System Component Inventory / AC-3). Checks the List of Suppliers proof.

Every record must satisfy: Number has a value. The test passes only if every record passes. If the proof contains no records, the test is marked passed.

Coupa Suppliers Use An Approved Payment Method

NIST 800-53 Rev5 SR-6 / financial disbursement controls: every supplier must settle through an approved payment method (Coupa Pay or Invoice), preventing unsanctioned payment channels. Fields: paymentMethod (text, raw Coupa codes 'coupa_pay' / 'invoice').

A record is marked failed when: Payment Method is none of "coupa_pay" or "invoice". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Coupa Active Users Have Assigned Roles

NIST 800-53 Rev5 AC-2 / AC-6: every active Coupa user account must have at least one role assigned, guarding against privilege-less or orphaned active accounts. Fields: active (boolean), role (text).

A record is marked failed when: Active is true and Role is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa User Accounts Have A Valid Email Identifier

Verifies every Coupa user account carries a non-empty email that contains '@', so each account maps to a real, addressable identity (NIST SP 800-53 Rev 5 AC-2 Account Management / IA-4 Identifier Management). Checks textField.email is present and well-formed on the List of Users proof.

Every record must satisfy: Email has a value and Email contains "@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Coupa Users Have At Least One Role Assigned

Verifies every Coupa user account has at least one role assigned (textField.role non-empty) so access is provisioned deliberately rather than left undefined, supporting least-privilege and access-review controls (NIST SP 800-53 Rev 5 AC-6 Least Privilege / AC-2 Account Management). Role is the comma-joined list of the user's Coupa roles on the List of Users proof.

Every record must satisfy: Role has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

CrowdStrike Device Control Policies Assigned To Host Groups

Removable media protection enforcement (NIST 800-53 Rev5 MP-7): each device-control policy must be assigned to at least one host group so it actually enforces. Checks textField.groups is not empty.

Every record must satisfy: Groups has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

CrowdStrike Device Control Policies Enabled

Removable media / port and I/O device control (NIST 800-53 Rev5 MP-7, SC-41): every USB device-control policy must be enabled. Checks booleanField.enabled isTrue.

Every record must satisfy: Enabled is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Automated Incident Response Triggering

Confirms that high-severity or critical CrowdStrike endpoint detections automatically trigger incident response procedures.

Every record must satisfy: Vulnerability has a value and Severity has a value and First Detected has a value and Status has a value and Hours to Resolution has a value and Hostname has a value and Platform has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

CrowdStrike Detections Are Triaged Within 30 Days

Flags CrowdStrike detections still in the new state more than 30 days after they were raised.

A record is sent for review when: First Detected is empty. A record is marked failed when: Status equals "new" and First Detected is more than 30 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Detection Host Attribution

Confirms every CrowdStrike endpoint detection is attributed to a named host running a recognized platform so responders can locate and contain the endpoint (NIST 800-53 Rev5 IR-4, CM-8). Fields: hostName, displayName, platformName (mapped from device.platform_name; display values Windows/Mac/Linux).

Every record must satisfy: Hostname has a value and Vulnerability has a value. A record is marked failed when: Platform is none of "Windows", "Mac" or "Linux". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Detection Severity Classified

Ensures every CrowdStrike endpoint detection carries a recognized severity classification and is attributable (host + name + time) to support risk-based incident triage (NIST 800-53 Rev5 IR-4, IR-5, RA-5). Fields: displayName, hostName, detectTime, maxSeverityDisplay (mapped from severity_name; display values Critical/High/Medium/Low/Informational).

Every record must satisfy: Vulnerability has a value and Hostname has a value and First Detected has a value. A record is marked failed when: Severity is none of "Critical", "High", "Medium", "Low" or "Informational". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Endpoint Detection Coverage Verification

Ensures that all endpoints have CrowdStrike sensors actively deployed and monitoring to detect malicious code.

Every record must satisfy: Vulnerability has a value and Severity has a value and Status has a value and Hostname has a value and Platform has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

CrowdStrike Host Groups Are Documented

Asset inventory grouping (NIST 800-53 Rev5 CM-8): each host group must carry a description so the grouping rationale used to scope protection policies is recorded. Checks textField.description is not empty.

Every record must satisfy: Description has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

CrowdStrike Endpoint Sensor Installed On All Hosts

Malicious code protection (NIST 800-53 Rev5 SI-3): verifies every managed host reports a Falcon sensor version so no endpoint is left unprotected. Checks textField.sensorVersion is not empty.

Every record must satisfy: Sensor Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

CrowdStrike Hosts Checked In Within 30 Days

Asset inventory currency (NIST 800-53 Rev5 CM-8, AU-6): each host's last check-in (dateField.lastSeen) must be within 30 days so stale or abandoned endpoints are flagged.

A record is sent for review when: Last Seen is empty. A record is marked failed when: Last Seen is more than 30 days in the past. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

CrowdStrike Hosts Not Stuck In Pending Containment

Incident handling (NIST 800-53 Rev5 IR-4): no host may remain in a Containment Pending or Lift Containment Pending state, which indicates a stalled isolation action. Checks textField.status against both pending states.

Every record must satisfy: Containment Status is none of "Containment Pending" or "Lift Containment Pending". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

CrowdStrike Hosts Record An Operating System Baseline

Checks that each CrowdStrike host records its platform and operating system version.

Every record must satisfy: Platform has a value and OS Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

CrowdStrike Sensor Version Meets Minimum Baseline

Flaw remediation / version currency (NIST 800-53 Rev5 SI-2): the Falcon sensor major version must be 7 or newer so agents stay patched. Regex-matches textField.sensorVersion.

Every record must satisfy: Sensor Version matches the pattern "^(7|8|9|[1-9][0-9]+)\.". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Host Active And Monitored

Confirms each host has a sensor installed and has checked in within the last 30 days so monitoring is current and stale endpoints are surfaced (NIST 800-53 Rev5 SI-4, CM-8). Fields: sensorVersion (textField.sensorVersion), lastSeen (dateField.lastSeen, mapped from last_seen).

A record is sent for review when: Last Seen is empty. Every record must satisfy: Sensor Version has a value. A record is marked failed when: Last Seen is more than 30 days in the past. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Host Sensor Deployed

Verifies every CrowdStrike-managed host reports an installed sensor agent version, evidencing endpoint protection coverage (NIST 800-53 Rev5 SI-3, CM-8). Fields: hostName (textField.hostName), sensorVersion (textField.sensorVersion, mapped from agent_version).

Every record must satisfy: Hostname has a value and Sensor Version has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

CrowdStrike Console Users Have Assigned Roles

Account management / least privilege (NIST 800-53 Rev5 AC-2, AC-6): every Falcon console user must have at least one explicitly assigned role. Checks textField.roles is not empty.

Every record must satisfy: Roles has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Malicious Code Prevention Policy Enforcement

Ensures CrowdStrike prevention policies are enabled and actively enforced to prevent execution of malicious code across all applicable endpoints. Assessment Procedures:

Every record must satisfy: Enabled is true and Created On has a value. The test passes if at least 80% of records pass. If the proof contains no records, the test is marked failed.

Prevention Policy Assigned To Host Groups

Confirms enabled CrowdStrike prevention policies are assigned to at least one host group so protection is actually enforced (NIST 800-53 Rev5 SI-3, CM-6). Fields: enabled (booleanField.enabled), groups (textField.groups).

Every record must satisfy: Enabled is true and Groups has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Prevention Policy Enabled With Settings

Verifies each CrowdStrike prevention policy is enabled and has at least one prevention setting configured (NIST 800-53 Rev5 SI-3). Fields: enabled (booleanField.enabled), details (textField.details), name (textField.name).

Every record must satisfy: Enabled is true and Policy Details has a value and Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Sensor Policy Version Pinned And Protected

Confirms enabled CrowdStrike sensor update policies pin an approved sensor version and do not disable uninstall protection (NIST 800-53 Rev5 SI-2, SI-3, CM-2). Fields: enabled (booleanField.enabled), sensor_version (textField.sensor_version), uninstall_protection (textField.uninstall_protection) whose disabled display value is Disabled.

Every record must satisfy: Enabled is true and Sensor Version has a value and Uninstall Protection does not equal "Disabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Sensor Uninstall Protection Enabled

Ensures enabled CrowdStrike sensor update policies enforce uninstall (tamper) protection so the agent cannot be removed by an attacker (NIST 800-53 Rev5 SI-3, SI-7, CM-5). Fields: enabled (booleanField.enabled), uninstall_protection (textField.uninstall_protection) which vlookups to the display value Enabled.

Every record must satisfy: Enabled is true and Uninstall Protection equals "Enabled". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Sensor Update Policies

Verifies that CrowdStrike sensors installed on endpoints match the organization's approved sensor version and that sensor policies are actively enabled with uninstall protection enforced.

Every record must satisfy: Name has a value and Platform has a value and Enabled is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Datadog Monitors Have Critical and Warning Alert Thresholds

Verifies each Datadog monitor defines both a warning and a critical alerting threshold so operators get graduated notification before a failure. Supports NIST 800-53 Rev5 SI-4(5) / AU-5 by checking the criticalThreshold and warningThreshold fields are populated.

Every record must satisfy: Critical Threshold has a value and Warning Threshold has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Datadog Active Users Have Recorded Name and Email

Verifies every active Datadog account records both a name and an email so each account is attributable to a real identity for account management. Supports NIST 800-53 Rev5 AC-2 by checking the users' name and email fields are populated.

Every record must satisfy: Name has a value and Email has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Datadog Hosts Are Actively Reporting (Agent Up)

Verifies every host in the Datadog inventory has an ACTIVE status, confirming its monitoring agent is up and telemetry is flowing. Supports NIST 800-53 Rev5 SI-4 / CM-8 by checking the hosts' status field.

Every record must satisfy: Status equals "ACTIVE". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Datadog Hosts Have a Recorded OS Platform

Verifies every host in the Datadog inventory records its OS platform, ensuring the asset inventory is complete enough to map hosts to configuration baselines. Supports NIST 800-53 Rev5 CM-8 by checking the hosts' platform field is populated.

Every record must satisfy: Platform has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Datadog Incidents Are Resolved or Completed

Verifies each Datadog incident has reached a closed state (Resolved or Completed) rather than lingering Active/Stable, evidencing incident closure. Supports NIST 800-53 Rev5 IR-4 / IR-5 by checking the incidents' state field.

A record is marked failed when: State is none of "Resolved" or "Completed". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Datadog Incidents Have a Triaged Severity

Fails any Datadog incident whose severity is still UNKNOWN, confirming each incident was triaged and assigned a severity for prioritized response. Supports NIST 800-53 Rev5 IR-4 by checking the incidents' severity field.

Every record must satisfy: Severity does not equal "UNKNOWN". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Datadog Monitors Are Actively Evaluating (No Data Gaps)

Fails any Datadog monitor in a 'No Data' state, which indicates the monitor is no longer receiving telemetry and monitoring coverage has silently broken. Supports NIST 800-53 Rev5 SI-4 / AU-6 by checking the monitors' status field.

Every record must satisfy: Status does not equal "No Data". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Datadog Monitors Have a Defined Alert Priority

Verifies every Datadog monitor has an assigned priority (not 'Not Defined') so alerts are ranked and routed for response. Supports NIST 800-53 Rev5 SI-4 / AU-6 by checking the monitors' priority field.

Every record must satisfy: Priority does not equal "Not Defined". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Elastic Cloud Deployment Instances Have Availability Zone Assigned

Verifies every Elastic Cloud deployment instance is placed in a named availability zone (zone is not empty), evidence of a resilient multi-zone topology baseline. Supports NIST SP 800-53 Rev 5 CP-2 (Contingency Planning) and CM-6 (Configuration Settings). Checks the 'zone' field emitted by the deploymentInstances proof.

Every record must satisfy: Zone has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Elastic Cloud Deployment Inventory Is Complete

Verifies each inventoried Elastic Cloud deployment record carries an identifying name and a resource kind (both non-empty), so the deployment inventory is complete and attributable. Supports NIST SP 800-53 Rev 5 CM-8 (System Component Inventory). Checks the 'name' and 'kind' fields emitted by the deployments proof.

Every record must satisfy: Name has a value and Applications has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Elastic Cloud Deployment Inventory Record Is Complete

Confirms each deployment record carries a well-formed unique identifier and a name so it can be tracked in the system component inventory.

Every record must satisfy: Id has a value and Id matches the pattern "^[0-9a-fA-F]{32}$" and Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Elastic Cloud Deployments Reside In US Regions

Verifies every Elastic Cloud deployment is hosted in a US cloud region (region name has a 'us-' segment at the start or after a provider prefix, e.g. us-east-1, aws-us-east-1, gcp-us-central1). Enforces data residency / data-location boundary requirements per NIST SP 800-53 Rev 5 SA-9 (External System Services) and AC-4 (Information Flow Enforcement). Uses a JS+.NET-compatible regex (no inline flags). Checks the 'region' field emitted by the deployments proof.

Every record must satisfy: Region matches the pattern "(^|-)us-". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Elastic Cloud Users Have An Organization Role Assigned

Verifies every Elastic Cloud organization user has at least one explicit role assignment (role is not empty), so no account has undefined or orphaned access. Supports least-privilege access governance per NIST SP 800-53 Rev 5 AC-2 (Account Management) and AC-6 (Least Privilege). Checks the 'role' field emitted by the userList proof.

Every record must satisfy: Roles has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Elasticsearch Accounts Are Active

Account lifecycle management: verifies each listed account is enabled (active), supporting review that no disabled or dormant account is unexpectedly retained with access. NIST 800-53 Rev5 AC-2, NIST 800-171 3.1.1, ISO/IEC 27001:2022 A.5.16. Field checked: enabled.

Every record must satisfy: Enabled is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Elasticsearch Accounts Do Not Hold The Superuser Role

Restrict privileged access: flags accounts granted the built-in superuser role, which confers unrestricted cluster-wide privileges, so privileged access can be justified and minimized. NIST 800-53 Rev5 AC-6(5), NIST 800-171 3.1.5, ISO/IEC 27001:2022 A.8.2. Field checked: roles.

Every record must satisfy: Roles does not contain "superuser". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Elasticsearch Accounts Do Not Use Generic Or Shared Names

Unique identification / no shared accounts: flags accounts whose username is a generic or shared identifier (admin, root, test, guest, shared, service) so each account maps to a single accountable identity. NIST 800-53 Rev5 IA-4 and AC-2, NIST 800-171 3.5.1, ISO/IEC 27001:2022 A.5.16. Field checked: username. Case-explicit anchored regex, no inline flags.

Every record must satisfy: User Name is none of "admin", "root", "test", "guest", "shared" or "service" (ignoring case). The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Elasticsearch Accounts Have A Contact Email

Accountability / traceability of accounts to an individual: verifies each account records a contact email so ownership and communication for access reviews and incident response are possible. NIST 800-53 Rev5 AC-2 and IA-2, NIST 800-171 3.1.1, ISO/IEC 27001:2022 A.5.16. Field checked: email.

Every record must satisfy: Email Address has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Elasticsearch Accounts Have An Assigned Role

Least-privilege authorization: verifies every Elasticsearch account has at least one security role assigned (roles field not empty) so access is granted only through defined roles. NIST 800-53 Rev5 AC-6, NIST 800-171 3.1.5, ISO/IEC 27001:2022 A.8.2, SOC 2 CC6.3. Field checked: roles.

Every record must satisfy: Roles has a value. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Chart Of Accounts Contains No Suspense Or Uncategorized Accounts

Flags general ledger accounts named as suspense or uncategorized holding accounts, which can conceal unreconciled activity.

Every record must satisfy: Account Name does not match the pattern "[Ss][Uu][Ss][Pp][Ee][Nn][Ss][Ee]|[Uu][Nn][Cc][Aa][Tt][Ee][Gg][Oo][Rr][Ii][SsZz][Ee][Dd]|[Aa][Ss][Kk] [Mm][Yy] [Aa][Cc][Cc][Oo][Uu][Nn][Tt][Aa][Nn][Tt]". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Chart Of Accounts Entries Have An Account Number And Name

Confirms every account in the chart of accounts has both an account number and an account name.

Every record must satisfy: Account Number has a value and Account Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Chart Of Accounts Contains No Suspense Or Uncategorized Accounts

Flags general ledger accounts named as suspense or uncategorized holding accounts, which can conceal unreconciled activity.

Every record must satisfy: Account Name does not match the pattern "[Ss][Uu][Ss][Pp][Ee][Nn][Ss][Ee]|[Uu][Nn][Cc][Aa][Tt][Ee][Gg][Oo][Rr][Ii][SsZz][Ee][Dd]|[Aa][Ss][Kk] [Mm][Yy] [Aa][Cc][Cc][Oo][Uu][Nn][Tt][Aa][Nn][Tt]". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Chart Of Accounts Entries Have An Account Number And Name

Confirms every account in the chart of accounts has both an account number and an account name.

Every record must satisfy: Account Number has a value and Account Name has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Supplier Master Records Have A Tax Identification Number

Flags supplier records on the vendor master list that have no tax identification number on file.

A record is marked failed when: Entity Type contains "Supplier" and Tax ID is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Vendor And Customer Master Records Are Named And Classified

Checks that every vendor or customer on the master list has a name and is classified as a supplier or a customer rather than left unidentified.

Every record must satisfy: Entity Name has a value and Entity Type does not equal "Unknown". The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

User Groups Are Named And Their Purpose Is Documented

Checks that every user group has a name, and flags groups with no description so their purpose and membership can be reviewed.

Every record must satisfy: Name is not blank. A record is sent for review when: Description is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

User Groups Are Named And Their Purpose Is Documented

Checks that every user group has a name, and flags groups with no description so their purpose and membership can be reviewed.

Every record must satisfy: Name is not blank. A record is sent for review when: Description is empty. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Issues Are Identified And Have A Tracked Status

Checks that every ticket in the list has a name and a current status so the work item can be tracked.

Every record must satisfy: Name has a value and Status has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

No Unresolved Issues Older Than 90 Days

Flags tickets created more than 90 days ago that are still not closed, surfacing aging unresolved work.

A record is sent for review when: Created is empty. A record is marked failed when: Created is more than 90 days in the past and Status does not equal "CLOSED". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Active Ticketing User Accounts Have An Assigned Role

Flags active ticketing user accounts that carry no assigned role.

A record is marked failed when: Active is true and Roles is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Active User Accounts Do Not Use Shared Or Generic Identities

Flags active user accounts whose email suggests a shared, generic, or system identity rather than an individually assigned account.

A record is marked failed when: Active is true and Email contains "admin@". A record is marked failed when: Active is true and Email contains "test@". A record is marked failed when: Active is true and Email contains "shared@". A record is marked failed when: Active is true and Email contains "service@". A record is marked failed when: Active is true and Email contains "guest@". The test passes only if every record passes. If the proof contains no records, the test is sent for review.

User Accounts Are Attributable To A Named Individual

Checks that every user account has a name and a valid email address, so each account can be traced back to a real person.

Every record must satisfy: Name is not blank and Email is a well-formed email address. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Test name

Test description

Test logic

Job Application Records Identify The Candidate, Position, And Application Date

Checks that each job application record identifies the candidate by email, names the position applied for, and records the date the application was received.

Every record must satisfy: Candidate Email has a value and Job Title has a value and Applied Date has a value. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

Rejected Job Applications Record A Reject Reason

Flags job applications that were rejected without a documented reason for the rejection.

A record is marked failed when: Rejected Date has a value and Reject Reason is empty. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

Deleted ATS Accounts Are Deactivated

Flags user accounts that the source system reports as deleted but that are still marked active.

A record is marked failed when: Deleted is true and Active is true. The test passes only if every record passes. If the proof contains no records, the test is sent for review.

Test name

Test description

Test logic

GitHub Branch Protection Enabled

Confirms every monitored branch has a branch protection rule in effect (protectionEnabled=true). Unprotected branches allow direct pushes and force-pushes that bypass change control. Supports NIST SP 800-53 Rev 5 CM-3 (Configuration Change Control) and SI-10 (Information Input Validation) / FedRAMP 20x. Field checked: booleanField.protectionEnabled.

Every record must satisfy: Branch Protection Enabled is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

GitHub Enforce Branch Protection For Administrators

Verifies branch protection rules also apply to repository administrators (enforceAdmins=true) so privileged users cannot bypass required reviews and status checks. Closes the common least-privilege gap where admins push directly to protected branches. Supports NIST SP 800-53 Rev 5 AC-6(1) (Authorize Access to Security Functions), CM-5 (Access Restrictions for Change), and CM-3. Field checked: booleanField.enforceAdmins.

Every record must satisfy: Include administrators is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.

GitHub Require Code Owner Review And Dismiss Stale Approvals

Verifies protected branches require review from designated code owners and automatically dismiss stale approvals when new commits are pushed (requireCodeOwnerReview=true AND dismissStaleReviews=true). Prevents merging unreviewed changes slipped in after approval. Supports NIST SP 800-53 Rev 5 AC-5 (Separation of Duties), CM-3 (Configuration Change Control), and SA-11. Fields checked: booleanField.requireCodeOwnerReview, booleanField.dismissStaleReviews.

Every record must satisfy: Require review from Code Owners is true and Dismiss Stale Reviews is true. The test passes only if every record passes. If the proof contains no records, the test is marked failed.