key,summary,details,category,agent,requester_email,team,sla,priority,parent_key,asset_keys,target_date,CFValidationID,CFValidationTest,CFValidationMethod,CFEvidenceType,CFEvidenceDescription,CFValidations
val-cmt-lmc-10,KSI-CMT-LMC.10 [AWS] CloudTrail trails have comprehensive logging,Capture and monitor all changes to cloud infrastructure. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-LMC,,,VAL-CMT-LMC-10,"Assert: cloudTrail trails have comprehensive logging configuration, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-cmt-lmc-11,KSI-CMT-LMC.11 [AWS] AWS Config is actively recording configuration,Check AWS Config is actively recording configuration changes. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-LMC,,,VAL-CMT-LMC-11,"Assert: aWS Config is actively recording configuration changes, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-lmc-20,KSI-CMT-LMC.20 [Azure] Verify diagnostic settings capture,"Ensure diagnostic settings are configured to log and monitor all administrative changes to system configuration. Requires capture of Administrative, Security, Alert, and Policy log categories. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-LMC,,,VAL-CMT-LMC-20,"Assert: verify diagnostic settings capture administrative operations, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-cmt-lmc-21,KSI-CMT-LMC.21 [Azure] Verify Azure Policy assignments are enforced,Ensure Azure Policy assignments are configured and enforced (not in audit-only mode) to track and enforce compliance with organizational standards and configuration baselines. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-LMC,,,VAL-CMT-LMC-21,"Assert: verify Azure Policy assignments are enforced, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-cmt-rmv-10,KSI-CMT-RMV.10 [AWS] Launch templates have been updated,Use immutable patterns - redeploy rather than modify in place. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RMV,,,VAL-CMT-RMV-10,"Assert: launch templates have been updated, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rmv-11,KSI-CMT-RMV.11 [AWS] Auto Scaling Groups use launch templates,Check Auto Scaling Groups use launch templates (not deprecated launch configs). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RMV,,,VAL-CMT-RMV-11,"Assert: auto Scaling Groups use launch templates, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rmv-12,KSI-CMT-RMV.12 [AWS] Long-running instances that may violate immutable,Check for long-running instances that may violate immutable infrastructure pattern. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RMV,,,VAL-CMT-RMV-12,"Assert: long-running instances that may violate immutable infrastructure pattern, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rmv-20,KSI-CMT-RMV.20 [Azure] Verify VM Scale Sets use automated upgrade,"Ensure VM Scale Sets are configured with rolling or automatic upgrade policies (not manual). Manual upgrade policies allow manual modifications, violating immutable infrastructure principles. Rolling and automatic policies enforce consistent redeployment of updates. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RMV,,,VAL-CMT-RMV-20,"Assert: verify VM Scale Sets use automated upgrade policies, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rmv-21,KSI-CMT-RMV.21 [Azure] Verify VMs use managed images,"Ensure virtual machines are deployed from managed or custom images, not marketplace images. Immutable infrastructure requires using VM Scale Sets with managed images and automated deployment, not long-running VMs with manual configuration changes. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RMV,,,VAL-CMT-RMV-21,"Assert: verify VMs use managed images, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rvp-10,KSI-CMT-RVP.10 [AWS] CodePipelines have sufficient stages,Automate testing throughout deployment process. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RVP,,,VAL-CMT-RVP-10,"Assert: codePipelines have sufficient stages, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rvp-11,KSI-CMT-RVP.11 [AWS] CodeBuild projects for privileged mode,Check CodeBuild projects for privileged mode (security review needed). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RVP,,,VAL-CMT-RVP-11,"Assert: codeBuild projects for privileged mode, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-rvp-20,KSI-CMT-RVP.20 [Azure] Verify Azure DevOps pipelines configured for,Ensure Azure DevOps pipelines are configured to validate configuration and code changes through automated testing and deployment procedures. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-RVP,,,VAL-CMT-RVP-20,"Assert: verify Azure DevOps pipelines configured for automated testing, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-vtd-10,KSI-CMT-VTD.10 [AWS] CloudTrail trails have log file integrity,Validate integrity of resources using cryptographic methods. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-VTD,,,VAL-CMT-VTD-10,"Assert: cloudTrail trails have log file integrity validation, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-cmt-vtd-11,KSI-CMT-VTD.11 [AWS] Review CodeBuild projects for privileged mode,Check CodeBuild projects for privileged mode (security review needed). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-VTD,,,VAL-CMT-VTD-11,"Assert: review CodeBuild projects for privileged mode, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cmt-vtd-12,KSI-CMT-VTD.12 [AWS] CodePipeline has sufficient stages for build and,Automate testing throughout deployment process. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CMT-VTD,,,VAL-CMT-VTD-12,"Assert: codePipeline has sufficient stages for build and test, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-10,KSI-CNA-DFP.10 [AWS] Overly permissive inbound security group rules,Limit inbound and outbound network traffic to only what is required. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-10,"Assert: overly permissive inbound security group rules, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-11,KSI-CNA-DFP.11 [AWS] Unrestricted outbound rules,Check for unrestricted outbound rules (all protocols to 0.0.0.0/0). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-11,"Assert: unrestricted outbound rules, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-12,KSI-CNA-DFP.12 [AWS] Default NACLs,Check for default NACLs (may be overly permissive). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-12,"Assert: default NACLs, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-13,KSI-CNA-DFP.13 [AWS] Sensitive ports (SSH/RDP/DB/Cache/Search) open to,Check sensitive ports (SSH/RDP/DB/Cache/Search) open to 0.0.0.0/0. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-13,"Assert: sensitive ports (SSH/RDP/DB/Cache/Search) open to 0.0.0.0/0, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-20,KSI-CNA-DFP.20 [Azure] Verify Network Security Groups have restrictive,Persistently ensure all machine-based information resources are configured to limit inbound and outbound network traffic. Validate NSGs restrict internet access to authorized ports only. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-20,"Assert: verify Network Security Groups have restrictive rules, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-21,KSI-CNA-DFP.21 [Azure] Verify all VMs are associated with Network,Persistently ensure all machine-based information resources are configured to limit inbound and outbound network traffic. All VMs should be protected by Network Security Groups. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-21,"Assert: verify all VMs are associated with Network Security Groups, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-dfp-23,KSI-CNA-DFP.23 [Azure] Application Gateway has Web Application,Persistently ensure all machine-based information resources are configured to limit inbound and outbound network traffic. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-DFP,,,VAL-CNA-DFP-23,"Assert: application Gateway has Web Application Firewall enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-10,KSI-CNA-EIS.10 [AWS] EC2 instances have been running 30 days or less,Deploy infrastructure that is replaced rather than modified. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-10,"Assert: eC2 instances have been running 30 days or less, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-11,KSI-CNA-EIS.11 [AWS] Static-tagged EC2 instances have SSM patch,"Static-tagged EC2 instances are acknowledged persistent resources (DBs, jump servers). Automated check evaluated continuously against the AWS estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-11,"Assert: static-tagged EC2 instances have SSM patch compliance within 30 days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-20,KSI-CNA-EIS.20 [Azure] Verify VM scale sets use custom images,Ensure virtual machine scale sets use custom hardened images rather than marketplace defaults to implement immutable infrastructure with strictly defined functionality. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-20,"Assert: verify VM scale sets use custom images, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-21,KSI-CNA-EIS.21 [Azure] AKS network policies are enabled,Ensure AKS clusters have network policies enabled to enforce intended state by restricting traffic between pods. Network policies provide microsegmentation and enforce least privilege access. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-21,"Assert: aKS network policies are enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-22,KSI-CNA-EIS.22 [Azure] Container registries have admin user disabled,Use immutable infrastructure with strictly defined functionality and privileges by default. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-22,"Assert: container registries have admin user disabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-eis-23,KSI-CNA-EIS.23 [Azure] Verify container registries have admin user,Ensure Azure Container Registry admin user accounts are disabled. Admin users should not be enabled to enforce least-privilege access control. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-23,"Assert: verify container registries have admin user disabled, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-eis-24,KSI-CNA-EIS.24 [Azure] Verify App Service uses current runtime,"Ensure App Service web apps use current and supported runtime versions (.NET 7+, Java 17+, Python 3.11+, PHP 8.2+, Node.js 18+) to maintain security and performance. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-EIS,,,VAL-CNA-EIS-24,"Assert: verify App Service uses current runtime versions, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-10,KSI-CNA-IBP.10 [AWS] EC2 instances with public IP addresses,Minimize exposed services and lateral movement paths. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-10,"Assert: eC2 instances with public IP addresses, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-11,KSI-CNA-IBP.11 [AWS] Non-standard ports open inbound from 0.0.0.0/0,Check for non-standard ports open inbound from 0.0.0.0/0. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-11,"Assert: non-standard ports open inbound from 0.0.0.0/0, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-12,KSI-CNA-IBP.12 [AWS] EC2 instances enforce IMDSv2,Check EC2 instances enforce IMDSv2 (prevents SSRF credential theft). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-12,"Assert: eC2 instances enforce IMDSv2, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-13,KSI-CNA-IBP.13 [AWS] S3 buckets with public policies,Check S3 buckets with public policies. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-13,"Assert: s3 buckets with public policies, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-14,KSI-CNA-IBP.14 [AWS] RDS instances publicly accessible,Check RDS instances publicly accessible. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-14,"Assert: rDS instances publicly accessible, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-15,KSI-CNA-IBP.15 [AWS] Internet-facing ALBs,Check for internet-facing ALBs (need WAF verification). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-15,"Assert: internet-facing ALBs, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-16,KSI-CNA-IBP.16 [AWS] S3 account-level public access block is fully,Check S3 account-level public access block is fully enabled (all 4 settings). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-16,"Assert: s3 account-level public access block is fully enabled, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-ibp-20,KSI-CNA-IBP.20 [Azure] VM disks are encrypted,Persistently ensure machine-based information resources have a minimal attack surface and that lateral movement is minimized if compromised. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-20,"Assert: vM disks are encrypted, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-21,KSI-CNA-IBP.21 [Azure] Verify SQL databases have Transparent Data,Ensure all SQL databases have Transparent Data Encryption (TDE) enabled to protect data at rest with encryption. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-21,"Assert: verify SQL databases have Transparent Data Encryption enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ibp-22,KSI-CNA-IBP.22 [Azure] Storage accounts use customer-managed,Persistently ensure machine-based information resources have a minimal attack surface and that lateral movement is minimized if compromised. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-22,"Assert: storage accounts use customer-managed encryption keys, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-ibp-23,KSI-CNA-IBP.23 [Azure] Verify storage accounts use customer-managed,Ensure storage accounts are configured to use customer-managed encryption keys (CMEK) from Azure Key Vault for enhanced control over encryption. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-23,"Assert: verify storage accounts use customer-managed keys for encryption, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-ibp-24,KSI-CNA-IBP.24 [Azure] Verify Azure Kubernetes Service (AKS) has RBAC,Ensure AKS clusters have Role-Based Access Control (RBAC) enabled to enforce least privilege and minimize attack surface. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-IBP,,,VAL-CNA-IBP-24,"Assert: verify Azure Kubernetes Service (AKS) has RBAC enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-cna-mat-10,KSI-CNA-MAT.10 [AWS] VPCs have flow logs enabled,Control where network traffic can flow using segmentation and routing. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-10,"Assert: vPCs have flow logs enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-11,KSI-CNA-MAT.11 [AWS] Subnets don't auto-assign public IPs,Check subnets don't auto-assign public IPs (bypass traffic controls). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-11,"Assert: subnets don't auto-assign public IPs, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-12,KSI-CNA-MAT.12 [AWS] Route tables with internet gateway routes,Check route tables with internet gateway routes (identify internet-facing paths). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-12,"Assert: route tables with internet gateway routes, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-13,KSI-CNA-MAT.13 [AWS] VPCs have sufficient VPC endpoints,Check VPCs have sufficient VPC endpoints (S3/KMS/SSM minimum for private traffic). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-13,"Assert: vPCs have sufficient VPC endpoints, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-14,KSI-CNA-MAT.14 [AWS] Active VPC peering connections are tagged as,Check active VPC peering connections are authorized and documented. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-14,"Assert: active VPC peering connections are tagged as authorized, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-20,KSI-CNA-MAT.20 [Azure] Verify storage accounts enforce HTTPS/secure,Use logical networking and related capabilities to enforce traffic flow controls. Storage accounts must require HTTPS for all transfers. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-20,"Assert: verify storage accounts enforce HTTPS/secure transfer only, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-mat-21,KSI-CNA-MAT.21 [Azure] Verify Application Gateway has SSL/TLS policies,Use logical networking and related capabilities to enforce traffic flow controls. Application Gateways must have SSL/TLS policies defined. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-21,"Assert: verify Application Gateway has SSL/TLS policies configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-22,KSI-CNA-MAT.22 [Azure] Verify Redis Cache enforces SSL/TLS connections,Use logical networking and related capabilities to enforce traffic flow controls. Redis Cache must enforce SSL/TLS. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-22,"Assert: verify Redis Cache enforces SSL/TLS connections, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-23,KSI-CNA-MAT.23 [Azure] PostgreSQL SSL enforcement,Use logical networking and related capabilities to enforce traffic flow controls. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-23,"Assert: postgreSQL SSL enforcement, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-mat-24,KSI-CNA-MAT.24 [Azure] Verify MySQL servers enforce SSL/TLS,Use logical networking and related capabilities to enforce traffic flow controls. MySQL servers must enforce SSL/TLS. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-MAT,,,VAL-CNA-MAT-24,"Assert: verify MySQL servers enforce SSL/TLS connections, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ofa-10,KSI-CNA-OFA.10 [AWS] Auto Scaling Groups deployed across multiple AZs,Optimize infrastructure for availability and rapid recovery. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-10,"Assert: auto Scaling Groups deployed across multiple AZs, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ofa-11,KSI-CNA-OFA.11 [AWS] ElastiCache replication groups have HA,Check ElastiCache replication groups have HA configuration. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-11,"Assert: elastiCache replication groups have HA configuration, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ofa-12,KSI-CNA-OFA.12 [AWS] ALBs deployed across multiple AZs,Check ALBs deployed across multiple AZs. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-12,"Assert: aLBs deployed across multiple AZs, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ofa-13,KSI-CNA-OFA.13 [AWS] RDS instances have Multi-AZ enabled,Check RDS instances have Multi-AZ enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-13,"Assert: rDS instances have Multi-AZ enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-ofa-14,KSI-CNA-OFA.14 [AWS] ECS services have desired count >= 2 for HA,Check ECS services have desired count >= 2 for HA. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-14,"Assert: eCS services have desired count >= 2 for HA, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-cna-ofa-20,KSI-CNA-OFA.20 [Azure] Verify backup vaults have cross-region,Ensure cloud native architecture optimizes for high availability and resilience. Backup vaults must have cross-region redundancy. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-OFA,,,VAL-CNA-OFA-20,"Assert: verify backup vaults have cross-region redundancy for availability, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rnt-10,KSI-CNA-RNT.10 [AWS] Security groups do not allow unrestricted,Check for unrestricted outbound rules (all protocols to 0.0.0.0/0). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RNT,,,VAL-CNA-RNT-10,"Assert: security groups do not allow unrestricted outbound rules, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rnt-11,KSI-CNA-RNT.11 [AWS] Security groups restrict non-standard ports,Check for non-standard ports open inbound from 0.0.0.0/0. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RNT,,,VAL-CNA-RNT-11,"Assert: security groups restrict non-standard ports, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rnt-12,KSI-CNA-RNT.12 [AWS] VPC flow logs are enabled,Control where network traffic can flow using segmentation and routing. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RNT,,,VAL-CNA-RNT-12,"Assert: vPC flow logs are enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rnt-13,KSI-CNA-RNT.13 [AWS] WAF rules are defined,Protect against DDoS and application-layer attacks. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RNT,,,VAL-CNA-RNT-13,"Assert: wAF rules are defined, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rnt-20,KSI-CNA-RNT.20 [Azure] Network Security Groups restrict inbound,Restrict inbound and outbound network traffic to authorized flows. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RNT,,,VAL-CNA-RNT-20,"Assert: network Security Groups restrict inbound traffic from the internet, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rvp-10,KSI-CNA-RVP.10 [AWS] WAF Web ACLs have rules configured,Protect against DDoS and application-layer attacks. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RVP,,,VAL-CNA-RVP-10,"Assert: wAF Web ACLs have rules configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rvp-11,KSI-CNA-RVP.11 [AWS] Internet-facing ALBs have Shield protection,Check internet-facing ALBs have Shield protection. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RVP,,,VAL-CNA-RVP-11,"Assert: internet-facing ALBs have Shield protection, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rvp-12,KSI-CNA-RVP.12 [AWS] GuardDuty enabled for automated threat detection,Check GuardDuty enabled for automated threat detection. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RVP,,,VAL-CNA-RVP-12,"Assert: guardDuty enabled for automated threat detection, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rvp-13,KSI-CNA-RVP.13 [AWS] CloudWatch alarms have actions enabled for,Check CloudWatch alarms have actions enabled for automated response. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RVP,,,VAL-CNA-RVP-13,"Assert: cloudWatch alarms have actions enabled for automated response, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-rvp-20,KSI-CNA-RVP.20 [Azure] Application Gateway has Web Application,Review and validate security protections for DDoS and flooding attacks. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-RVP,,,VAL-CNA-RVP-20,"Assert: application Gateway has Web Application Firewall enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-uln-10,KSI-CNA-ULN.10 [AWS] Config rules detecting drift from desired state,Automatically assess and enforce security posture. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-ULN,,,VAL-CNA-ULN-10,"Assert: config rules detecting drift from desired state, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-uln-11,KSI-CNA-ULN.11 [AWS] SSM associations status,Check SSM associations status (State Manager enforces configuration). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-ULN,,,VAL-CNA-ULN-11,"Assert: sSM associations status, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-uln-12,KSI-CNA-ULN.12 [AWS] Non-compliant Config rules have auto-remediation,Check non-compliant Config rules (verify auto-remediation is configured). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-ULN,,,VAL-CNA-ULN-12,"Assert: non-compliant Config rules have auto-remediation configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-cna-uln-20,KSI-CNA-ULN.20 [Azure] Private endpoints are successfully provisioned,Use logical networking to enforce traffic flow controls and network segmentation. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-CNA-ULN,,,VAL-CNA-ULN-20,"Assert: private endpoints are successfully provisioned, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-iam-aam-10,KSI-IAM-AAM.10 [AWS] IAM password policy minimum length,"Use secure passwordless methods when feasible, otherwise enforce strong passwords with MFA. Automated check evaluated continuously against the AWS estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-10,"Assert: iAM password policy minimum length, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-aam-11,KSI-IAM-AAM.11 [AWS] IAM password reuse prevention,Check IAM password reuse prevention. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-11,"Assert: iAM password reuse prevention, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-aam-12,KSI-IAM-AAM.12 [AWS] Users with passwords over 90 days old,Check for users with passwords over 90 days old. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-12,"Assert: users with passwords over 90 days old, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-aam-20,KSI-IAM-AAM.20 [Azure] Key Vault secret expiration dates are set,"Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-20,"Assert: key Vault secret expiration dates are set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-aam-21,KSI-IAM-AAM.21 [Azure] Key Vault secret expiration dates set,"Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-21,"Assert: key Vault secret expiration dates set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-aam-22,KSI-IAM-AAM.22 [Azure] Storage account requires secure transfer,"Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-22,"Assert: storage account requires secure transfer, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-aam-30,KSI-IAM-AAM.30 [Entra] Detect stale user accounts and enforce,The lifecycle of all accounts is securely managed using automation. Detect and manage user accounts that have not signed in for 90+ days. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-30,"Assert: detect stale user accounts and enforce lifecycle management, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-aam-31,KSI-IAM-AAM.31 [Entra] Detect inactive user accounts requiring removal,Accounts with no sign-in activity for more than 90 days should be disabled or removed. Validates automated lifecycle management. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-AAM,,,VAL-IAM-AAM-31,"Assert: detect inactive user accounts requiring removal, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-iam-apm-10,KSI-IAM-APM.10 [AWS] IAM roles without condition constraints on assume,Secure service accounts and machine identities. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-10,"Assert: iAM roles without condition constraints on assume role, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-iam-apm-11,KSI-IAM-APM.11 [AWS] Active access keys older than 90 days,Check active access keys older than 90 days (long-lived keys = risk). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-11,"Assert: active access keys older than 90 days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-apm-12,KSI-IAM-APM.12 [AWS] Unused instance profiles,Check for unused instance profiles (should be cleaned up). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-12,"Assert: unused instance profiles, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-apm-13,KSI-IAM-APM.13 [AWS] EC2 instances without managed identity,Check EC2 instances without managed identity (may use embedded credentials). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-13,"Assert: eC2 instances without managed identity, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-apm-14,KSI-IAM-APM.14 [AWS] IAM users have no console password,"Check IAM users have no console password (console access should be via SSO/federation, not IAM users). Automated check evaluated continuously against the AWS estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-14,"Assert: iAM users have no console password, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-apm-20,KSI-IAM-APM.20 [Azure] Verify managed identities are used for Azure,Enforce appropriately secure authentication methods for non-user accounts and services. Azure resources should use managed identities instead of shared credentials. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-20,"Assert: verify managed identities are used for Azure resources, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-iam-apm-21,KSI-IAM-APM.21 [Azure] SQL Server uses Azure AD authentication,Enforce appropriately secure authentication methods for non-user accounts and services. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-21,"Assert: sQL Server uses Azure AD authentication, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-apm-30,KSI-IAM-APM.30 [Entra] Enforce phishing-resistant MFA via Conditional,Conditional Access policies must enforce phishing-resistant MFA methods for user authentication to prevent account compromise. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-30,"Assert: enforce phishing-resistant MFA via Conditional Access policies, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-apm-31,KSI-IAM-APM.31 [Entra] Verify users are covered by passwordless/MFA,Verify that enabled users are covered by Conditional Access policies that enforce passwordless methods or phishing-resistant MFA. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-31,"Assert: verify users are covered by passwordless/MFA enforcement policies, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-apm-32,KSI-IAM-APM.32 [Entra] Verify MFA is enabled for all users,Verify that multi-factor authentication is enforced for all user accounts. MFA is enforced through Conditional Access policies and must cover all enabled member users. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-32,"Assert: verify MFA is enabled for all users, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-apm-33,KSI-IAM-APM.33 [Entra] Ensure Conditional Access policies are,Verify that Conditional Access policies are configured and enforced to control authentication and authorization decisions. Policies must be in 'enabled' state to be effective. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-33,"Assert: ensure Conditional Access policies are configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-apm-34,KSI-IAM-APM.34 [Entra] Verify legacy authentication is blocked,"Ensure legacy authentication protocols (SMTP, IMAP, POP3) are blocked via Conditional Access policies to enforce modern authentication methods and reduce attack surface. Automated check evaluated continuously against the Entra estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-APM,,,VAL-IAM-APM-34,"Assert: verify legacy authentication is blocked, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-elp-10,KSI-IAM-ELP.10 [AWS] Customer-managed policies with wildcard actions,Ensure permissions are scoped to minimum necessary. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-10,"Assert: customer-managed policies with wildcard actions, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-elp-11,KSI-IAM-ELP.11 [AWS] Users with AdministratorAccess policy,Check users with AdministratorAccess policy. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-11,"Assert: users with AdministratorAccess policy, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-elp-12,KSI-IAM-ELP.12 [AWS] Roles with AdministratorAccess,Check roles with AdministratorAccess (excluding AWS service roles). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-12,"Assert: roles with AdministratorAccess, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-elp-13,KSI-IAM-ELP.13 [AWS] Lambda functions have dedicated (non-shared),Check Lambda functions each have a dedicated (non-shared) execution role. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-13,"Assert: lambda functions have dedicated (non-shared) execution roles, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-elp-20,KSI-IAM-ELP.20 [Azure] Custom RBAC roles with wildcard permissions,Persistently ensure that identity and access management employs measures to ensure each user or device can only access the resources they need. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-20,"Assert: custom RBAC roles with wildcard permissions, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-elp-30,KSI-IAM-ELP.30 [Entra] PIM least privilege configuration for,Persistently ensure that identity and access management employs measures to ensure each user or device can only access the resources they need. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-30,"Assert: pIM least privilege configuration for privileged role assignments, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-elp-31,KSI-IAM-ELP.31 [Entra] Inactive users with active role assignments for,"Identify enabled users who have not signed in for 90+ days but retain role assignments, indicating stale access that violates least privilege principles. Automated check evaluated continuously against the Entra estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-31,"Assert: inactive users with active role assignments for stale access, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-elp-32,KSI-IAM-ELP.32 [Entra] Restrict and monitor guest account access,Verify that guest user accounts have restricted access and are not left enabled unnecessarily. Guest accounts should be disabled unless explicitly authorized and monitored. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-ELP,,,VAL-IAM-ELP-32,"Assert: restrict and monitor guest account access, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-iam-jit-10,KSI-IAM-JIT.10 [AWS] Users use temporary credentials,IAM users with permanent access keys should use temporary credentials. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-JIT,,,VAL-IAM-JIT-10,"Assert: users use temporary credentials, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-jit-31,KSI-IAM-JIT.31 [Entra] PIM JIT activation is configured for privileged,Ensure privileged access requires activation through Privileged Identity Management (PIM) for just-in-time authorization. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-JIT,,,VAL-IAM-JIT-31,"Assert: pIM JIT activation is configured for privileged roles, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-jit-32,KSI-IAM-JIT.32 [Entra] Permanent privileged role assignments that,"Identify permanent privileged role assignments (Global Administrator, Privileged Role Administrator, Security Administrator) that should be converted to PIM eligible assignments for just-in-time access. Automated check evaluated continuously against the Entra estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-JIT,,,VAL-IAM-JIT-32,"Assert: permanent privileged role assignments that should use PIM JIT, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-snu-10,KSI-IAM-SNU.10 [AWS] Stale users not logged in for 90+ days,Automate account lifecycle management. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-10,"Assert: stale users not logged in for 90+ days, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-iam-snu-11,KSI-IAM-SNU.11 [AWS] Access keys not rotated in 90+ days,Check access keys not rotated in 90+ days. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-11,"Assert: access keys not rotated in 90+ days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-snu-12,KSI-IAM-SNU.12 [AWS] SSO instances have identity store configured,Check SSO instances have identity store configured (enables automated provisioning/deprovisioning). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-12,"Assert: sSO instances have identity store configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-snu-20,KSI-IAM-SNU.20 [Azure] Storage accounts have shared key access,Secure non-user authentication by requiring Entra ID auth instead of shared keys. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-20,"Assert: storage accounts have shared key access disabled, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-snu-30,KSI-IAM-SNU.30 [Entra] Verify service principal credentials are not,Service principal credentials must be rotated regularly and not expire. Validate that password credentials are managed with appropriate expiration. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-30,"Assert: verify service principal credentials are not expired, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-snu-31,KSI-IAM-SNU.31 [Entra] Enforce certificate-based authentication for,Service principals should use certificate-based authentication instead of passwords. Verify that service principals do not rely solely on secrets. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-31,"Assert: enforce certificate-based authentication for service principals, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-snu-32,KSI-IAM-SNU.32 [Entra] Verify certificate credentials are rotated,Certificate credentials must be rotated regularly (at least annually) to maintain security. Verify that service principal certificates are not expired and have been rotated within the last year. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SNU,,,VAL-IAM-SNU-32,"Assert: verify certificate credentials are rotated regularly, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-sus-10,KSI-IAM-SUS.10 [AWS] GuardDuty enabled for suspicious activity,Detect and respond to suspicious authentication activity. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SUS,,,VAL-IAM-SUS-10,"Assert: guardDuty enabled for suspicious activity detection, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-sus-11,KSI-IAM-SUS.11 [AWS] IAM-related CloudWatch alarms have actions,Check IAM-related CloudWatch alarms have actions enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SUS,,,VAL-IAM-SUS-11,"Assert: iAM-related CloudWatch alarms have actions enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-sus-20,KSI-IAM-SUS.20 [Azure] Microsoft Defender for Cloud is enabled for,Detect and respond to suspicious identity activity. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SUS,,,VAL-IAM-SUS-20,"Assert: microsoft Defender for Cloud is enabled for identity protection, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-iam-sus-21,KSI-IAM-SUS.21 [Azure] Ensure security alerts notify owners,Verify that security alerts from Microsoft Defender for Cloud notify subscription owners to ensure timely response to suspicious activity. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SUS,,,VAL-IAM-SUS-21,"Assert: ensure security alerts notify owners, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-sus-30,KSI-IAM-SUS.30 [Entra] Verify suspicious activity monitoring is,"Ensure Conditional Access policies are configured to detect and respond to suspicious user activity through risk-based conditions (user risk, sign-in risk) to protect privileged accounts. Automated check evaluated continuously against the Entra estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-IAM-SUS,,,VAL-IAM-SUS-30,"Assert: verify suspicious activity monitoring is configured, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-inr-aar-10,KSI-INR-AAR.10 [AWS] GuardDuty enabled for incident detection,Maintain effective incident response capabilities. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-AAR,,,VAL-INR-AAR-10,"Assert: guardDuty enabled for incident detection, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-inr-aar-11,KSI-INR-AAR.11 [AWS] CloudWatch log groups have sufficient retention,Check CloudWatch log groups have sufficient retention for incident investigation. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-AAR,,,VAL-INR-AAR-11,"Assert: cloudWatch log groups have sufficient retention for incident investigation, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-inr-aar-20,KSI-INR-AAR.20 [Azure] Azure Defender enabled for services,"Microsoft Defender for Cloud is enabled on the Standard tier, providing the incident detection that feeds after action reporting. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-AAR,,,VAL-INR-AAR-20,"Assert: azure Defender enabled for services, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-inr-aar-21,KSI-INR-AAR.21 [Azure] Verify activity log alerts exist for,Ensure activity log alerts are configured to monitor and alert on administrative operations. Essential for incident response and audit trail review. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-AAR,,,VAL-INR-AAR-21,"Assert: verify activity log alerts exist for administrative operations, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-inr-rir-10,KSI-INR-RIR.10 [AWS] GuardDuty is detecting suspicious activity,Detect and respond to suspicious authentication activity. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RIR,,,VAL-INR-RIR-10,"Assert: guardDuty is detecting suspicious activity, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-inr-rir-11,KSI-INR-RIR.11 [AWS] GuardDuty is detecting automated threats,Check GuardDuty enabled for automated threat detection. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RIR,,,VAL-INR-RIR-11,"Assert: guardDuty is detecting automated threats, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-inr-rir-12,KSI-INR-RIR.12 [AWS] GuardDuty is detecting incidents,Maintain effective incident response capabilities. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RIR,,,VAL-INR-RIR-12,"Assert: guardDuty is detecting incidents, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-inr-rir-20,KSI-INR-RIR.20 [Azure] Diagnostic settings have a log destination,Review and maintain documented incident response procedures. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RIR,,,VAL-INR-RIR-20,"Assert: diagnostic settings have a log destination configured, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-inr-rpi-10,KSI-INR-RPI.10 [AWS] GuardDuty is detecting incidents for pattern,Maintain effective incident response capabilities. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RPI,,,VAL-INR-RPI-10,"Assert: guardDuty is detecting incidents for pattern analysis, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-inr-rpi-11,KSI-INR-RPI.11 [AWS] ECR repositories have vulnerability scanning,Identify and mitigate supply chain risks. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-INR-RPI,,,VAL-INR-RPI-11,"Assert: eCR repositories have vulnerability scanning enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-ala-10,KSI-MLA-ALA.10 [AWS] Log buckets do not grant public ACL access,Restrict access to log data using least privilege. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-ALA,,,VAL-MLA-ALA-10,"Assert: log buckets do not grant public ACL access, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-ala-11,KSI-MLA-ALA.11 [AWS] CloudWatch log groups have KMS encryption,Check log groups have KMS encryption (protect log data at rest). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-ALA,,,VAL-MLA-ALA-11,"Assert: cloudWatch log groups have KMS encryption, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-ala-20,KSI-MLA-ALA.20 [Azure] Log Analytics workspaces disable public network,Authorize and restrict access to audit logs and log data. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-ALA,,,VAL-MLA-ALA-20,"Assert: log Analytics workspaces disable public network access, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-ala-30,KSI-MLA-ALA.30 [Entra] Enforce just-in-time access to log-related,"Verify that roles with log data access (Security Reader, Security Administrator, Compliance Administrator, Audit roles) use PIM-eligible just-in-time access instead of permanent assignments. Automated check evaluated continuously against the Entra estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-ALA,,,VAL-MLA-ALA-30,"Assert: enforce just-in-time access to log-related roles via PIM, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-ala-31,KSI-MLA-ALA.31 [Entra] Identify and mitigate permanent assignments to,Identify permanent (non-PIM) assignments to sensitive roles with log data access. These should be converted to PIM-eligible to enforce just-in-time authorization. Automated check evaluated continuously against the Entra estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-ALA,,,VAL-MLA-ALA-31,"Assert: identify and mitigate permanent assignments to sensitive log-access roles, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-mla-evc-10,KSI-MLA-EVC.10 [AWS] AWS Config is actively recording configuration,Check AWS Config is actively recording configuration changes. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-EVC,,,VAL-MLA-EVC-10,"Assert: aWS Config is actively recording configuration, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-evc-11,KSI-MLA-EVC.11 [AWS] Non-compliant Config rules for auto-remediation,Check non-compliant Config rules (verify auto-remediation is configured). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-EVC,,,VAL-MLA-EVC-11,"Assert: non-compliant Config rules for auto-remediation, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-evc-12,KSI-MLA-EVC.12 [AWS] Config rules compliance status,Check Config rules compliance status (aggregate configuration posture view). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-EVC,,,VAL-MLA-EVC-12,"Assert: config rules compliance status, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-evc-20,KSI-MLA-EVC.20 [Azure] Policy compliance tracking placeholder,Placeholder: asserts policy compliance tracking per subscription but evaluates no configuration state and cannot fail. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-EVC,,,VAL-MLA-EVC-20,"Assert: policy compliance tracking placeholder, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-mla-let-10,KSI-MLA-LET.10 [AWS] CloudTrail trails have log integrity validation,"Operate centralized, tamper-resistant logging. Automated check evaluated continuously against the AWS estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-10,"Assert: cloudTrail trails have log integrity validation, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-11,KSI-MLA-LET.11 [AWS] CloudWatch log groups are encrypted,Check CloudWatch log groups are encrypted (protect sensitive audit data). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-11,"Assert: cloudWatch log groups are encrypted, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-12,KSI-MLA-LET.12 [AWS] Security Lake status,Check Security Lake status (centralizes security telemetry). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-12,"Assert: security Lake status, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-mla-let-13,KSI-MLA-LET.13 [AWS] Application Load Balancers have access logging,Check Application Load Balancers have access logging enabled to S3. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-13,"Assert: application Load Balancers have access logging enabled to S3, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-14,KSI-MLA-LET.14 [AWS] VPCs have flow logs enabled,Control where network traffic can flow using segmentation and routing. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-14,"Assert: vPCs have flow logs enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-let-21,KSI-MLA-LET.21 [Azure] Diagnostic settings have log categories defined,"Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistant logging of events, activities, and changes. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-21,"Assert: diagnostic settings have log categories defined, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-22,KSI-MLA-LET.22 [Azure] Diagnostic settings capture required log,Verify that diagnostic settings are configured to capture all required log categories for Network Security Groups and other resources to support centralized logging and SIEM integration. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-22,"Assert: diagnostic settings capture required log categories, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-23,KSI-MLA-LET.23 [Azure] SQL Servers have auditing enabled,"Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistant logging of events, activities, and changes. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-23,"Assert: sQL Servers have auditing enabled, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-24,KSI-MLA-LET.24 [Azure] Log Analytics workspace retention,"Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistant logging of events, activities, and changes. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-24,"Assert: log Analytics workspace retention, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-let-25,KSI-MLA-LET.25 [Azure] Verify Azure Monitor log alerts are configured,"Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistant logging of events, activities, and changes. Log Analytics workspaces should have alerts configured. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-LET,,,VAL-MLA-LET-25,"Assert: verify Azure Monitor log alerts are configured, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-osm-10,KSI-MLA-OSM.10 [AWS] AWS Config recorders are actively recording,Check AWS Config is actively recording configuration changes. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-OSM,,,VAL-MLA-OSM-10,"Assert: aWS Config recorders are actively recording configurations, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-osm-11,KSI-MLA-OSM.11 [AWS] Config rules compliance status,Check Config rules compliance status (aggregate configuration posture view). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-OSM,,,VAL-MLA-OSM-11,"Assert: config rules compliance status, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-mla-osm-20,KSI-MLA-OSM.20 [Azure] Log Analytics workspaces disable local,Operate a centralized SIEM system for security event monitoring and analysis. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-OSM,,,VAL-MLA-OSM-20,"Assert: log Analytics workspaces disable local authentication, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-mla-rvl-10,KSI-MLA-RVL.10 [AWS] CloudWatch log groups have encryption,Check CloudWatch log groups are encrypted (protect sensitive audit data). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-RVL,,,VAL-MLA-RVL-10,"Assert: cloudWatch log groups have encryption, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-rvl-11,KSI-MLA-RVL.11 [AWS] CloudWatch log groups have KMS encryption,Check log groups have KMS encryption (protect log data at rest). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-RVL,,,VAL-MLA-RVL-11,"Assert: cloudWatch log groups have KMS encryption, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-rvl-12,KSI-MLA-RVL.12 [AWS] CloudWatch log groups have sufficient retention,Check CloudWatch log groups have sufficient retention for incident investigation. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-RVL,,,VAL-MLA-RVL-12,"Assert: cloudWatch log groups have sufficient retention, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-mla-rvl-20,KSI-MLA-RVL.20 [Azure] Subscriptions have enabled activity log alert,Regularly review and analyze audit logs for security events and anomalies. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-MLA-RVL,,,VAL-MLA-RVL-20,"Assert: subscriptions have enabled activity log alert rules, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-piy-giv-10,KSI-PIY-GIV.10 [AWS] AWS Config provides automated inventory,Generate real-time resource inventory automatically. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-10,"Assert: aWS Config provides automated inventory, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-piy-giv-11,KSI-PIY-GIV.11 [AWS] EC2 instances have required inventory tags,Check EC2 instances have required inventory tags (Name and Environment minimum). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-11,"Assert: eC2 instances have required inventory tags, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-piy-giv-12,KSI-PIY-GIV.12 [AWS] S3 buckets have required inventory tags,Check S3 buckets have required inventory tags. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-12,"Assert: s3 buckets have required inventory tags, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-piy-giv-20,KSI-PIY-GIV.20 [Azure] Verify Azure Resource Graph can query resources,Use authoritative sources to automatically generate real-time inventories of all information resources when needed. Ensure subscriptions are available for resource discovery. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-20,"Assert: verify Azure Resource Graph can query resources, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-piy-giv-21,KSI-PIY-GIV.21 [Azure] Verify Azure Policy assignments exist for,Use authoritative sources to automatically generate real-time inventories of all information resources when needed. Azure Policy assignments enforce organizational standards and configuration baselines. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-21,"Assert: verify Azure Policy assignments exist for governance, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-piy-giv-22,KSI-PIY-GIV.22 [Azure] Verify subscriptions are organized with,Use authoritative sources to automatically generate real-time inventories of all information resources when needed. Management groups provide organizational hierarchy for resource management and policy governance. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-GIV,,,VAL-PIY-GIV-22,"Assert: verify subscriptions are organized with management groups, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-piy-res-10,KSI-PIY-RES.10 [AWS] Support role is created,IAM Support role has been created. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RES,,,VAL-PIY-RES-10,"Assert: support role is created, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-piy-rsd-10,KSI-PIY-RSD.10 [AWS] Review CodeBuild projects for privileged mode,Check CodeBuild projects for privileged mode (security review needed). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RSD,,,VAL-PIY-RSD-10,"Assert: review CodeBuild projects for privileged mode, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-piy-rsd-11,KSI-PIY-RSD.11 [AWS] CodePipeline has sufficient stages for build and,Automate testing throughout deployment process. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RSD,,,VAL-PIY-RSD-11,"Assert: codePipeline has sufficient stages for build and test, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-piy-rsd-12,KSI-PIY-RSD.12 [AWS] Review Lambda functions for code signing,Check Lambda functions have code signing configured to enforce publisher trust. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RSD,,,VAL-PIY-RSD-12,"Assert: review Lambda functions for code signing configuration, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-piy-rsd-20,KSI-PIY-RSD.20 [Azure] Virtual machines have network interfaces,Virtual machines have network interfaces attached. Note: this check does not evaluate SDLC security practices. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RSD,,,VAL-PIY-RSD-20,"Assert: virtual machines have network interfaces attached, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-piy-rvd-10,KSI-PIY-RVD.10 [AWS] ECR repositories have vulnerability scanning,Identify and mitigate supply chain risks. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RVD,,,VAL-PIY-RVD-10,"Assert: eCR repositories have vulnerability scanning enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-piy-rvd-20,KSI-PIY-RVD.20 [Azure] SQL Servers have vulnerability assessment,Review and respond to vulnerability disclosures and security advisories. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-PIY-RVD,,,VAL-PIY-RVD-20,"Assert: sQL Servers have vulnerability assessment configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-10,KSI-RPL-ABO.10 [AWS] Backup plans have rules configured,Ensure backup coverage and configuration. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-10,"Assert: backup plans have rules configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-11,KSI-RPL-ABO.11 [AWS] Backup vaults are encrypted,Check backup vaults are encrypted. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-11,"Assert: backup vaults are encrypted, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-12,KSI-RPL-ABO.12 [AWS] RDS instances have automated backups enabled,Check RDS instances have automated backups enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-12,"Assert: rDS instances have automated backups enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-13,KSI-RPL-ABO.13 [AWS] S3 buckets have versioning enabled,Check S3 buckets have versioning enabled (provides object recovery capability). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-13,"Assert: s3 buckets have versioning enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-14,KSI-RPL-ABO.14 [AWS] Backup S3 buckets have cross-region replication,Check backup S3 buckets have cross-region replication configured for geographic redundancy. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-14,"Assert: backup S3 buckets have cross-region replication configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-15,KSI-RPL-ABO.15 [AWS] AWS Backup has completed database backups within,Check AWS Backup has completed database backup recovery points within the last 24 hours. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-15,"Assert: aWS Backup has completed database backups within 24 hours, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-abo-20,KSI-RPL-ABO.20 [Azure] Verify backup strategy supports defined,Align backup strategies with defined recovery objectives. Cross-region redundancy enables meeting RTO and RPO requirements. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ABO,,,VAL-RPL-ABO-20,"Assert: verify backup strategy supports defined recovery objectives, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-arp-10,KSI-RPL-ARP.10 [AWS] Backup plans have rules defined,Ensure backup coverage and configuration. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ARP,,,VAL-RPL-ARP-10,"Assert: backup plans have rules defined, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-arp-11,KSI-RPL-ARP.11 [AWS] Backup vaults have recovery points,Define and maintain RTO/RPO objectives. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ARP,,,VAL-RPL-ARP-11,"Assert: backup vaults have recovery points, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-arp-12,KSI-RPL-ARP.12 [AWS] DynamoDB tables have point-in-time recovery,Check DynamoDB tables have Point-in-Time Recovery (PITR) enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ARP,,,VAL-RPL-ARP-12,"Assert: dynamoDB tables have point-in-time recovery, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-arp-20,KSI-RPL-ARP.20 [Azure] Verify backup vaults have cross-region,Align recovery plan with business continuity objectives. Backup vaults must support cross-region redundancy for disaster recovery. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-ARP,,,VAL-RPL-ARP-20,"Assert: verify backup vaults have cross-region redundancy for recovery plan, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-rro-10,KSI-RPL-RRO.10 [AWS] Backup vaults have recovery points,Define and maintain RTO/RPO objectives. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-RRO,,,VAL-RPL-RRO-10,"Assert: backup vaults have recovery points, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-rro-11,KSI-RPL-RRO.11 [AWS] RDS instances have adequate backup retention,Check RDS instances have adequate backup retention (minimum 7 days for RPO). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-RRO,,,VAL-RPL-RRO-11,"Assert: rDS instances have adequate backup retention, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-rro-12,KSI-RPL-RRO.12 [AWS] DynamoDB tables have Point-in-Time Recovery,Check DynamoDB tables have Point-in-Time Recovery (PITR) enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-RRO,,,VAL-RPL-RRO-12,"Assert: dynamoDB tables have Point-in-Time Recovery (PITR) enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-rro-20,KSI-RPL-RRO.20 [Azure] Verify SQL databases have backup retention,Persistently review desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). SQL databases must have backup retention configured. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-RRO,,,VAL-RPL-RRO-20,"Assert: verify SQL databases have backup retention configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-rro-21,KSI-RPL-RRO.21 [Azure] Verify storage accounts use geo-redundant,Persistently review desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Storage accounts must use geo-redundant replication for disaster recovery. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-RRO,,,VAL-RPL-RRO-21,"Assert: verify storage accounts use geo-redundant replication for DR, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-rpl-trc-10,KSI-RPL-TRC.10 [AWS] Backup and archive S3 buckets have cross-region,Check backup S3 buckets have cross-region replication configured for geographic redundancy. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-TRC,,,VAL-RPL-TRC-10,"Assert: backup and archive S3 buckets have cross-region replication, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-trc-11,KSI-RPL-TRC.11 [AWS] DynamoDB tables have point-in-time recovery,Check DynamoDB tables have Point-in-Time Recovery (PITR) enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-TRC,,,VAL-RPL-TRC-11,"Assert: dynamoDB tables have point-in-time recovery, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-trc-12,KSI-RPL-TRC.12 [AWS] CodePipeline has sufficient stages for testing,Automate testing throughout deployment process. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-TRC,,,VAL-RPL-TRC-12,"Assert: codePipeline has sufficient stages for testing, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-rpl-trc-20,KSI-RPL-TRC.20 [Azure] Verify backup infrastructure supports recovery,Regularly test and validate recovery capabilities and procedures. Cross-region backup redundancy enables disaster recovery testing. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-RPL-TRC,,,VAL-RPL-TRC-20,"Assert: verify backup infrastructure supports recovery testing, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-scr-mon-10,KSI-SCR-MON.10 [AWS] RDS instances have enhanced monitoring enabled,Automated check: rDS instances have enhanced monitoring enabled.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SCR-MON,,,VAL-SCR-MON-10,"Assert: rDS instances have enhanced monitoring enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-scr-mon-11,KSI-SCR-MON.11 [AWS] EC2 instances have detailed monitoring enabled,Check EC2 instances have detailed monitoring enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SCR-MON,,,VAL-SCR-MON-11,"Assert: eC2 instances have detailed monitoring enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-scr-mon-20,KSI-SCR-MON.20 [Azure] Diagnostic settings have a log destination,Diagnostic settings have a log destination configured. Note: this check does not evaluate upstream or third-party vulnerability monitoring. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SCR-MON,,,VAL-SCR-MON-20,"Assert: diagnostic settings have a log destination configured, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-svc-acm-10,KSI-SVC-ACM.10 [AWS] Customer-managed KMS keys have automatic rotation,Automate secret rotation and protection. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-10,"Assert: customer-managed KMS keys have automatic rotation enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-11,KSI-SVC-ACM.11 [AWS] Secrets Manager secrets accessed within 90 days,Check Secrets Manager secrets have been accessed within 90 days (orphaned secrets pose credential risk). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-11,"Assert: secrets Manager secrets accessed within 90 days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-12,KSI-SVC-ACM.12 [AWS] Secrets Manager secrets have automatic rotation,Check Secrets Manager secrets have automatic rotation enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-12,"Assert: secrets Manager secrets have automatic rotation enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-13,KSI-SVC-ACM.13 [AWS] Secrets Manager secrets rotated within 90 days,Check Secrets Manager secrets have been rotated within the last 90 days. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-13,"Assert: secrets Manager secrets rotated within 90 days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-14,KSI-SVC-ACM.14 [AWS] DynamoDB tables use customer-managed KMS keys for,Check DynamoDB tables use customer-managed KMS keys (CMK) for encryption at rest. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-14,"Assert: dynamoDB tables use customer-managed KMS keys for encryption, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-20,KSI-SVC-ACM.20 [Azure] Key Vault key rotation policy configured,"Automate management, protection, and regular rotation of digital keys, certificates, and other secrets. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-20,"Assert: key Vault key rotation policy configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-svc-acm-21,KSI-SVC-ACM.21 [Azure] Key Vault secrets have expiration dates set,"Automate management, protection, and regular rotation of digital keys, certificates, and other secrets. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-21,"Assert: key Vault secrets have expiration dates set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-22,KSI-SVC-ACM.22 [Azure] Key Vault secrets have expiration dates,"Automate management, protection, and regular rotation of digital keys, certificates, and other secrets. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-22,"Assert: key Vault secrets have expiration dates, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-23,KSI-SVC-ACM.23 [Azure] Key Vault secrets have expiration dates set,"Verify that Key Vault certificates, keys, and secrets have expiration dates set. This ensures automated management and rotation of digital credentials. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-23,"Assert: key Vault secrets have expiration dates set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-24,KSI-SVC-ACM.24 [Azure] Verify Application Gateway SSL certificates are,Ensure Application Gateway SSL/TLS certificates are not expired and not expiring within 30 days. Automated renewal should be configured for uninterrupted service. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-24,"Assert: verify Application Gateway SSL certificates are valid, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-acm-25,KSI-SVC-ACM.25 [Azure] Storage Account access keys rotation,"Automate management, protection, and regular rotation of digital keys, certificates, and other secrets. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ACM,,,VAL-SVC-ACM-25,"Assert: storage Account access keys rotation, with every non-conforming resource reported as a failing row.",Automated,Report,"Reconciliation report generated by the scheduled check, listing each in-scope resource and its result.",
val-svc-asm-10,KSI-SVC-ASM.10 [AWS] Customer-managed KMS keys have rotation enabled,Customer-managed KMS keys have automatic rotation enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ASM,,,VAL-SVC-ASM-10,"Assert: customer-managed KMS keys have rotation enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-asm-11,KSI-SVC-ASM.11 [AWS] Customer-managed KMS keys have automatic rotation,Automate secret rotation and protection. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ASM,,,VAL-SVC-ASM-11,"Assert: customer-managed KMS keys have automatic rotation, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-asm-12,KSI-SVC-ASM.12 [AWS] Secrets Manager secrets are accessed within,Check Secrets Manager secrets have been accessed within 90 days (orphaned secrets pose credential risk). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ASM,,,VAL-SVC-ASM-12,"Assert: secrets Manager secrets are accessed within rotation period, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-asm-20,KSI-SVC-ASM.20 [Azure] Key Vault secrets have expiration dates set,Automate management and rotation of secrets and credentials. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-ASM,,,VAL-SVC-ASM-20,"Assert: key Vault secrets have expiration dates set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-eis-10,KSI-SVC-EIS.10 [AWS] Security Lake data retention,Check Security Lake data retention is configured for at least 365 days. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-EIS,,,VAL-SVC-EIS-10,"Assert: security Lake data retention, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-eis-11,KSI-SVC-EIS.11 [AWS] Security Lake data sources operational,Verify Security Lake data sources are operational and actively ingesting logs. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-EIS,,,VAL-SVC-EIS-11,"Assert: security Lake data sources operational, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-eis-12,KSI-SVC-EIS.12 [AWS] Security Lake is centralized,Check Security Lake status (centralizes security telemetry). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-EIS,,,VAL-SVC-EIS-12,"Assert: security Lake is centralized, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-svc-eis-20,KSI-SVC-EIS.20 [Azure] Security assessment tracking placeholder,Placeholder: asserts security assessment tracking per subscription but evaluates no assessment state and cannot fail. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-EIS,,,VAL-SVC-EIS-20,"Assert: security assessment tracking placeholder, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-prr-10,KSI-SVC-PRR.10 [AWS] ASGs use launch templates,Manage configuration using automation. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-PRR,,,VAL-SVC-PRR-10,"Assert: aSGs use launch templates, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-prr-11,KSI-SVC-PRR.11 [AWS] CloudFormation stacks in failed or rollback state,Check CloudFormation stacks in failed or rollback state (indicates configuration automation issues). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-PRR,,,VAL-SVC-PRR-11,"Assert: cloudFormation stacks in failed or rollback state, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-prr-12,KSI-SVC-PRR.12 [AWS] Config rules for non-compliance,Check Config rules for non-compliance (indicates configuration drift). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-PRR,,,VAL-SVC-PRR-12,"Assert: config rules for non-compliance, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-prr-20,KSI-SVC-PRR.20 [Azure] SQL Servers have vulnerability assessment,Prevent residual security risks in information resources. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-PRR,,,VAL-SVC-PRR-20,"Assert: sQL Servers have vulnerability assessment configured, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-rud-10,KSI-SVC-RUD.10 [AWS] S3 buckets have lifecycle policies,Enable data lifecycle management and removal capability. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-RUD,,,VAL-SVC-RUD-10,"Assert: s3 buckets have lifecycle policies, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-rud-11,KSI-SVC-RUD.11 [AWS] Review DynamoDB tables for TTL configuration,Check DynamoDB tables have TTL configured (enables automatic data removal). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-RUD,,,VAL-SVC-RUD-11,"Assert: review DynamoDB tables for TTL configuration, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-rud-20,KSI-SVC-RUD.20 [Azure] Key Vaults have soft delete enabled,Securely remove unwanted data and information from systems. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-RUD,,,VAL-SVC-RUD-20,"Assert: key Vaults have soft delete enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-sin-10,KSI-SVC-SIN.10 [AWS] EBS volumes are encrypted,Check EBS volumes are encrypted. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-SIN,,,VAL-SVC-SIN-10,"Assert: eBS volumes are encrypted, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-sin-11,KSI-SVC-SIN.11 [AWS] S3 buckets have default encryption,Check S3 buckets have default encryption configured. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-SIN,,,VAL-SVC-SIN-11,"Assert: s3 buckets have default encryption, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-sin-12,KSI-SVC-SIN.12 [AWS] RDS instances are encrypted,RDS instances have encryption at rest enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-SIN,,,VAL-SVC-SIN-12,"Assert: rDS instances are encrypted, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-sin-13,KSI-SVC-SIN.13 [AWS] CloudWatch log groups are encrypted,Check CloudWatch log groups are encrypted (protect sensitive audit data). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-SIN,,,VAL-SVC-SIN-13,"Assert: cloudWatch log groups are encrypted, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-svc-sin-20,KSI-SVC-SIN.20 [Azure] Key Vault secrets have expiration dates set,Key Vault secrets have expiration dates set. Note: this check does not evaluate encryption of stored information. Automated check evaluated continuously against the Azure estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-SIN,,,VAL-SVC-SIN-20,"Assert: key Vault secrets have expiration dates set, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vcm-10,KSI-SVC-VCM.10 [AWS] Lambda functions for deprecated runtimes,Continuously improve security based on evaluations. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VCM,,,VAL-SVC-VCM-10,"Assert: lambda functions for deprecated runtimes, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vcm-11,KSI-SVC-VCM.11 [AWS] RDS instances have auto minor version upgrade,Check RDS instances have auto minor version upgrade enabled. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VCM,,,VAL-SVC-VCM-11,"Assert: rDS instances have auto minor version upgrade enabled, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vcm-20,KSI-SVC-VCM.20 [Azure] Verify AKS clusters use current Kubernetes,"Ensure AKS clusters run supported Kubernetes versions. Running outdated versions reduces access to latest security patches, features, and performance improvements. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VCM,,,VAL-SVC-VCM-20,"Assert: verify AKS clusters use current Kubernetes versions, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vri-10,KSI-SVC-VRI.10 [AWS] CloudTrail trails have log file integrity,Validate integrity of resources using cryptographic methods. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-10,"Assert: cloudTrail trails have log file integrity validation, with every non-conforming resource reported as a failing row.",Automated,Log,Exported log/trail configuration and the coverage listing produced by the scheduled check.,
val-svc-vri-11,KSI-SVC-VRI.11 [AWS] EC2 instances run approved trusted AMI images,Check EC2 instances are running approved trusted AMI images. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-11,"Assert: eC2 instances run approved trusted AMI images, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vri-12,KSI-SVC-VRI.12 [AWS] Critical buckets have object lock protection for,Check critical buckets have object lock protection for integrity. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-12,"Assert: critical buckets have object lock protection for integrity, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vri-13,KSI-SVC-VRI.13 [AWS] Review Lambda functions for code signing,Check Lambda functions have code signing configured to enforce publisher trust. Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-13,"Assert: review Lambda functions for code signing configuration, with every non-conforming resource reported as a failing row.",Automated,Configuration,Resource configuration export with the per-resource evaluation produced by the scheduled check.,
val-svc-vri-14,KSI-SVC-VRI.14 [AWS] IAM roles unused for 90+ days,Check for IAM roles unused for 90+ days (stale roles should be removed). Automated check evaluated continuously against the AWS estate.,Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-14,"Assert: iAM roles unused for 90+ days, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
val-svc-vri-20,KSI-SVC-VRI.20 [Azure] Storage immutability check,"Storage immutability policy verification is unavailable: the Azure plugin lacks the azure_storage_blob_container table, so every row is skipped. Automated check evaluated continuously against the Azure estate.",Validation>KSI,Demo Account,,Continuous Monitoring,Class C Validation SLA,Machine,KSI-SVC-VRI,,,VAL-SVC-VRI-20,"Assert: storage immutability check, with every non-conforming resource reported as a failing row.",Automated,Configuration,Identity/policy configuration export with the per-account or per-role evaluation table.,
