Checks

AWS Secrets Manager secrets with no retrieval activity beyond a configured window (default 90 days) are identified as unused based on their most recent access timestamp

The domain-level policy enforces 2-Step Verification for all users, allows users to turn it on, keeps the new user enrollment period at two weeks or less, disables device trust and excludes verification codes via text or phone call from the accepted methods.

The domain-level 2-Step Verification policy requires hardware security keys only as the allowed sign-in factor, with enforcement on or scheduled and a policy suspension grace period of at most one day. Note: the Policy API returns domain-wide policies only and cannot verify admin role-specific enforcement.

The domain-level policy enables the Advanced Protection Program with user self-enrollment and blocks the use of security codes. The Advanced Protection Program is Google's strongest account security offering, requiring hardware security keys and applying a curated set of high-security policies.

The domain-level API controls configuration restricts third-party app access to at least one Google service. This check verifies that the administrator has configured API access controls rather than leaving all services at the unrestricted default. The CIS benchmark recommends restricting access to all applicable services, particularly high-risk scopes like Drive and Gmail.

Alibaba Cloud Security Center should be running the Advanced or Enterprise Edition to enable comprehensive threat detection capabilities for network and endpoints. These editions provide malware detection, webshell detection, anomaly detection, and precision defense features that are not available in the Basic or Free editions.

Alibaba Cloud Security Center requires an agent to be installed on each endpoint to provide comprehensive endpoint intrusion detection and protection capabilities. The agent enables remote logon detection, webshell detection and removal, anomaly detection of abnormal process behaviors and network connections, and monitoring of changes to key files and suspicious accounts.

Alibaba Cloud Security Center should have all risk item notifications enabled across Vulnerability, Baseline Risks, Alerts, and AccessKey Leak event detection categories. This ensures that relevant security operators receive notifications as soon as critical security events occur, enabling timely incident response.

Alibaba Cloud Security Center should have scheduled vulnerability scanning enabled on all servers to periodically discover system vulnerabilities. The scan should cover all vulnerability types including yum, cve, sys, cms, and emg to ensure comprehensive detection of known security weaknesses across the infrastructure.

Vercel projects are assessed for custom firewall rule configuration. Custom rules allow fine-grained control over traffic based on request attributes such as path, headers, user agent, and geographic location, providing application-specific protection beyond managed rulesets.

At least one active Data Loss Prevention (DLP) rule targeting Google Drive file sharing is configured. DLP policies detect and prevent users from sharing sensitive information such as credit card numbers, identity numbers, and other regulated data through Drive.

E2E Networks security groups should not have an all-traffic rule, which permits unrestricted inbound and outbound network access.

E2E Networks security groups should not allow inbound all-protocol traffic from any source (0.0.0.0/0), which opens every port to the internet.

E2E Networks nodes should not rely solely on default security groups that have overly permissive inbound rules.

AWS Security Hub has a delegated administrator configured at the organization level, hubs are active in all opted-in regions, and organization auto-enable is active so that new member accounts are automatically enrolled.

AWS Security Hub is ACTIVE in the Region and has at least one enabled security standard or connected integration. Otherwise, it is either not enabled or enabled without standards/integrations.

The domain-level API controls configuration trusts internal domain-owned apps to access restricted Google Workspace APIs. This avoids the need to individually trust each internal app.

Vercel projects are assessed for IP blocking rule configuration. IP blocking rules allow denying access from known malicious IP addresses or ranges, reducing the attack surface and preventing traffic from untrusted sources.

The domain-level policy disables access to less secure apps that do not use modern security standards such as OAuth. Blocking these apps helps keep user accounts and organizational data safe.

The domain-level login challenges configuration has the employee ID challenge disabled. This check is not mapped to CIS 4.1.4.1 because that recommendation also requires Post-SSO verification, a setting not exposed by the Cloud Identity Policy API, so the requirement cannot be evaluated end to end.

Vercel projects are assessed for managed WAF ruleset enablement. Managed rulesets are curated by Vercel and provide protection against known attack patterns including OWASP Top 10 threats. Availability varies by ruleset, and the check reports MANUAL when the firewall configuration cannot be assessed from the API.

The domain-level password policy is configured with enhanced security settings: minimum length of 14 characters, strong passwords enforced, password reuse disallowed, enforcement at next sign-in enabled, and password expiration set to 365 days.

Vercel projects are assessed for rate limiting rule configuration. Rate limiting protects applications from abuse, brute-force attacks, and DDoS attempts by restricting the number of requests from a single source within a given time window.

The domain-level Google session control limits web session duration to 12 hours or less. When a session expires, users must re-authenticate, reducing the window of opportunity for session hijacking.