Checks

The domain-level policy disables self-service account recovery for Super Admin accounts. When disabled, Super Admins cannot use recovery options (phone, email) to regain access, reducing the risk of account takeover through compromised recovery channels.

The domain-level policy enables self-service account recovery for non-Super Admin users. When enabled, users can recover access to their accounts if their password is forgotten, reducing helpdesk burden and downtime.

Vercel projects are assessed for Web Application Firewall (WAF) enablement. The WAF provides protection against common web attacks including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats.

AWS Service Catalog portfolios are assessed to confirm sharing occurs via AWS Organizations integration, not direct ACCOUNT shares. It reviews shared portfolios and identifies those targeted to individual accounts instead of organizational scopes.

Amazon SES identities are evaluated for DKIM (DomainKeys Identified Mail) signing enabled and verified. DKIM adds a cryptographic signature to outgoing emails, allowing recipients to verify that the email was sent by the domain owner and was not altered in transit.

Amazon SES identities are evaluated for publicly accessible resource policies-for example, statements with Principal:"*" or broadly trusted principals that permit actions against the identity.

Microsoft 365 SharePoint external sharing uses domain-based restrictions via AllowList or BlockList. The evaluation inspects sharingDomainRestrictionMode and whether the corresponding domain list is populated, flagging when domain controls are missing or the selected list is empty.

Microsoft 365 SharePoint org-wide external sharing is evaluated to ensure it excludes anonymous 'Anyone' links and is restricted to authenticated guests via ExternalUserSharingOnly, ExistingExternalUserSharingOnly, or fully Disabled.

Microsoft 365 SharePoint tenant sharing settings evaluate whether guest resharing is disabled (resharingEnabled=false).

Focus is the org-level option that blocks guests from sharing items they don't own.

Microsoft 365 SharePoint tenant settings require modern authentication for applications and block access for apps using legacy protocols.

The assessment determines whether legacy authentication is disabled so only OAuth-based sign-ins with advanced controls are allowed.

Microsoft 365 SharePoint tenant settings for OneDrive sync enforce that only managed, domain-joined devices can sync. The evaluation looks for a configured list of approved domain GUIDs that limits syncing to specific Active Directory domains.

Elastic IP addresses are assessed for AWS Shield Advanced coverage by verifying they are listed as protected resources.

Classic Load Balancers are evaluated for association with AWS Shield Advanced as a protected resource.

Identifies load balancers without an active Shield Advanced protection when the subscription is enabled.

CloudFront distributions are associated with AWS Shield Advanced as protected resources.

The assessment identifies distributions that lack this protection mapping.

AWS Global Accelerator accelerators are assessed for enrollment in Shield Advanced as protected resources, indicating whether enhanced DDoS coverage is configured for each accelerator.

Application Load Balancers that are internet-facing are evaluated for an associated AWS Shield Advanced protection. Scope includes ALBs of type application with external exposure.

Route 53 hosted zones have an active AWS Shield Advanced protection registered to the zone's ARN.

Each Okta brand's sign-in page must present the Standard Mandatory DOD Notice and Consent Banner (DTM-08-060) before granting access.

The check inspects the sign-in page HTML returned by the Okta Management API, using the customized page when present and otherwise falling back to the default sign-in page.

Aligns with DISA STIG V-273192 / OKTA-APP-000200.

Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Okta global session cookies persist across browser sessions to Disabled.

Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Aligns with DISA STIG V-273206 / OKTA-APP-001710.

Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Maximum Okta global session idle time to 15 minutes or less.

Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Threshold override: okta_max_session_idle_minutes. Aligns with DISA STIG V-273186.

Every active Okta Global Session Policy needs a Priority 1 rule that is not the built-in Default Rule, setting Maximum Okta global session lifetime to 18 hours or less.

Okta evaluates policies by group assignment, so a permissive custom policy can govern users. Threshold override: okta_max_session_lifetime_minutes (minutes). Aligns with DISA STIG V-273203.

Every active Okta Global Session Policy must apply the IF User's IP is condition, mapped to a Network Zone, on its Priority 1 active rule.

Unlike the idle / lifetime / cookie STIGs, this control does not exclude the built-in Default Rule. Okta evaluates policies by group assignment. Aligns with DISA STIG V-279691.

The domain-wide Google Sites configuration has the service disabled for all users. Google Sites allows users to create internal and external websites, which may expose sensitive information or create unmanaged content outside the organization's control.

The Kubernetes API server of an SKE cluster should not be reachable from the entire internet. Enable the ACL extension to restrict access to a known set of source CIDRs, or run the control plane inside a STACKIT Network Area (SNA) so that it is not published on the internet at all.