Checks

E2E Networks EFS volumes should restrict access to specific VPC resources instead of allowing every resource in the VPC to connect.

Azure Storage account network rules include the AzureServices bypass so trusted Microsoft services can reach the account even when firewalls restrict public access

Azure Storage accounts use customer-managed keys (CMK) from Key Vault/Managed HSM for service-side encryption of data at rest, rather than platform-managed keys (encryption_type=Microsoft.Keyvault).

Azure Storage file shares have soft delete with a retention period (days). The evaluation determines if the storage account's file service has this setting enabled and records the retention duration applied to all shares.

Azure Storage accounts enforce a minimum TLS version of 1.2 for client connections to data services

Azure Storage accounts are evaluated for the presence of Private Endpoint connections. When configured, traffic flows over a VNet private IP via Private Link; when absent, access occurs through the storage account's public endpoint.

Azure Storage accounts have container soft delete enabled via a retention policy that keeps deleted containers for a set period.

Storage Gateway file shares configured with customer-managed KMS keys (CMKs) for server-side encryption of objects written to S3.

File shares without an explicit KMS key (e.g., SSE-KMS or DSSE-KMS) are identified.

AWS Storage Gateway hosted on an EC2 instance is flagged by assessing each gateway's hosting environment, distinguishing single-instance EC2 deployments from non-EC2 platforms that can leverage platform-level high availability.

Azure Storage accounts configured for geo-redundant replication via Standard_GRS, Standard_GZRS, Standard_RAGRS, or Standard_RAGZRS.

The setting indicates data is copied to a paired secondary region, with RA-* allowing read access during primary-region unavailability.

Azure Storage accounts have infrastructure encryption enabled, providing double encryption at rest alongside service-level encryption (requireInfrastructureEncryption=true).

Azure Storage accounts must define a key expiration period for access-key rotation, with a maximum of 90 days. The evaluation looks for accounts lacking this setting or exceeding that limit.

Azure Storage accounts are evaluated for secure transfer enforcement, requiring all client requests to use HTTPS only (enableHttpsTrafficOnly) and blocking HTTP.

Azure Storage file shares (SMB) are evaluated for SMB channel encryption and whether the allowed ciphers include the recommended AES-256-GCM.

This identifies if encryption is configured and a secure algorithm is present in the SMB settings for file shares within the storage account.

Azure Storage file shares (SMB) are configured to allow only the latest SMB protocol version, blocking legacy SMB versions at the storage account level

Okta must off-load audit records to a central log server. At least one Log Stream (AWS EventBridge, Splunk Cloud, etc.) must be configured and ACTIVE in the tenant. Alternatively, an external SIEM pulling the System Log API can satisfy the requirement, but that pull-based path is verified manually.

Vercel team is assessed for directory sync (SCIM) enablement. Directory sync automates user provisioning and deprovisioning by synchronizing team membership with an external identity provider, ensuring timely access revocation when employees leave.

Vercel team members are assessed for least privilege by checking whether the proportion of members with the OWNER role exceeds a configurable percentage threshold (default: 20%) or a maximum owner count (default: 3). Both thresholds are configurable via audit_config. An excessive number of owners increases the attack surface and risk of accidental or malicious configuration changes.

Vercel team is assessed for stale invitations by checking whether pending invitations have been outstanding for more than 30 days. Stale invitations may indicate abandoned onboarding processes or forgotten invitation links that could be exploited.

Vercel team is assessed for SAML single sign-on (SSO) enablement. SAML SSO enables centralized identity management through an external identity provider, ensuring consistent authentication policies across the organization.

Vercel team is assessed for SAML SSO enforcement across all members. When enforced, all team members must authenticate through the configured identity provider, preventing the use of individual Vercel credentials.

Microsoft 365 Teams tenant configuration for channel email addresses determines if channels can receive messages via email. This evaluates the allow_email_into_channel setting.

The Teams external access configuration should block communication with trial-only tenants (tenants that don't have any purchased seats). When blocked, users from these trial-only tenants cannot search for, contact, call, or meet with the organization's users via Teams external access.

Microsoft 365 Teams tenant external access configuration is assessed. The expected posture is federation with external domains disabled, so users cannot chat, call, or meet with accounts in other domains.