Distribution of evaluated control results.
Severity distribution for findings with active risk.
Confirmed control exceptions are shown separately from evidence-quality issues.
All active user accounts must have MFA enabled.
Terminated users must have their accounts disabled.
Administrative privileges must be limited to approved accounts.
Company-managed endpoints must use disk encryption.
Company-managed endpoints must have endpoint protection enabled.
Critical third-party vendors must have a documented security review.
Third-party vendors with privileged access must use MFA.
Active user accounts were identified without MFA enabled, increasing the risk of unauthorized access if credentials are compromised.
mlopez, jparis, snguyen
Enable MFA for all active user accounts and verify enrollment.
Terminated user accounts were identified as still enabled, increasing the risk of unauthorized access after employment ends.
malvarez
Disable terminated user accounts promptly and verify account deactivation as part of the offboarding process.
Administrative privileges were identified on accounts without documented approval, increasing the risk of unauthorized privileged access.
akim
Remove unapproved administrative privileges or document appropriate authorization, and periodically review privileged account access.
Company-managed endpoints were identified without disk encryption, increasing the risk of unauthorized access to data if a device is lost, stolen, or otherwise physically compromised.
DEV-002, DEV-005
Enable full-disk encryption on all company-managed endpoints and periodically verify encryption status through endpoint management.
Critical third-party vendors were identified without a documented security review, limiting the organization's ability to understand and manage cybersecurity risks introduced by those vendors.
VND-003
Complete and document security reviews for all critical third-party vendors and establish a process for periodic reassessment.
Third-party vendors with privileged access were identified without MFA enabled, increasing the risk that compromised vendor credentials could be used to gain unauthorized privileged access.
VND-002
Require MFA for all third-party vendors with privileged access and periodically verify that MFA remains enforced.