| 2-Step Verification enforced for all Google Workspace users | CC6.1 | GCP | critical | Pass | Oct 11, 2026 | {"message":"2-Step Verification enforced for all Google Workspace users: all observed resources comply.","affectedResources":[]} |
| 2FA required for all org members | CC6.1 | GITHUB | critical | Pass | Oct 11, 2026 | {"message":"2FA required for all org members: all observed resources comply.","affectedResources":[]} |
| Azure Activity Log diagnostic settings configured | CC7.2 | AZURE | critical | Fail | Oct 11, 2026 | {"message":"Azure Activity Log diagnostic settings configured: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Azure Key Vault in use for secrets management | CC6.1 | AZURE | high | Pass | Oct 11, 2026 | {"message":"Azure Key Vault in use for secrets management: all observed resources comply.","affectedResources":[]} |
| Azure PostgreSQL enforces SSL | CC6.1 | AZURE | high | Fail | Oct 11, 2026 | {"message":"Azure PostgreSQL enforces SSL: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Azure SQL Transparent Data Encryption enabled | CC6.1 | AZURE | high | Fail | Oct 11, 2026 | {"message":"Azure SQL Transparent Data Encryption enabled: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Azure SQL server-level auditing enabled | CC7.2 | AZURE | medium | Pass | Oct 11, 2026 | {"message":"Azure SQL server-level auditing enabled: all observed resources comply.","affectedResources":[]} |
| Azure Storage account public blob access disabled | CC6.1 | AZURE | critical | Fail | Oct 11, 2026 | {"message":"Azure Storage account public blob access disabled: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Azure managed disks encrypted at rest | CC6.1 | AZURE | high | Fail | Oct 11, 2026 | {"message":"Azure managed disks encrypted at rest: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Cloud Audit Logs enabled for all services | CC7.2 | GCP | critical | Fail | Oct 11, 2026 | {"message":"Cloud Audit Logs enabled for all services: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Cloud SQL instances encrypted at rest | CC6.1 | GCP | high | Fail | Oct 11, 2026 | {"message":"Cloud SQL instances encrypted at rest: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Cloud SQL requires SSL connections | CC6.1 | GCP | high | Pass | Oct 11, 2026 | {"message":"Cloud SQL requires SSL connections: all observed resources comply.","affectedResources":[]} |
| CloudTrail enabled in all regions | CC7.2 | AWS | critical | Fail | Oct 11, 2026 | {"message":"CloudTrail enabled in all regions: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| CloudTrail log file validation enabled | CC7.2 | AWS | high | Pass | Oct 11, 2026 | {"message":"CloudTrail log file validation enabled: all observed resources comply.","affectedResources":[]} |
| CloudWatch alarm for root account usage | CC7.2 | AWS | high | Pass | Oct 11, 2026 | {"message":"CloudWatch alarm for root account usage: all observed resources comply.","affectedResources":[]} |
| CloudWatch log groups retain at least 12 months | CC7.2 | AWS | high | Pass | Oct 11, 2026 | {"message":"CloudWatch log groups retain at least 12 months: all observed resources comply.","affectedResources":[]} |
| Compute Engine disks are encrypted | CC6.1 | GCP | high | Pass | Oct 11, 2026 | {"message":"Compute Engine disks are encrypted: all observed resources comply.","affectedResources":[]} |
| Default branch protection enabled | CC8.1 | GITHUB | critical | Fail | Oct 11, 2026 | {"message":"Default branch protection enabled: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Dependabot security alerts enabled | CC7.1 | GITHUB | high | Pass | Oct 11, 2026 | {"message":"Dependabot security alerts enabled: all observed resources comply.","affectedResources":[]} |
| EBS default encryption enabled | CC6.1 | AWS | high | Pass | Oct 11, 2026 | {"message":"EBS default encryption enabled: all observed resources comply.","affectedResources":[]} |
| GCS buckets block public access | CC6.1 | GCP | critical | Pass | Oct 11, 2026 | {"message":"GCS buckets block public access: all observed resources comply.","affectedResources":[]} |
| GuardDuty enabled in all regions | CC7.2 | AWS | critical | Fail | Oct 11, 2026 | {"message":"GuardDuty enabled in all regions: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| KMS symmetric keys rotate within 90 days | CC6.1 | GCP | medium | Pass | Oct 11, 2026 | {"message":"KMS symmetric keys rotate within 90 days: all observed resources comply.","affectedResources":[]} |
| Key Vaults use Azure RBAC | CC6.1 | AZURE | medium | Fail | Oct 11, 2026 | {"message":"Key Vaults use Azure RBAC: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Load balancer HTTPS listeners require TLS 1.2 or higher | CC6.1 | AWS | high | Pass | Oct 11, 2026 | {"message":"Load balancer HTTPS listeners require TLS 1.2 or higher: all observed resources comply.","affectedResources":[]} |
| Log Analytics workspaces retain logs for 90+ days | CC7.2 | AZURE | medium | Pass | Oct 11, 2026 | {"message":"Log Analytics workspaces retain logs for 90+ days: all observed resources comply.","affectedResources":[]} |
| Long-term log sink configured | CC7.2 | GCP | medium | Pass | Oct 11, 2026 | {"message":"Long-term log sink configured: all observed resources comply.","affectedResources":[]} |
| MFA enabled for all IAM users | CC6.1 | AWS | critical | Pass | Oct 11, 2026 | {"message":"MFA enabled for all IAM users: all observed resources comply.","affectedResources":[]} |
| MFA enforced via Security Defaults or Conditional Access | CC6.1 | AZURE | critical | Fail | Oct 11, 2026 | {"message":"MFA enforced via Security Defaults or Conditional Access: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Microsoft Defender for Cloud enabled on key workloads | CC7.2 | AZURE | high | Pass | Oct 11, 2026 | {"message":"Microsoft Defender for Cloud enabled on key workloads: all observed resources comply.","affectedResources":[]} |
| No NSG rule opens SSH/RDP to the internet | CC6.6 | AZURE | critical | Pass | Oct 11, 2026 | {"message":"No NSG rule opens SSH/RDP to the internet: all observed resources comply.","affectedResources":[]} |
| No credentials unused for 90+ days | CC6.2 | AWS | high | Pass | Oct 11, 2026 | {"message":"No credentials unused for 90+ days: all observed resources comply.","affectedResources":[]} |
| No firewall rule opens SSH/RDP to the internet | CC6.6 | GCP | critical | Pass | Oct 11, 2026 | {"message":"No firewall rule opens SSH/RDP to the internet: all observed resources comply.","affectedResources":[]} |
| No security groups expose SSH/RDP/DB ports to the internet | CC6.1 | AWS | critical | Pass | Oct 11, 2026 | {"message":"No security groups expose SSH/RDP/DB ports to the internet: all observed resources comply.","affectedResources":[]} |
| No stale Azure AD guest users | CC6.2 | AZURE | medium | Pass | Oct 11, 2026 | {"message":"No stale Azure AD guest users: all observed resources comply.","affectedResources":[]} |
| OS Login is enforced at the project level | CC6.2 | GCP | medium | Pass | Oct 11, 2026 | {"message":"OS Login is enforced at the project level: all observed resources comply.","affectedResources":[]} |
| Primitive IAM roles (Owner/Editor) not assigned to users | CC6.1 | GCP | high | Pass | Oct 11, 2026 | {"message":"Primitive IAM roles (Owner/Editor) not assigned to users: all observed resources comply.","affectedResources":[]} |
| Privileged Identity Management activated for admin roles | CC6.2 | AZURE | medium | Pass | Oct 11, 2026 | {"message":"Privileged Identity Management activated for admin roles: all observed resources comply.","affectedResources":[]} |
| RDS instances encrypted at rest | CC6.1 | AWS | high | Fail | Oct 11, 2026 | {"message":"RDS instances encrypted at rest: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| RDS instances enforce TLS at the parameter group | CC6.1 | AWS | high | Pass | Oct 11, 2026 | {"message":"RDS instances enforce TLS at the parameter group: all observed resources comply.","affectedResources":[]} |
| RDS instances use non-default master username | CC6.1 | AWS | medium | Pass | Oct 11, 2026 | {"message":"RDS instances use non-default master username: all observed resources comply.","affectedResources":[]} |
| Required status checks on default branch | CC8.1 | GITHUB | high | Fail | Oct 11, 2026 | {"message":"Required status checks on default branch: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Root account has no active access keys | CC6.1 | AWS | critical | Fail | Oct 11, 2026 | {"message":"Root account has no active access keys: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| S3 buckets encrypted at rest | CC6.1 | AWS | high | Pass | Oct 11, 2026 | {"message":"S3 buckets encrypted at rest: all observed resources comply.","affectedResources":[]} |
| S3 public access block enabled | CC6.1 | AWS | critical | Pass | Oct 11, 2026 | {"message":"S3 public access block enabled: all observed resources comply.","affectedResources":[]} |
| S3 versioning enabled on critical buckets | A1.2 | AWS | medium | Fail | Oct 11, 2026 | {"message":"S3 versioning enabled on critical buckets: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Secret scanning enabled | CC6.1 | GITHUB | high | Pass | Oct 11, 2026 | {"message":"Secret scanning enabled: all observed resources comply.","affectedResources":[]} |
| Service account keys not older than 90 days | CC6.2 | GCP | high | Fail | Oct 11, 2026 | {"message":"Service account keys not older than 90 days: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Storage accounts require HTTPS | CC6.1 | AZURE | high | Fail | Oct 11, 2026 | {"message":"Storage accounts require HTTPS: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| Strong password policy configured | CC6.1 | AWS | high | Pass | Oct 11, 2026 | {"message":"Strong password policy configured: all observed resources comply.","affectedResources":[]} |
| The default VPC network has been removed | CC6.6 | GCP | medium | Pass | Oct 11, 2026 | {"message":"The default VPC network has been removed: all observed resources comply.","affectedResources":[]} |
| Uniform bucket-level access enabled on GCS buckets | CC6.1 | GCP | high | Pass | Oct 11, 2026 | {"message":"Uniform bucket-level access enabled on GCS buckets: all observed resources comply.","affectedResources":[]} |
| VPC Flow Logs enabled | CC7.2 | AWS | high | Fail | Oct 11, 2026 | {"message":"VPC Flow Logs enabled: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |
| VPC Flow Logs enabled on all subnets | CC7.2 | GCP | high | Fail | Oct 11, 2026 | {"message":"VPC Flow Logs enabled on all subnets: 2 resource(s) do not comply.","affectedResources":["demo-resource-a","demo-resource-b"],"remediation":"Open the check detail for full remediation guidance."} |