Вашите 85 несъответствия не са 85 проблема: те се свеждат до четири основна(-и) причина(-и). Разгледайте ги в ред и ще неутрализирате основната част от риска с концентрирано усилие, без да преправяте всичко.
Едно доказателство, три читателя. Това досие е замислено да бъде представено на кибер застраховател (формат за подписване на полица), на възложител, който изисква от вас доказателство за вашата позиция (каскаден ефект във веригата на доставчиците, NIS2 чл. 21 - споделяема версия), и на одитор или външен ревизор. Всяка констатация по-долу е проверима във вашите собствени журнали на Microsoft: доказуема, не декларативна.
195 съответстващ(и) контрол(и) от общо 280 решени контрола - проверимата база, която вече може да бъде представена на застраховател, точка по точка, с доказателства. Позиция, оценена като C, без ласкателство, само на базата на решените контроли.
85 установено(и) несъответствие(я) и 63 неизмерен(и) контрол(и) остават изложение, непокрито от доказуемо доказателство: докато основните причини по-долу не бъдат отстранени, това изложение не може да бъде удостоверено.
| Референтна точка | Контролна точка | Тежест |
|---|---|---|
| M365SEC:2.4.2M365SAT, Monkey365 | MEx 2.4.2 - Priority accounts do not have 'Strict protection' presets applied | Висока |
| M365SEC:7.3.2M365SAT, Monkey365 | MSp 7.3.2 - OneDrive for Business sync from unmanaged devices is not blocked | Висока |
| MT.1037Maester | Only users with Presenter role are allowed to present in Teams meetings | Висока |
| MT.1034Maester | MT.1034.$($EmergencyAccessUsers.IndexOf($_)): Emergency access users should not be blocked ($($_.userPrincipalName)) | За саниране |
| M365SEC:5.2.2.2M365SAT, Monkey365 | MAz 5.2.2.2 - MultiFactor Authentication (MFA) is not enabled for all users non-administrative roles | Критична |
| CISA:MS.AAD.3.2Maester, ScubaGear | If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | Критична |
| M365SEC:5.1.5.2M365SAT, Maester, Monkey365 | CISMAz 5.1.5.2 - User consent to apps accessing company data on their behalf is allowed! | Висока |
| M365SEC:5.2.3.4M365SAT, Monkey365 | MAz 5.2.3.4 - Not all member users are 'MFA capable' | Висока |
| ORCA.140Maester | High Confidence Spam action set to Quarantine message. | Висока |
| ORCA.189.2Maester | Safe Links is not bypassed. | Висока |
| Референтна точка | Контролна точка | Статус |
|---|---|---|
| M365SEC:1.3.5M365SAT, Maester, Monkey365 | MOff 1.3.5 - Internal phishing protection for Forms is disabled | Неизмерено |
| M365SEC:2.4.1M365SAT, Monkey365 | MEx 2.4.1 - Priority account protection is not enabled and configured! | Неизмерено |
| M365SEC:3.2.1M365SAT, Monkey365 | MEx 3.2.1 - DLP Policy is not enabled! | Неизмерено |
| M365SEC:7.2.7M365SAT, Maester, Monkey365 | MSp 7.2.7 - Ensure link sharing is not restricted in SharePoint and OneDrive! | Неизмерено |
| CISA:MS.AAD.4.1Maester, ScubaGear | Security logs SHALL be sent to the agency's security operations center for monitoring. | Неизмерено |
| M365SEC:6.2.1M365SAT, Monkey365 | MEx 6.2.1 - Forms of mail forwarding are not blocked and/or not disabled | Неизмерено |
| CISA:MS.EXO.13.1Maester, ScubaGear | Mailbox auditing SHALL be enabled. | Неизмерено |
| M365SEC:4.2Monkey365 | Devices enrollment personal devices not blocked | Неизмерено |
| M365SEC:7.2.11Maester, Monkey365 | Ensure the SharePoint default sharing link permission is set | Неизмерено |
| MT.1027Maester | No Service Principal with Client Secret and permanent role assignment on Control Plane. | Неизмерено |
| Референтна точка | Контролна точка | Тежест |
|---|---|---|
| ANSSI R13ANSSI/NIS2 ANSSI R13 | ANSSI R13 | Съответства |
| ANSSI R14ANSSI/NIS2 ANSSI R14 | ANSSI R14 | Съответства |
| ANSSI R16ANSSI/NIS2 ANSSI R16 | ANSSI R16 | Съответства |
| ANSSI R24ANSSI/NIS2 ANSSI R24 | ANSSI R24 | Съответства |
| ANSSI R29ANSSI/NIS2 ANSSI R29 | ANSSI R29 | Съответства |
| ANSSI R36ANSSI/NIS2 ANSSI R36 | ANSSI R36 | Съответства |
| ANSSI R5ANSSI/NIS2 ANSSI R5 | ANSSI R5 | Съответства |
| ANSSI R8ANSSI/NIS2 ANSSI R8 | ANSSI R8 | Съответства |
| M365SEC:5.1.1.1M365SAT CISMAz5111 | CISMAz 5.1.1.1 - The Security Defaults are enabled on Azure Active Directory Tenant | Съответства |
| M365SEC:6.1.4M365SAT CISMEx614 | MEx 6.1.4 - Des boîtes aux lettres portent-elles 'AuditBypassEnabled', qui les exclut du journal d'audit ? | Съответства |
| CISA:MS.EXO.10.1Maester CISA.MS.EXO.10.1 | Emails SHALL be scanned for malware. | Съответства |
| CISA:MS.EXO.10.2Maester CISA.MS.EXO.10.2 | Emails identified as containing malware SHALL be quarantined or dropped. | Съответства |
| CISA:MS.EXO.10.3Maester CISA.MS.EXO.10.3 | Email scanning SHALL be capable of reviewing emails after delivery. | Съответства |
| CISA:MS.EXO.11.1Maester CISA.MS.EXO.11.1 | Impersonation protection checks SHOULD be used. | Съответства |
| CISA:MS.EXO.11.2Maester CISA.MS.EXO.11.2 | User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. | Съответства |
| CISA:MS.EXO.11.3Maester CISA.MS.EXO.11.3 | The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. | Съответства |
| CISA:MS.EXO.12.1Maester CISA.MS.EXO.12.1 | IP allow lists SHOULD NOT be created. | Съответства |
| CISA:MS.EXO.14.1Maester CISA.MS.EXO.14.1 | A spam filter SHALL be enabled. | Съответства |
| CISA:MS.EXO.14.2Maester CISA.MS.EXO.14.2 | Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. | Съответства |
| CISA:MS.EXO.14.3Maester CISA.MS.EXO.14.3 | Allowed domains SHALL NOT be added to inbound anti-spam protection policies. | Съответства |
| CISA:MS.EXO.15.1Maester CISA.MS.EXO.15.1 | URL comparison with a block-list SHOULD be enabled. | Съответства |
| CISA:MS.EXO.15.2Maester CISA.MS.EXO.15.2 | Direct download links SHOULD be scanned for malware. | Съответства |
| CISA:MS.EXO.15.3Maester CISA.MS.EXO.15.3 | User click tracking SHOULD be enabled. | Съответства |
| CISA:MS.EXO.16.1Maester CISA.MS.EXO.16.1 | Alerts SHALL be enabled. | Съответства |
| CISA:MS.EXO.16.2Maester CISA.MS.EXO.16.2 | Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. | Съответства |
| CISA:MS.EXO.17.1Maester CISA.MS.EXO.17.1 | Microsoft Purview Audit (Standard) logging SHALL be enabled. | Съответства |
| CISA:MS.EXO.2.1Maester CISA.MS.EXO.2.1 | A list of approved IP addresses for sending mail SHALL be maintained. | Съответства |
| EIDSCA.AF01Maester EIDSCA.AF01 | Authentication method - FIDO2 security key - State. | Съответства |
| EIDSCA.AF02Maester EIDSCA.AF02 | Authentication Method - FIDO2 security key - Allow self-service set up. | Съответства |
| EIDSCA.AF03Maester EIDSCA.AF03 | Authentication method - FIDO2 security key - Enforce attestation. | Съответства |
| EIDSCA.AF04Maester EIDSCA.AF04 | Authentication method - FIDO2 security key - Enforce key restrictions. | Съответства |
| EIDSCA.AF05Maester EIDSCA.AF05 | Authentication method - FIDO2 security key - Restricted. | Съответства |
| EIDSCA.AF06Maester EIDSCA.AF06 | Authentication Method - FIDO2 security key - Restrict specific keys. | Съответства |
| EIDSCA.AG01Maester EIDSCA.AG01 | Authentication method - General settings - Manage migration. | Съответства |
| EIDSCA.AG02Maester EIDSCA.AG02 | Authentication method - General settings - Report suspicious activity - State. | Съответства |
| EIDSCA.AM01Maester EIDSCA.AM01 | Authentication method - Microsoft Authenticator - State. | Съответства |
| EIDSCA.AM02Maester EIDSCA.AM02 | Authentication method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP. | Съответства |
| EIDSCA.AM03Maester EIDSCA.AM03 | Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | Съответства |
| EIDSCA.AM04Maester EIDSCA.AM04 | Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | Съответства |
| EIDSCA.AM06Maester EIDSCA.AM06 | Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Съответства |
| EIDSCA.AM07Maester EIDSCA.AM07 | Authentication method - Microsoft Authenticator - Users and groups included for showing the application name in push and passwordless notifications. | Съответства |
| EIDSCA.AM09Maester EIDSCA.AM09 | Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Съответства |
| EIDSCA.AM10Maester EIDSCA.AM10 | Authentication method - Microsoft Authenticator - Users and groups included for showing the geographic location in push and passwordless notifications. | Съответства |
| EIDSCA.AP01Maester EIDSCA.AP01 | Default authorization settings - Self-service password reset enabled for administrators. | Съответства |
| EIDSCA.AP04Maester EIDSCA.AP04 | Default Authorization Settings - Guest invite restrictions. | Съответства |
| EIDSCA.AP06Maester EIDSCA.AP06 | Default Authorization Settings - User can join the tenant by email validation. | Съответства |
| EIDSCA.AP08Maester EIDSCA.AP08 | Default authorization settings - User consent policy assigned for applications. | Съответства |
| EIDSCA.AP10Maester EIDSCA.AP10 | Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | Съответства |
| EIDSCA.AS04Maester EIDSCA.AS04 | Authentication Method - SMS - Use for sign-in. | Съответства |
| EIDSCA.AT01Maester EIDSCA.AT01 | Authentication method - Temporary Access Pass - State. | Съответства |
| EIDSCA.AT02Maester EIDSCA.AT02 | Authentication method - Temporary Access Pass - One-time use. | Съответства |
| EIDSCA.AV01Maester EIDSCA.AV01 | Authentication method - Voice call - State. | Съответства |
| EIDSCA.CP01Maester EIDSCA.CP01 | Default settings - Consent policy settings - Group owner consent for apps accessing data. | Съответства |
| EIDSCA.CP03Maester EIDSCA.CP03 | Default Settings - Consent Policy Settings - Block user consent for risky apps. | Съответства |
| EIDSCA.PR02Maester EIDSCA.PR02 | Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | Съответства |
| EIDSCA.PR03Maester EIDSCA.PR03 | Default settings - Password rule settings - Enforce custom list. | Съответства |
| EIDSCA.PR05Maester EIDSCA.PR05 | Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. | Съответства |
| EIDSCA.PR06Maester EIDSCA.PR06 | Default settings - Password rule settings - Smart Lockout - Lockout threshold. | Съответства |
| EIDSCA.ST08Maester EIDSCA.ST08 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Съответства |
| EIDSCA.ST09Maester EIDSCA.ST09 | Default settings - Classification and M365 groups - M365 groups - Allow guests to access group content. | Съответства |
| M365SEC:1.1.1Maester M365.1.1.1 | MOff 1.1.1 - Ensure Administrative accounts are separate and cloud-only | Съответства |
| M365SEC:1.1.3Maester M365.1.1.3 | Ensure that between two and four global admins are designated | Съответства |
| M365SEC:1.3.1Maester M365.1.3.1 | Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' | Съответства |
| M365SEC:1.3.3Maester M365.1.3.3 | Ensure 'External sharing' of calendars is not available | Съответства |
| M365SEC:1.3.4Maester M365.1.3.4 | MOff 1.3.4 - User owned apps and services are not restricted | Съответства |
| M365SEC:2.1.1Maester M365.2.1.1 | Ensure Safe Links for Office Applications is Enabled (Only Checks Default Policy) | Съответства |
| M365SEC:2.1.11Maester M365.2.1.11 | Ensure comprehensive attachment filtering is applied | Съответства |
| M365SEC:2.1.2Maester M365.2.1.2 | Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Съответства |
| M365SEC:2.1.3Maester M365.2.1.3 | Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Съответства |
| M365SEC:2.1.4Maester M365.2.1.4 | Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | Съответства |
| M365SEC:2.1.5Maester M365.2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Съответства |
| M365SEC:2.1.6Maester M365.2.1.6 | Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Съответства |
| M365SEC:2.1.7Maester M365.2.1.7 | Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Съответства |
| M365SEC:3.1.1Maester M365.3.1.1 | MEx 3.1.1 - Microsoft 365 audit log search is Disabled! | Съответства |
| M365SEC:4.1Maester M365.4.1 | Ensure devices without a compliance policy are marked | Съответства |
| M365SEC:5.1.2.2Maester M365.5.1.2.2 | MAz 5.1.2.2 - Third party integrated applications are allowed! | Съответства |
| M365SEC:5.1.5.1Maester M365.5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowed | Съответства |
| M365SEC:5.1.6.2Maester M365.5.1.6.2 | Ensure that guest user access is restricted | Съответства |
| M365SEC:5.2.3.5Maester M365.5.2.3.5 | Ensure weak authentication methods are disabled | Съответства |
| M365SEC:7.2.2Maester M365.7.2.2 | MSp 7.2.2 - SharePoint and OneDrive integration with Azure AD B2B is not enabled! | Съответства |
| M365SEC:7.2.5Maester M365.7.2.5 | Ensure that SharePoint guest users cannot share items they don | Съответства |
| M365SEC:7.2.9Maester M365.7.2.9 | MSp 7.2.9 - Guest access to a site or OneDrive does not expire automatically | Съответства |
| M365SEC:7.3.1Maester M365.7.3.1 | MSp 7.3.1 - Office 365 SharePoint infected files are NOT disallowed for download | Съответства |
| M365SEC:8.4.1Maester M365.8.4.1 | Ensure all or a majority of third-party and custom apps are blocked | Съответства |
| M365SEC:8.6.1Maester M365.8.6.1 | Ensure users can report security concerns in Teams to internal destination | Съответства |
| MT.1003Maester MT.1003 | At least one Conditional Access policy is configured with All Apps. | Съответства |
| MT.1004Maester MT.1004 | At least one Conditional Access policy is configured with All Apps and All Users. | Съответства |
| MT.1006Maester MT.1006 | At least one Conditional Access policy is configured to require MFA for administrators. | Съответства |
| MT.1007Maester MT.1007 | At least one Conditional Access policy is configured to require MFA for all users. | Съответства |
| MT.1008Maester MT.1008 | At least one Conditional Access policy is configured to require MFA for Azure management. | Съответства |
| MT.1009Maester MT.1009 | At least one Conditional Access policy is configured to block other legacy authentication. | Съответства |
| MT.1010Maester MT.1010 | At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. | Съответства |
| MT.1011Maester MT.1011 | At least one Conditional Access policy is configured to secure security info registration only from a trusted location. | Съответства |
| MT.1014Maester MT.1014 | At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for administrators. | Съответства |
| MT.1015Maester MT.1015 | At least one Conditional Access policy is configured to block access from unknown or unsupported device platforms. | Съответства |
| MT.1016Maester MT.1016 | At least one Conditional Access policy is configured to require MFA for guest access. | Съответства |
| MT.1020Maester MT.1020 | All Conditional Access policies are configured to exclude directory synchronisation accounts, or do not target them. | Съответства |
| MT.1022Maester MT.1022 | MT.1022 | Съответства |
| MT.1025Maester MT.1025 | No external user with permanent role assignment on Control Plane. | Съответства |
| MT.1026Maester MT.1026 | No hybrid user with permanent role assignment on Control Plane. | Съответства |
| MT.1031Maester MT.1031 | Control Plane privileged roles are managed by PIM only. | Съответства |
| MT.1032Maester MT.1032 | A limited number of Global Administrators is assigned. | Съответства |
| MT.1044Maester MT.1044 | Ensure modern authentication for Exchange Online is enabled | Съответства |
| MT.1045Maester MT.1045 | Only guest users should be admitted automatically to Teams meetings | Съответства |
| MT.1050Maester MT.1050 | Applications with high-risk permissions having a direct path to Global Administrator. | Съответства |
| MT.1051Maester MT.1051 | Applications with high-risk permissions having an indirect path to Global Administrator. | Съответства |
| MT.1052Maester MT.1052 | At least one Conditional Access policy targets the Device Code authentication flow. | Съответства |
| MT.1061Maester MT.1061 | The device registration MFA control conflicts with Conditional Access policies. | Съответства |
| MT.1066Maester MT.1066 | Conditional Access policies should not include or exclude deleted users, groups or roles. | Съответства |
| MT.1071Maester MT.1071 | At least one Conditional Access policy explicitly includes Azure DevOps. | Съответства |
| MT.1072Maester MT.1072 | Conditional Access policies should not use the deprecated Approved Client App grant. | Съответства |
| MT.1075Maester MT.1075 | Third-party Entra applications should have explicitly assigned users rather than All Users. | Съответства |
| MT.1105Maester MT.1105 | The MDM authority should be set to Microsoft Intune | Съответства |
| ORCA.101Maester ORCA.101 | Bulk is marked as spam. | Съответства |
| ORCA.102Maester ORCA.102 | Advanced Spam filter options are turned off. | Съответства |
| ORCA.104Maester ORCA.104 | High Confidence Phish action set to Quarantine message. | Съответства |
| ORCA.108.1Maester ORCA.108.1 | DNS Records have been set up to support DKIM. | Съответства |
| ORCA.109Maester ORCA.109 | Senders are not unsafely allow listed. | Съответства |
| ORCA.111Maester ORCA.111 | Anti-phishing policy exists and EnableUnauthenticatedSender is true. | Съответства |
| ORCA.112Maester ORCA.112 | Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy. | Съответства |
| ORCA.118.1Maester ORCA.118.1 | Domains are not unsafely allow listed in anti-spam policies. | Съответства |
| ORCA.118.3Maester ORCA.118.3 | Your own domains are not unsafely allow listed in anti-spam policies. | Съответства |
| ORCA.121Maester ORCA.121 | A supported filter policy action is in use. | Съответства |
| ORCA.124Maester ORCA.124 | Safe Attachments unknown malware response is set to block messages. | Съответства |
| ORCA.139Maester ORCA.139 | The spam action is set to move the message to the Junk Email folder or to quarantine. | Съответства |
| ORCA.141Maester ORCA.141 | Bulk action set to Move message to Junk Email Folder. | Съответства |
| ORCA.143Maester ORCA.143 | Safety Tips are enabled. | Съответства |
| ORCA.158Maester ORCA.158 | Safe Attachments is enabled for SharePoint and Teams. | Съответства |
| ORCA.180Maester ORCA.180 | Anti-phishing policy exists and EnableSpoofIntelligence is true. | Съответства |
| ORCA.221Maester ORCA.221 | Mailbox Intelligence is enabled in anti-phishing policies. | Съответства |
| ORCA.225Maester ORCA.225 | Safe Documents is enabled for Office clients. | Съответства |
| ORCA.226Maester ORCA.226 | Every domain has a Safe Links policy applied to it. | Съответства |
| ORCA.227Maester ORCA.227 | Every domain has a Safe Attachments policy applied to it. | Съответства |
| ORCA.228Maester ORCA.228 | No trusted senders in Anti-phishing policy. | Съответства |
| ORCA.229Maester ORCA.229 | No trusted domains in Anti-phishing policy. | Съответства |
| ORCA.230Maester ORCA.230 | Each domain has a Anti-phishing policy applied to it, or the default policy is being used. | Съответства |
| ORCA.231Maester ORCA.231 | Each domain has a anti-spam policy applied to it, or the default policy is being used. | Съответства |
| ORCA.232Maester ORCA.232 | Each domain has a malware filter policy applied to it, or the default policy is being used. | Съответства |
| ORCA.234Maester ORCA.234 | Click through is disabled for Safe Documents. | Съответства |
| ORCA.236Maester ORCA.236 | Safe Links is enabled for emails. | Съответства |
| ORCA.237Maester ORCA.237 | Safe Links is enabled for teams messages. | Съответства |
| ORCA.238Maester ORCA.238 | Safe Links is enabled for office documents. | Съответства |
| ORCA.240Maester ORCA.240 | Outlook is configured to display external tags for external emails. | Съответства |
| ORCA.242Maester ORCA.242 | The significant protection alerts responsible for AIR activity are enabled. | Съответства |
| ORCA.244Maester ORCA.244 | Policies are configured to honour the DMARC policy of sending domains. | Съответства |
| M365SEC:5.2.2.3Monkey365 eid-cap-block-legacy-authentication-not-enabled | MAz 5.2.2.3 - No Conditional Access policies to block legacy authentication | Съответства |
| M365SEC:5.2.2.4Monkey365 eid-cap-lack-sign-in-frequency-browser-persistent-session | MAz 5.2.2.4 - Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users | Съответства |
| M365SEC:5.2.2.12Monkey365 eid-device-code-sign-in-flow-not-enabled | Eid device code sign in flow not enabled | Съответства |
| M365SEC:5.2.2.1Monkey365 eid-ensure-mfa-for-high-privileged-users-missing-cap | MAz 5.2.2.1 - MultiFactor Authentication (MFA) is not enabled for all users in administrative roles | Съответства |
| M365SEC:5.2.2.5Monkey365 eid-ensure-phishing-resistant-mfa-for-high-privileged-users-missing-cap | MAz 5.2.2.5 - Phishing-resistant MFA strength must be required for Administrators | Съответства |
| M365SEC:5.1.6.3Monkey365 eid-guest-invite-restriction-disabled | Eid guest invite restriction disabled | Съответства |
| M365SEC:5.2.3.1Monkey365 eid-microsoft-authenticator-lack-mfa-fatigue-protection | MAz 5.2.3.1 - Microsoft Authenticator is not configured to protect against MFA fatigue | Съответства |
| M365SEC:5.1.8.1Monkey365 eid-password-hash-sync-disabled | MAz 5.1.8.1 - Password Synchronization Disabled | Съответства |
| M365SEC:5.2.2.9Monkey365 eid-require-device-compliant-all-apps-missing-cap | Eid require device compliant all apps missing cap | Съответства |
| M365SEC:5.2.2.10Monkey365 eid-require-device-compliant-to-register-security-info-missing-cap | Eid require device compliant to register security info missing cap | Съответства |
| M365SEC:5.1.6.1Monkey365 eid-restrict-collaboration-specific-domains-disabled | MAz 5.1.6.1 - Collaboration invitations are not sent to allowed domains only | Съответства |
| M365SEC:5.2.2.11Monkey365 eid-sign-in-frequency-intune-enrollment-missing-cap | Eid sign in frequency intune enrollment missing cap | Съответства |
| M365SEC:5.2.4.1Monkey365 eid-sspr-enabled-set-to-all | MAz 5.2.4.1 - Self Service Password Reset is not set to be enabled for all users | Съответства |
| M365SEC:6.1.3Monkey365 exchange-audit-bypass-enabled | Exchange audit bypass enabled | Съответства |
| M365SEC:6.1.1Monkey365 exchange-audit-enabled-globally | MEx 6.1.1 - Mailbox auditing is not Enabled for all users | Съответства |
| M365SEC:6.2.3Monkey365 exchange-external-email-sender-configured | MEx 6.2.3 - Email from external senders cannot be identified | Съответства |
| M365SEC:6.5.1Monkey365 exchange-modern-authentication-disabled | Exchange modern authentication disabled | Съответства |
| M365SEC:2.1.14Monkey365 exhange-inbound-anti-spam-policies-allowed-domains | MEx 2.1.14 - No comprehensive attachment filtering is applied! | Съответства |
| M365SEC:7.2.8Monkey365 sharepoint-external-sharing-not-restricted-by-security-group | MSp 7.2.8 - Ensure external sharing is restricted by security group! | Съответства |
| M365SEC:7.2.1Monkey365 sharepoint-modern-authentication-required | SharePoint modern authentication required | Съответства |
| M365SEC:8.5.1Monkey365 teams-anonymous-users-cant-join-meeting | CISM Tm 8.5.1 - Anonymous users can join a meeting | Съответства |
| CISA:MS.AAD.1.1ScubaGear MS.AAD.1.1v1 | Legacy authentication SHALL be blocked. | Съответства |
| CISA:MS.AAD.3.1ScubaGear MS.AAD.3.1v1 | Phishing-resistant MFA SHALL be enforced for all users. | Съответства |
| CISA:MS.AAD.3.3ScubaGear MS.AAD.3.3v2 | If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. | Съответства |
| CISA:MS.AAD.3.4ScubaGear MS.AAD.3.4v1 | The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | Съответства |
| CISA:MS.AAD.3.6ScubaGear MS.AAD.3.6v1 | Phishing-resistant MFA SHALL be required for highly privileged roles. | Съответства |
| CISA:MS.AAD.3.7ScubaGear MS.AAD.3.7v1 | Managed devices SHOULD be required for authentication. | Съответства |
| CISA:MS.AAD.3.8ScubaGear MS.AAD.3.8v1 | Managed Devices SHOULD be required to register MFA. | Съответства |
| CISA:MS.AAD.3.9ScubaGear MS.AAD.3.9v1 | Device code authentication SHOULD be blocked. | Съответства |
| CISA:MS.AAD.5.1ScubaGear MS.AAD.5.1v1 | Only administrators SHALL be allowed to register applications. | Съответства |
| CISA:MS.AAD.5.2ScubaGear MS.AAD.5.2v1 | Only administrators SHALL be allowed to consent to applications. | Съответства |
| CISA:MS.AAD.6.1ScubaGear MS.AAD.6.1v1 | User passwords SHALL NOT expire. | Съответства |
| CISA:MS.AAD.7.1ScubaGear MS.AAD.7.1v1 | A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. | Съответства |
| CISA:MS.AAD.7.2ScubaGear MS.AAD.7.2v1 | Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. | Съответства |
| CISA:MS.AAD.7.4ScubaGear MS.AAD.7.4v1 | Permanent active role assignments SHALL NOT be allowed for highly privileged roles. | Съответства |
| CISA:MS.AAD.8.1ScubaGear MS.AAD.8.1v1 | Guest users SHOULD have limited or restricted access to Microsoft Entra ID directory objects. | Съответства |
| CISA:MS.AAD.8.2ScubaGear MS.AAD.8.2v1 | Only users with the Guest Inviter role SHOULD be able to invite guest users. | Съответства |
| CISA:MS.AAD.8.3ScubaGear MS.AAD.8.3v1 | Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. | Съответства |
| CISA:MS.DEFENDER.2.2ScubaGear MS.DEFENDER.2.2v1 | Domain impersonation protection SHOULD be enabled for agency-owned domains in standard and strict policies. | Съответства |
| CISA:MS.DEFENDER.2.3ScubaGear MS.DEFENDER.2.3v1 | Domain impersonation protection SHOULD be added for key suppliers and partners in standard and strict policies. | Съответства |
| CISA:MS.DEFENDER.3.1ScubaGear MS.DEFENDER.3.1v1 | Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams. | Съответства |
| CISA:MS.DEFENDER.5.1ScubaGear MS.DEFENDER.5.1v1 | Alerts required by Exchange Online baseline SHALL be enabled at minimum. | Съответства |
| CISA:MS.DEFENDER.5.2ScubaGear MS.DEFENDER.5.2v1 | Alerts SHOULD be sent to a monitored address or incorporated into SIEM. | Съответства |
| CISA:MS.DEFENDER.6.1ScubaGear MS.DEFENDER.6.1v1 | Unified Audit logging SHALL be enabled. | Съответства |
| CISA:MS.EXO.1.1ScubaGear MS.EXO.1.1v2 | Automatic forwarding to external domains SHALL be disabled. | Съответства |
| CISA:MS.EXO.6.1ScubaGear MS.EXO.6.1v1 | Contact folders SHALL NOT be shared with all domains. | Съответства |
| CISA:MS.EXO.6.2ScubaGear MS.EXO.6.2v1 | Calendar details SHALL NOT be shared with all domains. | Съответства |
| CISA:MS.EXO.7.1ScubaGear MS.EXO.7.1v1 | External sender warnings SHALL be implemented. | Съответства |
| CISA:MS.SHAREPOINT.1.3ScubaGear MS.SHAREPOINT.1.3v1 | External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. | Съответства |
| CISA:MS.TEAMS.1.3ScubaGear MS.TEAMS.1.3v1 | Anonymous users and dial-in callers SHOULD NOT be admitted automatically. | Съответства |
Проверимото доказателство е аргументът. Тази диагностика никога не е виждала вашите данни: прочетени са само конфигурационни параметри, никога лично съдържание. Всяка констатация по-горе е проверима във вашите собствени журнали на Microsoft, следователно доказуема - независимо дали читателят е застраховател, възложител, който ви одитира, или одитор.