Assessment Categories & Checkpoints

Evaluates disaster recovery readiness based on plan compliance, testing frequency, and recovery objectives.

{
  "dr_plan_compliance_status": "In Compliance",
  "dr_testing_frequency": "Annual or better (3-12 Months)",
  "hosting_vendor_score": 3.8,
  "last_dr_review_date": "03/17/2025",
  "overall_dr_rpo": "12h:00m",
  "overall_dr_rto": "1h:11m",
  "overall_dr_score": 3.68,
  "site_dr_score": 3.2,
  "system_availability_score": 3.5
}

Evaluates the effectiveness of automated monitoring systems based on coverage, alert quality, and response times.

{
  "alert_noise_ratio": 0.25,
  "mean_time_to_detect": 8,
  "mean_time_to_respond": 35,
  "monitoring_alerting_configured": true,
  "monitoring_coverage_percent": 92,
  "monitoring_documentation": true,
  "monitoring_tools_redundancy": 2
}

Checks the operational health of EC2 instances and their monitoring configuration.

{
  "required_tags": "Name,Environment,Application"
}

Evaluates the completeness and quality of architecture documentation.

{}

Verifies that system architecture is properly documented.

{
  "required_sections": [
    "overview",
    "components",
    "data_flow",
    "security"
  ]
}

Verifies that SSL certificates are properly registered and maintained.

{}

Verifies enrollment in the Operational Risk Compliance Assessment program.

{}

Evaluates results from Infrastructure as Code security scans.

{}

Assesses the results of network perimeter security testing.

{}

Evaluates AWS IAM user and role security configuration, including password policies, MFA, and access key rotation.

{
  "max_access_key_age_days": 90,
  "require_mfa": true,
  "require_strong_password_policy": true
}

Verifies S3 buckets are configured securely with encryption, logging, and proper access controls.

{
  "prohibit_public_access": true,
  "require_encryption": true,
  "require_logging": true
}

Checks if regular security vulnerability scans are conducted.

{
  "scan_frequency_days": 30
}

Checks compliance with relevant regulations like GDPR, HIPAA, etc.

{
  "frameworks": [
    "GDPR",
    "HIPAA",
    "PCI-DSS"
  ]
}

Verifies that local load balancers conform to standards.

{}

Verifies that automated monitoring and alerts are configured for critical services.

{
  "critical_services": [
    "web",
    "database",
    "api"
  ]
}

Checks if application performance monitoring tools are properly configured.

{
  "required_metrics": [
    "response_time",
    "error_rate",
    "throughput"
  ]
}

Verifies that load testing has been performed and meets requirements.

{
  "max_response_time_ms": 500,
  "min_concurrent_users": 1000
}

Checks if all environments (dev, test, prod) are properly configured and consistent.

{
  "environments": [
    "development",
    "testing",
    "production"
  ]
}

Verifies that backups are tested and can be successfully restored.

{
  "test_frequency_days": 90
}

Verifies that DR tests are scheduled and performed regularly.

{
  "test_frequency_months": 6
}

Evaluates Azure Virtual Machines for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure Blob Storage for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure Role-Based Access Control for compliance with security best practices.

{
  "resource_group": ""
}

Evaluates Azure Disaster Recovery for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure Virtual Machines for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure Blob Storage for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure Role-Based Access Control for compliance with security best practices.

{
  "resource_group": ""
}

Evaluates Azure Disaster Recovery for operational health and configuration compliance.

{
  "resource_group": ""
}

Evaluates Azure role-based access control

{}

Checks Azure Monitor and logging configuration

{}

Analyzes Azure resource utilization for cost efficiency

{}

Evaluates Azure Storage account configuration and security

{}

Checks if AWS root account has active access keys, which is a security risk

{
  "severity": "high"
}

Checks for IAM users with administrator privileges

{
  "severity": "medium"
}

Checks for IAM users that don't have Multi-Factor Authentication enabled

{
  "severity": "high"
}

Checks for IAM policies that use wildcard actions, which can create security risks

{
  "severity": "medium"
}

Checks if more than three owners are assigned to an Azure subscription

{
  "severity": "medium"
}

Checks if users can register applications without restriction in Azure AD

{
  "severity": "medium"
}

Checks if users can add gallery apps to their Access Panel without approval

{
  "severity": "low"
}

Checks for custom subscription administrator roles in Azure

{
  "severity": "medium"
}

Checks for non-privileged users executing privileged functions without audit logs

{
  "severity": "high"
}

Checks for S3 buckets with public read access, which is a security risk

{
  "severity": "high"
}

Checks for storage accounts that are not configured to use secure transfer

{
  "severity": "high"
}

Checks for security groups that allow unrestricted SSH access

{
  "severity": "high"
}

Checks for RDS instances that are not using encryption at rest

{
  "severity": "medium"
}

Checks if CloudTrail is not enabled in all AWS regions

{
  "severity": "medium"
}

Checks for EBS volumes that are not encrypted

{
  "severity": "medium"
}

Checks for SQL servers that do not have auditing enabled

{
  "severity": "medium"
}

Checks for Key Vaults that do not have purge protection enabled

{
  "severity": "medium"
}

Checks for NSGs that allow inbound RDP from any source

{
  "severity": "high"
}

Checks for VMs that do not have endpoint protection installed

{
  "severity": "medium"
}

Checks if CloudTrail logs are not integrated with CloudWatch Logs

{
  "severity": "medium"
}

Checks for App Service apps that do not have diagnostic logs enabled

{
  "severity": "medium"
}

Checks if VPC flow logs are not enabled

{
  "severity": "medium"
}

Checks if ELB access logs are not enabled

{
  "severity": "medium"
}

Checks if resource logs are not enabled for Key Vault

{
  "severity": "medium"
}

Checks if activity log alerts are not configured for administrative operations

{
  "severity": "medium"
}

Checks if diagnostic settings are not configured for selected resource types

{
  "severity": "medium"
}

Checks if Log Analytics workspace is not configured for retention policies

{
  "severity": "medium"
}

Checks for missing alerts for policy changes

{
  "severity": "medium"
}

Checks for missing alerts for security operations

{
  "severity": "medium"
}

Checks for EC2 instances that do not have termination protection enabled

{
  "severity": "low"
}

Checks for VMs that do not have backup configured

{
  "severity": "high"
}

Checks for unused Elastic IP addresses that may incur charges

{
  "severity": "low"
}

Checks for RDS instances that do not have backups enabled

{
  "severity": "high"
}

Checks for unassociated public IP addresses that may incur charges

{
  "severity": "low"
}

Checks for virtual networks that do not have Network Watcher enabled

{
  "severity": "medium"
}

Checks for load balancers that do not have diagnostic logs enabled

{
  "severity": "medium"
}

Checks for SQL databases that do not have geo-redundant backups configured

{
  "severity": "medium"
}

Checks for App Service plans that do not have scaling configured

{
  "severity": "low"
}

Checks for storage accounts that do not have soft delete enabled

{
  "severity": "medium"
}

Checks for underutilized EC2 instances that may be wasting resources

{
  "severity": "low",
  "thresholds": {
    "cpu": 10,
    "memory": 20
  }
}

Checks for unused virtual machines that may be wasting resources

{
  "severity": "low",
  "thresholds": {
    "cpu": 10,
    "memory": 20
  }
}

Checks for idle RDS instances that may be wasting resources

{
  "severity": "low",
  "thresholds": {
    "connections": 5,
    "iops": 10
  }
}

Checks for unattached EBS volumes that may incur unnecessary charges

{
  "severity": "low"
}

Checks for orphaned disks that are not attached to any VM

{
  "severity": "low"
}

Checks for unused public IP addresses that may incur charges

{
  "severity": "low"
}

Checks for unused network interfaces that may incur charges

{
  "severity": "low"
}

Checks for unused load balancers that may incur charges

{
  "severity": "low"
}

Checks for unused application gateways that may incur charges

{
  "severity": "low"
}

Checks for unused ExpressRoute circuits that may incur charges

{
  "severity": "low"
}

Checks AWS security settings compliance

{}

Evaluates AWS CloudTrail and CloudWatch setup

{}

Analyzes AWS resource utilization and cost efficiency

{}