Baseline crosswalk
Every table below is generated from the module's check definitions and the published baseline catalogs. Uncovered controls are shown with the reason they are uncovered, never hidden.
CISA SCuBA (Google Workspace)
95 of 137 controls assessed by 73 checks. Configuration-assessable ceiling: 111 of 137. The remainder is manual, DNS-based, or has no configuration API.
| Control | Title | Status | Guerrilla checks |
|---|---|---|---|
| GWS.ASSUREDCONTROLS.1.1v1 | Access Approvals SHOULD be enabled. | Assessed by Guerrilla | ADMIN-014 (Not Assessed in live runs) |
| GWS.ASSUREDCONTROLS.1.2v1 | Agencies SHOULD restrict support access to U.S. Google staff only. | Assessed by Guerrilla | ADMIN-015 (Not Assessed in live runs) |
| GWS.ASSUREDCONTROLS.2.1v1 | Data processing across multiple regions SHOULD be disabled for all Google Workspace products. | Assessed by Guerrilla | ADMIN-016 |
| GWS.CALENDAR.1.1v1 | External Sharing Options for Primary Calendars SHALL be configured to "Only free/busy information (hide event details)." | Assessed by Guerrilla | COLLAB-008 |
| GWS.CALENDAR.1.2v1 | External sharing options for secondary calendars SHALL be configured to "Only free/busy information (hide event details)." | Assessed by Guerrilla | COLLAB-008 |
| GWS.CALENDAR.2.1v1 | External invitations warnings SHALL be enabled to prompt users before sending invitations. | Assessed by Guerrilla | COLLAB-009 |
| GWS.CALENDAR.3.1v1 | Calendar Interop SHOULD be disabled. | Assessed by Guerrilla | COLLAB-017 (Not Assessed in live runs) |
| GWS.CALENDAR.3.2v1 | Microsoft 365 (Graph API) SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment. | Manual (CISA marks this control manual) | None |
| GWS.CALENDAR.4.1v1 | "Appointment Schedule with Payments" SHOULD be disabled. | Assessed by Guerrilla | COLLAB-018 (Not Assessed in live runs) |
| GWS.CHAT.1.1v1 | Chat history SHALL be enabled for information traceability. | Assessed by Guerrilla | COLLAB-005 |
| GWS.CHAT.1.2v1 | Users SHALL NOT be allowed to change their history setting. | Assessed by Guerrilla | COLLAB-005 |
| GWS.CHAT.2.1v1 | External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing. | Assessed by Guerrilla | COLLAB-013 (Not Assessed in live runs) |
| GWS.CHAT.3.1v1 | Space history SHOULD be enabled for information traceability. | Assessed by Guerrilla | COLLAB-014 (Not Assessed in live runs) |
| GWS.CHAT.4.1v1 | External chat messaging SHALL be restricted to allowlisted domains only. | Assessed by Guerrilla | COLLAB-004 |
| GWS.CHAT.5.1v1 | Chat content reporting SHALL be enabled for all conversation types. | No configuration API (deferred) | None |
| GWS.CHAT.5.2v1 | All reporting message categories SHOULD be selected. | No configuration API (deferred) | None |
| GWS.CLASSROOM.1.1v1 | "Who can join classes in your domain" SHOULD be set to "Users in your domain only." | Assessed by Guerrilla | GWS-CLASS-001 |
| GWS.CLASSROOM.1.2v1 | "Which classes users in your domain can join" SHOULD be set to "Classes in your domain only." | Assessed by Guerrilla | GWS-CLASS-002 |
| GWS.CLASSROOM.2.1v1 | Users SHOULD NOT be able to authorize apps to access their Google Classroom data. | Assessed by Guerrilla | GWS-CLASS-003 |
| GWS.CLASSROOM.3.1v1 | "Roster Import" with Clever SHOULD be turned off. | Assessed by Guerrilla | GWS-CLASS-004 |
| GWS.CLASSROOM.4.1v1 | Only teachers SHOULD be allowed to unenroll students from classes. | Assessed by Guerrilla | GWS-CLASS-005 |
| GWS.CLASSROOM.5.1v1 | Class creation SHOULD be restricted to verified teachers only. | Assessed by Guerrilla | GWS-CLASS-006 |
| GWS.COMMONCONTROLS.1.1v1 | Phishing-Resistant MFA SHALL be required for all users. | Assessed by Guerrilla | AUTH-003, AUTH-014 |
| GWS.COMMONCONTROLS.1.2v1 | If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | Assessed by Guerrilla | AUTH-014 |
| GWS.COMMONCONTROLS.1.3v1 | SMS or Voice as the MFA method SHALL NOT be used. | Assessed by Guerrilla | AUTH-003, AUTH-014 |
| GWS.COMMONCONTROLS.1.4v1 | Google 2-Step Verification (2SV) new user enrollment period SHALL be set to at least 1 day or at most 1 week. | Assessed by Guerrilla | AUTH-014, AUTH-015 |
| GWS.COMMONCONTROLS.1.5v1 | Allow users to trust the device SHALL be disabled. | Assessed by Guerrilla | AUTH-014 |
| GWS.COMMONCONTROLS.2.1v1 | Policies restricting access to Google Workspace based on signals about enterprise devices SHOULD be implemented. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.3.1v1 | Post single sign-on (SSO) verification SHOULD be enabled for users signing in using the SSO profile for the organization. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.3.2v1 | Post-SSO verification SHOULD be enabled for users signing in using other SSO profiles. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.4.1v1 | Users SHALL be forced to re-authenticate after an established 12-hour GWS login session has expired. | Assessed by Guerrilla | AUTH-006 |
| GWS.COMMONCONTROLS.5.1v1 | User password strength SHALL be enforced. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.5.2v1 | User password length SHALL be at least 12 characters. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.5.3v1 | User password length SHOULD be at least 15 characters. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.5.4v1 | Password policy SHALL be enforced at next sign-in. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.5.5v1 | User passwords SHALL NOT be reused. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.5.6v1 | User passwords SHALL NOT expire. | Assessed by Guerrilla | AUTH-004, AUTH-005 |
| GWS.COMMONCONTROLS.6.1v1 | All administrative accounts SHALL be provisioned as cloud-only accounts separate from an agency's authoritative on-premises or other federated identity providers. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.6.2v1 | A minimum of two and maximum of eight separate and distinct super admin users SHALL be configured. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.7.1v1 | Account conflict management SHOULD be configured to replace conflicting unmanaged accounts with managed ones. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.8.1v1 | Account self-recovery for super admins SHALL be disabled. | Assessed by Guerrilla | AUTH-017 |
| GWS.COMMONCONTROLS.8.2v1 | Account self-recovery for users and non-super admins SHALL be disabled. | Assessed by Guerrilla | AUTH-018 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.8.3v1 | Ability to add recovery information SHOULD be disabled. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.9.1v1 | Highly privileged accounts SHALL be enrolled in the Google Workspace (GWS) Advanced Protection Program. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.9.2v1 | All sensitive user accounts SHOULD be enrolled into the GWS Advanced Protection Program. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.10.1v1 | Agencies SHALL use GWS application access control policies to restrict access to all GWS services by third party applications. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.10.2v1 | Agencies SHALL NOT allow users to grant consent for access to low-risk scopes. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.10.3v1 | Agencies SHALL NOT trust unconfigured internal apps. | Assessed by Guerrilla | ADMIN-017 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.10.4v1 | Agencies SHALL NOT allow users to access unconfigured third-party apps. | Assessed by Guerrilla | ADMIN-020 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.10.5v1 | Access to GWS applications by less secure apps that do not meet security standards for authentication SHALL be prevented. | Assessed by Guerrilla | AUTH-008 |
| GWS.COMMONCONTROLS.11.1v1 | Only approved Google Workspace (GWS) Marketplace applications SHALL be allowed for installation. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.12.1v1 | Google Takeout services SHALL be disabled. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.13.1v1 | Required system-defined alerting rules, as listed in the Policy group description, SHALL be enabled with alerts. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.14.1v1 | The following critical logs SHALL be sent to the agency's centralized SIEM. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.14.2v1 | Audit logs SHALL be retained and searchable for a minimum of 3 months and retrievable for a minimum of 12 months. | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.15.1v1 | The data storage region SHALL be set to be the United States for all users in the agency's GWS environment. | Assessed by Guerrilla | ADMIN-018 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.15.2v1 | Data SHALL be processed in the region selected for data at rest. | Assessed by Guerrilla | ADMIN-019 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.16.1v1 | Service status for Google services that do not have an individual control SHOULD be set to OFF for everyone. | Assessed by Guerrilla | ADMIN-021 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.16.2v1 | User access to Early Access applications SHOULD be disabled. | Assessed by Guerrilla | ADMIN-022 (Not Assessed in live runs) |
| GWS.COMMONCONTROLS.16.3v1 | Looker Studio Sharing outside org SHOULD be set to OFF. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.16.4v1 | Pinpoint access to drive SHOULD be set to OFF. | Config-readable, check buildable | None |
| GWS.COMMONCONTROLS.17.1v1 | Require multiparty approval for sensitive admin actions SHOULD be enabled. | No configuration API (deferred) | None |
| GWS.COMMONCONTROLS.18.1v1 | A custom policy SHALL be configured for Google Drive, Google Calendar, Google Chat, and Gmail to protect PII and sensitive information as defined by the agency, covering at a minimum: credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN). | Manual (CISA marks this control manual) | None |
| GWS.COMMONCONTROLS.18.2v1 | The action for DLP policies SHOULD be set to block. | Manual (CISA marks this control manual) | None |
| GWS.DRIVEDOCS.1.1v1 | External sharing SHALL be restricted to allowlisted domains. | Assessed by Guerrilla | DRIVE-001 |
| GWS.DRIVEDOCS.1.2v1 | Receiving files from outside of allowlisted domains SHOULD be disabled. | Assessed by Guerrilla | DRIVE-001 |
| GWS.DRIVEDOCS.1.3v1 | Warnings SHALL be enabled when a user is attempting to share with someone not in allowlisted domains. | Config-readable, check buildable | None |
| GWS.DRIVEDOCS.1.4v1 | If sharing outside of the organization, then agencies SHOULD disable sharing of files with individuals who are not using a Google account. | Config-readable, check buildable | None |
| GWS.DRIVEDOCS.1.5v1 | Any OUs that do allow external sharing SHOULD disable making content available to anyone with the link. | Config-readable, check buildable | None |
| GWS.DRIVEDOCS.1.6v1 | Agencies SHALL set access checking to "recipients only." | Assessed by Guerrilla | DRIVE-001 |
| GWS.DRIVEDOCS.1.7v1 | Users SHOULD NOT be allowed to upload or move content to shared drives owned by another organization. | Config-readable, check buildable | None |
| GWS.DRIVEDOCS.1.8v1 | "Private to owner" SHALL be the default access level for newly created items. | Assessed by Guerrilla | DRIVE-017 (Not Assessed in live runs) |
| GWS.DRIVEDOCS.1.9v1 | Out-of-Domain file-level warnings SHALL be enabled. | Assessed by Guerrilla | DRIVE-015 (Not Assessed in live runs) |
| GWS.DRIVEDOCS.1.10v1 | If external sharing is not allowed, then forms owned by users within the organization SHOULD NOT be able to accept responses from anyone with the link outside the organization. | Manual (CISA marks this control manual) | None |
| GWS.DRIVEDOCS.1.11v1 | If receiving external files is not allowed, then users in the organization SHOULD NOT be able to submit responses to forms from users or shared drives outside of the organization. | Manual (CISA marks this control manual) | None |
| GWS.DRIVEDOCS.2.1v1 | Agencies SHOULD NOT allow members with manager access to override shared Google Drive creation settings. | Assessed by Guerrilla | DRIVE-004 |
| GWS.DRIVEDOCS.2.2v1 | Agencies SHALL allow users who are not shared Google Drive members to be added to files. | Assessed by Guerrilla | DRIVE-004 |
| GWS.DRIVEDOCS.3.1v1 | Agencies SHALL enable the security update for Google Drive files. | Assessed by Guerrilla | DRIVE-016 (Not Assessed in live runs) |
| GWS.DRIVEDOCS.4.1v1 | Agencies SHOULD disable Google Drive SDK access. | Assessed by Guerrilla | DRIVE-014 (Not Assessed in live runs) |
| GWS.DRIVEDOCS.5.1v1 | Google Drive for Desktop SHALL be enabled only for authorized devices. | Config-readable, check buildable | None |
| GWS.DRIVEDOCS.5.2v1 | Monitoring for potential ransomware corruption SHALL be enabled. | Manual (CISA marks this control manual) | None |
| GWS.GEMINI.1.1v1 | Gemini app user access SHALL be set to OFF for everyone without a license. | Assessed by Guerrilla | GWS-GEMINI-001 |
| GWS.GEMINI.2.1v1 | Gemini Alpha features SHALL be disabled. | Assessed by Guerrilla | GWS-GEMINI-002 (Not Assessed in live runs) |
| GWS.GEMINI.3.1v1 | Gemini conversation history SHALL be enabled. | Assessed by Guerrilla | GWS-GEMINI-003 (Not Assessed in live runs) |
| GWS.GEMINI.3.2v1 | Conversation retention SHALL be set to minimum of 18 months. | Assessed by Guerrilla | GWS-GEMINI-004 (Not Assessed in live runs) |
| GWS.GEMINI.4.1v1 | Conversation sharing SHALL be set to OFF. | Assessed by Guerrilla | GWS-GEMINI-005 (Not Assessed in live runs) |
| GWS.GMAIL.1.1v1 | Mail Delegation SHOULD be disabled. | Assessed by Guerrilla | EMAIL-025 (Not Assessed in live runs) |
| GWS.GMAIL.2.1v1 | DKIM SHOULD be enabled for all domains. | Assessed by Guerrilla | EMAIL-002 |
| GWS.GMAIL.3.1v1 | An SPF policy SHALL be published for each domain that fails all non-approved senders. | Assessed by Guerrilla | EMAIL-001 |
| GWS.GMAIL.4.1v1 | A DMARC policy SHALL be published at the full domain or the second-level domain for all Google Workspace domains, including user alias domains. | Assessed by Guerrilla | EMAIL-003 |
| GWS.GMAIL.4.2v1 | The DMARC message rejection option SHALL be p=reject. | Assessed by Guerrilla | EMAIL-003 |
| GWS.GMAIL.4.3v1 | The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov. | DNS-based (outside configuration read) | None |
| GWS.GMAIL.4.4v1 | An agency point of contact SHOULD be included for aggregate and failure reports. | DNS-based (outside configuration read) | None |
| GWS.GMAIL.5.1v1 | "Protect against encrypted attachments from untrusted senders" SHALL be enabled. | Assessed by Guerrilla | EMAIL-015 |
| GWS.GMAIL.5.2v1 | "Protect against attachments with scripts from untrusted senders" SHALL be enabled. | Assessed by Guerrilla | EMAIL-015 |
| GWS.GMAIL.5.3v1 | "Protect against anomalous attachment types in emails" SHALL be enabled. | Assessed by Guerrilla | EMAIL-015 |
| GWS.GMAIL.5.4v1 | Google SHOULD be allowed to automatically apply future recommended settings for attachments. | Assessed by Guerrilla | EMAIL-015 |
| GWS.GMAIL.5.5v1 | Emails flagged by SCuBA policies GWS.GMAIL.5.1 through GWS.GMAIL.5.3 SHALL NOT be kept in inbox. | Config-readable, check buildable | None |
| GWS.GMAIL.6.1v1 | "Identify links behind shortened URLs" SHALL be enabled. | Assessed by Guerrilla | EMAIL-016 |
| GWS.GMAIL.6.2v1 | "Scan linked images" SHALL be enabled. | Assessed by Guerrilla | EMAIL-016 |
| GWS.GMAIL.6.3v1 | "Show warning prompt for any click on links to untrusted domains" SHALL be enabled. | Assessed by Guerrilla | EMAIL-016 |
| GWS.GMAIL.6.4v1 | Google SHALL be allowed to automatically apply future recommended settings for links and external images. | Assessed by Guerrilla | EMAIL-016 |
| GWS.GMAIL.7.1v1 | "Protect against domain spoofing based on similar domain names" SHALL be enabled. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.7.2v1 | "Protect against spoofing of employee names" SHALL be enabled. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.7.3v1 | "Protect against inbound emails spoofing your domain" SHALL be enabled. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.7.4v1 | "Protect against any unauthenticated emails" SHALL be enabled. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.7.5v1 | "Protect your Groups from inbound emails spoofing your domain" SHALL be enabled. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.7.6v1 | Emails flagged by SCuBA policies GWS.GMAIL.7.1 through GWS.GMAIL.7.5 SHALL NOT be kept in inbox. | Config-readable, check buildable | None |
| GWS.GMAIL.7.7v1 | Google SHALL be allowed to automatically apply future recommended settings for spoofing and authentication. | Assessed by Guerrilla | EMAIL-017 |
| GWS.GMAIL.8.1v1 | User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment. | Assessed by Guerrilla | EMAIL-027 (Not Assessed in live runs) |
| GWS.GMAIL.9.1v1 | POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients. | Assessed by Guerrilla | EMAIL-026 (Not Assessed in live runs) |
| GWS.GMAIL.10.1v1 | Google Workspace Sync SHOULD be disabled. | Assessed by Guerrilla | EMAIL-028 (Not Assessed in live runs) |
| GWS.GMAIL.11.1v1 | Automatic forwarding SHOULD be disabled, especially to external domains. | Assessed by Guerrilla | EMAIL-030 (Not Assessed in live runs) |
| GWS.GMAIL.12.1v1 | Using a per-user outbound gateway that is a mail server other than the Google Workspace (GWS) mail servers SHALL be disabled. | Assessed by Guerrilla | EMAIL-023 (Not Assessed in live runs) |
| GWS.GMAIL.13.1v1 | Unintended external reply warnings SHALL be enabled. | No configuration API (deferred) | None |
| GWS.GMAIL.14.1v1 | An email allowlist SHOULD not be implemented. | Assessed by Guerrilla | EMAIL-006 |
| GWS.GMAIL.15.1v1 | Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing. | Assessed by Guerrilla | EMAIL-031 (Not Assessed in live runs) |
| GWS.GMAIL.16.1v1 | Security sandbox SHOULD be enabled to provide additional protections for emails. | Assessed by Guerrilla | EMAIL-024 (Not Assessed in live runs) |
| GWS.GMAIL.17.1v1 | Comprehensive mail storage SHOULD be enabled to allow information traceability across applications. | Manual (CISA marks this control manual) | None |
| GWS.GMAIL.18.1v1 | Domains SHALL NOT be added to lists that bypass spam filters. | Assessed by Guerrilla | EMAIL-029 (Not Assessed in live runs) |
| GWS.GMAIL.18.2v1 | Domains SHALL NOT be added to lists that bypass spam filters and hide warnings. | Config-readable, check buildable | None |
| GWS.GMAIL.18.3v1 | "Bypass spam filters" and "hide warnings for all messages from internal and external senders" SHALL NOT be enabled. | Config-readable, check buildable | None |
| GWS.GROUPS.1.1v1 | Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner. | Assessed by Guerrilla | GROUP-001 (Not Assessed in live runs) |
| GWS.GROUPS.1.2v1 | Group owners' ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment. | Assessed by Guerrilla | GROUP-002 (Not Assessed in live runs) |
| GWS.GROUPS.1.3v1 | Group owners' ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment. | Assessed by Guerrilla | GROUP-003 (Not Assessed in live runs) |
| GWS.GROUPS.2.1v1 | Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment. | Assessed by Guerrilla | GROUP-004 (Not Assessed in live runs) |
| GWS.GROUPS.3.1v1 | The default permission to view conversations SHOULD be set to "All Group Members." | Assessed by Guerrilla | GROUP-005 (Not Assessed in live runs) |
| GWS.GROUPS.4.1v1 | The ability for groups to be hidden from the directory SHALL be disabled. | Assessed by Guerrilla | GROUP-006 (Not Assessed in live runs) |
| GWS.MEET.1.1v1 | External users who were not explicitly invited SHALL be required to ask to join. | Assessed by Guerrilla | COLLAB-002 |
| GWS.MEET.2.1v1 | Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace (GWS) tenant or organization. | Assessed by Guerrilla | COLLAB-015 (Not Assessed in live runs) |
| GWS.MEET.3.1v1 | Host Management meeting features SHALL be enabled. | Assessed by Guerrilla | COLLAB-012 |
| GWS.MEET.4.1v1 | "Warn for external participants" SHALL be enabled. | Assessed by Guerrilla | COLLAB-011 |
| GWS.MEET.5.1v1 | Automatic recordings for Google Meet SHALL be disabled. | Assessed by Guerrilla | COLLAB-001, COLLAB-019 (Not Assessed in live runs) |
| GWS.MEET.5.2v1 | Automatic transcripts for Google Meet SHALL be disabled. | Assessed by Guerrilla | COLLAB-016 (Not Assessed in live runs) |
| GWS.MEET.6.1v1 | Admins SHOULD NOT be allowed to override the default sharing level for meeting notes set by the organization. | No configuration API (deferred) | None |
| GWS.MEET.6.2v1 | Default sharing setting for Google AI notes SHALL be restricted to guests in your organization. | No configuration API (deferred) | None |
| GWS.SITES.1.1v1 | Sites Service SHOULD be disabled for all users. | Assessed by Guerrilla | GWS-SITES-001 |
CISA SCuBA (Microsoft 365)
79 of 96 controls assessed by 74 checks. Configuration-assessable ceiling: 93 of 96. The remainder is manual, DNS-based, or has no configuration API.
| Control | Title | Status | Guerrilla checks |
|---|---|---|---|
| MS.AAD.1.1v1 | Legacy authentication SHALL be blocked. | Assessed by Guerrilla | EIDAUTH-015, EIDCA-008 |
| MS.AAD.2.1v1 | Users detected as high risk SHALL be blocked. | Assessed by Guerrilla | EIDCA-013 |
| MS.AAD.2.2v1 | A notification SHOULD be sent to the administrator when high-risk users are detected. | Assessed by Guerrilla | EIDCA-017 (Not Assessed in live runs) |
| MS.AAD.2.3v1 | Sign-ins detected as high risk SHALL be blocked. | Assessed by Guerrilla | EIDCA-012 |
| MS.AAD.3.1v1 | Phishing-resistant MFA SHALL be enforced for all users. | Assessed by Guerrilla | EIDAUTH-006, EIDAUTH-008, EIDCA-007 |
| MS.AAD.3.2v2 | MFA SHALL be enforced for all users. | Assessed by Guerrilla | EIDAUTH-002, EIDCA-007 |
| MS.AAD.3.3v2 | If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. | Assessed by Guerrilla | EIDAUTH-018 |
| MS.AAD.3.4v1 | The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | Assessed by Guerrilla | EIDAUTH-001 |
| MS.AAD.3.5v2 | The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled. | Assessed by Guerrilla | EIDAUTH-001, EIDAUTH-004 |
| MS.AAD.3.6v1 | Phishing-resistant MFA SHALL be required for highly privileged roles. | Assessed by Guerrilla | EIDPIM-006, EIDPIM-007 |
| MS.AAD.3.7v1 | Managed devices SHOULD be required for authentication. | Assessed by Guerrilla | EIDCA-009 |
| MS.AAD.3.8v1 | Managed Devices SHOULD be required to register MFA. | Assessed by Guerrilla | EIDCA-018 |
| MS.AAD.3.9v1 | Device code authentication SHOULD be blocked. | Config-readable, check buildable | None |
| MS.AAD.4.1v1 | Security logs SHALL be sent to the agency's security operations center for monitoring. | Assessed by Guerrilla | EIDTNT-011, EIDTNT-012 |
| MS.AAD.5.1v1 | Only administrators SHALL be allowed to register applications. | Assessed by Guerrilla | EIDTNT-002 |
| MS.AAD.5.2v1 | User consent to applications SHALL be restricted. | Assessed by Guerrilla | EIDAPP-012 |
| MS.AAD.5.3v1 | An admin consent workflow SHALL be configured for applications. | Assessed by Guerrilla | EIDAPP-013 |
| MS.AAD.5.5v1 | Application Password Addition SHOULD be blocked. | Assessed by Guerrilla | EIDAPP-003 |
| MS.AAD.5.6v1 | Application password lifetime SHOULD be restricted to 180 days or less. | Assessed by Guerrilla | EIDAPP-008 |
| MS.AAD.5.7v1 | Application certificate lifetime SHOULD be restricted to 365 days or less. | Assessed by Guerrilla | EIDAPP-008 |
| MS.AAD.6.1v1 | User passwords SHALL NOT expire. | Assessed by Guerrilla | EIDTNT-014 (Not Assessed in live runs) |
| MS.AAD.7.1v1 | A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. | Assessed by Guerrilla | EIDPIM-001 |
| MS.AAD.7.2v1 | Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. | Assessed by Guerrilla | EIDPIM-002, EIDPIM-013 |
| MS.AAD.7.3v1 | Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. | Assessed by Guerrilla | EIDPIM-005 |
| MS.AAD.7.4v1 | Permanent active role assignments SHALL NOT be allowed for highly privileged roles. | Assessed by Guerrilla | EIDPIM-003 |
| MS.AAD.7.5v1 | Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. | Assessed by Guerrilla | EIDPIM-010 |
| MS.AAD.7.6v1 | Activation of the Global Administrator role SHALL require approval. | Assessed by Guerrilla | EIDPIM-010 |
| MS.AAD.7.7v1 | Eligible and active highly privileged role assignments SHALL trigger an alert. | Assessed by Guerrilla | EIDPIM-014 (Not Assessed in live runs) |
| MS.AAD.7.8v1 | User activation of the Global Administrator role SHALL trigger an alert. | Assessed by Guerrilla | EIDPIM-014 (Not Assessed in live runs) |
| MS.AAD.7.9v1 | User activation of other highly privileged roles SHOULD trigger an alert. | Assessed by Guerrilla | EIDPIM-014 (Not Assessed in live runs) |
| MS.AAD.8.1v1 | Guest users SHOULD have limited or restricted access to Microsoft Entra ID directory objects. | Assessed by Guerrilla | EIDTNT-003 |
| MS.AAD.8.2v1 | Only users with the Guest Inviter role SHOULD be able to invite guest users. | Assessed by Guerrilla | EIDTNT-004 |
| MS.AAD.8.3v1 | Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. | Assessed by Guerrilla | EIDTNT-005 |
| MS.AAD.9.1v1 | Risky AI agents SHALL be blocked. | Config-readable, check buildable | None |
| MS.DEFENDER.1.1v1 | The standard and strict preset security policies SHALL be enabled. | Assessed by Guerrilla | M365DEF-001 (Not Assessed in live runs) |
| MS.DEFENDER.1.2v1 | All users SHALL be added to Exchange Online Protection (EOP) in either the standard or strict preset security policy. | Assessed by Guerrilla | M365DEF-001 (Not Assessed in live runs) |
| MS.DEFENDER.1.3v1 | All users SHALL be added to Defender for Office 365 protection in either the standard or strict preset security policy. | Assessed by Guerrilla | M365DEF-001 (Not Assessed in live runs) |
| MS.DEFENDER.1.4v1 | Sensitive accounts SHALL be added to Exchange Online Protection in the strict preset security policy. | Config-readable, check buildable | None |
| MS.DEFENDER.1.5v1 | Sensitive accounts SHALL be added to Defender for Office 365 protection in the strict preset security policy. | Config-readable, check buildable | None |
| MS.DEFENDER.2.1v1 | User impersonation protection SHOULD be enabled for sensitive accounts in both the standard and strict preset policies. | Assessed by Guerrilla | M365EXO-002 |
| MS.DEFENDER.2.2v1 | Domain impersonation protection SHOULD be enabled for domains owned by the agency in both the standard and strict preset policies. | Assessed by Guerrilla | M365EXO-002 |
| MS.DEFENDER.2.3v1 | Domain impersonation protection SHOULD be added for key suppliers and partners in both the standard and strict preset policies. | Config-readable, check buildable | None |
| MS.DEFENDER.3.1v1 | Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams. | Assessed by Guerrilla | M365EXO-004 (Not Assessed in live runs) |
| MS.DEFENDER.4.1v2 | A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency, blocking at a minimum: credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN). | Assessed by Guerrilla | M365SPO-005 (Not Assessed in live runs) |
| MS.DEFENDER.4.2v1 | The custom policy SHOULD be applied to Exchange, OneDrive, SharePoint, Teams chat, and Devices. | Config-readable, check buildable | None |
| MS.DEFENDER.4.3v1 | The action for the custom policy SHOULD be set to block sharing sensitive information with everyone. | Config-readable, check buildable | None |
| MS.DEFENDER.4.4v1 | Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled in the custom policy. | Config-readable, check buildable | None |
| MS.DEFENDER.4.5v1 | A list of apps that are restricted from accessing files protected by DLP policy SHOULD be defined. | Manual (CISA marks this control manual) | None |
| MS.DEFENDER.4.6v1 | The custom policy SHOULD include an action to block access to sensitive information by restricted apps and unwanted Bluetooth applications. | Manual (CISA marks this control manual) | None |
| MS.DEFENDER.5.1v1 | At a minimum, the alerts required by the CISA M365 Secure Configuration Baseline for Exchange Online SHALL be enabled. | Assessed by Guerrilla | M365DEF-002 (Not Assessed in live runs), M365EXO-044 |
| MS.DEFENDER.5.2v1 | The alerts SHOULD be sent to a monitored address or incorporated into a Security Information and Event Management (SIEM). | Assessed by Guerrilla | M365DEF-002 (Not Assessed in live runs), M365EXO-045 (Not Assessed in live runs) |
| MS.DEFENDER.6.1v1 | Unified Audit logging SHALL be enabled. | Assessed by Guerrilla | M365AUDIT-001 (Not Assessed in live runs), M365EXO-046 (Not Assessed in live runs) |
| MS.DEFENDER.6.3v1 | Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31. | Assessed by Guerrilla | M365AUDIT-002 (Not Assessed in live runs), M365EXO-048 (Not Assessed in live runs) |
| MS.EXO.1.1v2 | Automatic forwarding to external domains SHALL be disabled. | Assessed by Guerrilla | M365EXO-007, M365EXO-012 (Not Assessed in live runs), M365EXO-013 (Not Assessed in live runs) |
| MS.EXO.2.2v3 | An SPF policy SHALL be published for each domain that fails all non-approved senders. | Assessed by Guerrilla | M365EXO-006, M365EXO-015 (Not Assessed in live runs) |
| MS.EXO.3.1v1 | DKIM SHOULD be enabled for all domains. | Assessed by Guerrilla | M365EXO-006, M365EXO-016 (Not Assessed in live runs) |
| MS.EXO.4.1v1 | A DMARC policy SHALL be published for every second-level domain. | Assessed by Guerrilla | M365EXO-006, M365EXO-017 (Not Assessed in live runs) |
| MS.EXO.4.2v1 | The DMARC message rejection option SHALL be p=reject. | Assessed by Guerrilla | M365EXO-006, M365EXO-018 (Not Assessed in live runs) |
| MS.EXO.4.3v1 | The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov. | Assessed by Guerrilla | M365EXO-019 (Not Assessed in live runs) |
| MS.EXO.4.4v1 | An agency point of contact SHOULD be included for aggregate and failure reports. | Assessed by Guerrilla | M365EXO-019 (Not Assessed in live runs) |
| MS.EXO.5.1v1 | SMTP AUTH SHALL be disabled. | Assessed by Guerrilla | M365EXO-011, M365EXO-020 (Not Assessed in live runs) |
| MS.EXO.6.1v1 | Contact folders SHALL NOT be shared with all domains. | Assessed by Guerrilla | M365EXO-021 (Not Assessed in live runs) |
| MS.EXO.6.2v1 | Calendar details SHALL NOT be shared with all domains. | Assessed by Guerrilla | M365EXO-022 (Not Assessed in live runs) |
| MS.EXO.7.1v1 | External sender warnings SHALL be implemented. | Assessed by Guerrilla | M365EXO-010 (Not Assessed in live runs), M365EXO-023 (Not Assessed in live runs) |
| MS.EXO.13.1v1 | Mailbox auditing SHALL be enabled. | Assessed by Guerrilla | M365EXO-009 (Not Assessed in live runs), M365EXO-037 (Not Assessed in live runs) |
| MS.POWERPLATFORM.1.1v1 | The ability to create production and sandbox environments SHALL be restricted to admins. | Assessed by Guerrilla | M365PP-001 (Not Assessed in live runs) |
| MS.POWERPLATFORM.1.2v1 | The ability to create trial environments SHALL be restricted to admins. | Assessed by Guerrilla | M365PP-001 (Not Assessed in live runs) |
| MS.POWERPLATFORM.2.1v1 | A DLP policy SHALL be created to restrict connector access in the default Power Platform environment. | Assessed by Guerrilla | M365PP-002 (Not Assessed in live runs) |
| MS.POWERPLATFORM.2.2v1 | Non-default environments SHOULD have at least one DLP policy affecting them. | Assessed by Guerrilla | M365PP-002 (Not Assessed in live runs) |
| MS.POWERPLATFORM.3.1v1 | Power Platform tenant isolation SHALL be enabled. | Assessed by Guerrilla | M365PP-003 (Not Assessed in live runs) |
| MS.POWERPLATFORM.3.2v1 | An inbound/outbound connection allowlist SHOULD be configured. | Assessed by Guerrilla | M365PP-003 (Not Assessed in live runs) |
| MS.POWERPLATFORM.4.1v1 | Content Security Policy (CSP) SHALL be enforced for model-driven and canvas Power Apps. | Manual (CISA marks this control manual) | None |
| MS.POWERPLATFORM.5.1v1 | The ability to create Power Pages sites SHOULD be restricted to admins. | Config-readable, check buildable | None |
| MS.POWERPLATFORM.6.1v1 | The Share with Everyone feature SHOULD be disabled. | Config-readable, check buildable | None |
| MS.SHAREPOINT.1.1v1 | External sharing for SharePoint SHALL be limited to "Existing guests" or "Only people in your organization". | Assessed by Guerrilla | M365SPO-001 (Not Assessed in live runs) |
| MS.SHAREPOINT.1.2v1 | External sharing for OneDrive SHALL be limited to "Existing guests" or "Only people in your organization". | Assessed by Guerrilla | M365SPO-001 (Not Assessed in live runs) |
| MS.SHAREPOINT.1.3v1 | External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. | Assessed by Guerrilla | M365SPO-001 (Not Assessed in live runs) |
| MS.SHAREPOINT.2.1v1 | File and folder default sharing scope SHALL be set to "Specific people (only the people the user specifies)". | Assessed by Guerrilla | M365SPO-003 (Not Assessed in live runs) |
| MS.SHAREPOINT.2.2v1 | File and folder default sharing permissions SHALL be set to view only. | Assessed by Guerrilla | M365SPO-003 (Not Assessed in live runs) |
| MS.SHAREPOINT.3.1v1 | Expiration days for Anyone links SHALL be set to 30 days or less. | Assessed by Guerrilla | M365SPO-002 (Not Assessed in live runs) |
| MS.SHAREPOINT.3.2v1 | The allowable file and folder permissions for links SHALL be set to view only. | Assessed by Guerrilla | M365SPO-003 (Not Assessed in live runs) |
| MS.SHAREPOINT.3.3v2 | Reauthentication days for people who use a verification code SHALL be set to 30 days or less. | Config-readable, check buildable | None |
| MS.TEAMS.1.1v1 | External meeting participants SHOULD NOT be enabled to request control of shared desktops or windows. | Assessed by Guerrilla | M365TEAMS-003 (Not Assessed in live runs) |
| MS.TEAMS.1.2v2 | Anonymous users SHALL NOT be enabled to start meetings. | Assessed by Guerrilla | M365TEAMS-004 (Not Assessed in live runs) |
| MS.TEAMS.1.3v1 | Anonymous users and dial-in callers SHOULD NOT be admitted automatically. | Assessed by Guerrilla | M365TEAMS-004 (Not Assessed in live runs) |
| MS.TEAMS.1.4v1 | Internal users SHOULD be admitted automatically. | Config-readable, check buildable | None |
| MS.TEAMS.1.5v1 | Dial-in users SHOULD NOT be enabled to bypass the lobby. | Config-readable, check buildable | None |
| MS.TEAMS.1.6v1 | Meeting recording SHOULD be disabled. | Assessed by Guerrilla | M365TEAMS-005 (Not Assessed in live runs) |
| MS.TEAMS.1.7v2 | Record an event SHOULD NOT be set to Always record. | Assessed by Guerrilla | M365TEAMS-005 (Not Assessed in live runs) |
| MS.TEAMS.2.1v2 | External access for users SHALL only be enabled on a per-domain basis. | Assessed by Guerrilla | M365TEAMS-001 (Not Assessed in live runs) |
| MS.TEAMS.2.2v2 | Unmanaged users SHALL NOT be enabled to initiate contact with internal users. | Assessed by Guerrilla | M365TEAMS-006 (Not Assessed in live runs) |
| MS.TEAMS.2.3v2 | Internal users SHOULD NOT be enabled to initiate contact with unmanaged users. | Assessed by Guerrilla | M365TEAMS-006 (Not Assessed in live runs) |
| MS.TEAMS.4.1v1 | Teams email integration SHALL be disabled. | Config-readable, check buildable | None |
| MS.TEAMS.5.1v2 | Agencies SHOULD only allow installation of Microsoft apps approved by the agency. | Assessed by Guerrilla | M365TEAMS-007 (Not Assessed in live runs) |
| MS.TEAMS.5.2v2 | Agencies SHOULD only allow installation of third-party apps approved by the agency. | Assessed by Guerrilla | M365TEAMS-007 (Not Assessed in live runs) |
| MS.TEAMS.5.3v2 | Agencies SHOULD only allow installation of custom apps approved by the agency. | Assessed by Guerrilla | M365TEAMS-007 (Not Assessed in live runs) |
EIDSCA
44 of 44 controls assessed by 45 checks.
| Control | Status | Guerrilla checks |
|---|---|---|
| AF01 | Assessed by Guerrilla | EIDSCA-AF01 |
| AF02 | Assessed by Guerrilla | EIDSCA-AF02 |
| AF03 | Assessed by Guerrilla | EIDSCA-AF03 |
| AF04 | Assessed by Guerrilla | EIDSCA-AF04 |
| AF05 | Assessed by Guerrilla | EIDSCA-AF05 |
| AF06 | Assessed by Guerrilla | EIDSCA-AF06 |
| AG01 | Assessed by Guerrilla | EIDSCA-AG01 |
| AG02 | Assessed by Guerrilla | EIDSCA-AG02 (Not Assessed in live runs) |
| AG03 | Assessed by Guerrilla | EIDSCA-AG03 (Not Assessed in live runs) |
| AM01 | Assessed by Guerrilla | EIDSCA-AM01 |
| AM02 | Assessed by Guerrilla | EIDSCA-AM02 |
| AM03 | Assessed by Guerrilla | EIDSCA-AM03 (Not Assessed in live runs) |
| AM04 | Assessed by Guerrilla | EIDSCA-AM04 (Not Assessed in live runs) |
| AM06 | Assessed by Guerrilla | EIDAUTH-018, EIDSCA-AM06 |
| AM07 | Assessed by Guerrilla | EIDSCA-AM07 |
| AM09 | Assessed by Guerrilla | EIDAUTH-018, EIDSCA-AM09 |
| AM10 | Assessed by Guerrilla | EIDSCA-AM10 |
| AP01 | Assessed by Guerrilla | EIDSCA-AP01 |
| AP04 | Assessed by Guerrilla | EIDSCA-AP04 |
| AP05 | Assessed by Guerrilla | EIDSCA-AP05 |
| AP06 | Assessed by Guerrilla | EIDSCA-AP06 |
| AP07 | Assessed by Guerrilla | EIDSCA-AP07 |
| AP08 | Assessed by Guerrilla | EIDSCA-AP08 (Not Assessed in live runs) |
| AP09 | Assessed by Guerrilla | EIDSCA-AP09 (Not Assessed in live runs) |
| AP10 | Assessed by Guerrilla | EIDSCA-AP10 |
| AP14 | Assessed by Guerrilla | EIDSCA-AP14 |
| AS04 | Assessed by Guerrilla | EIDSCA-AS04 |
| AT01 | Assessed by Guerrilla | EIDSCA-AT01 |
| AT02 | Assessed by Guerrilla | EIDSCA-AT02 |
| AV01 | Assessed by Guerrilla | EIDSCA-AV01 |
| CP01 | Assessed by Guerrilla | EIDSCA-CP01 (Not Assessed in live runs) |
| CP03 | Assessed by Guerrilla | EIDSCA-CP03 (Not Assessed in live runs) |
| CP04 | Assessed by Guerrilla | EIDSCA-CP04 (Not Assessed in live runs) |
| CR01 | Assessed by Guerrilla | EIDSCA-CR01 |
| CR02 | Assessed by Guerrilla | EIDSCA-CR02 |
| CR03 | Assessed by Guerrilla | EIDSCA-CR03 |
| CR04 | Assessed by Guerrilla | EIDSCA-CR04 |
| PR01 | Assessed by Guerrilla | EIDSCA-PR01 (Not Assessed in live runs) |
| PR02 | Assessed by Guerrilla | EIDSCA-PR02 (Not Assessed in live runs) |
| PR03 | Assessed by Guerrilla | EIDSCA-PR03 (Not Assessed in live runs) |
| PR05 | Assessed by Guerrilla | EIDSCA-PR05 (Not Assessed in live runs) |
| PR06 | Assessed by Guerrilla | EIDSCA-PR06 (Not Assessed in live runs) |
| ST08 | Assessed by Guerrilla | EIDSCA-ST08 (Not Assessed in live runs) |
| ST09 | Assessed by Guerrilla | EIDSCA-ST09 (Not Assessed in live runs) |
CIS Active Directory Benchmark
127 of 127 controls assessed by 139 checks. Coverage view: this table lists the controls Guerrilla maps, not the full baseline.
| Control | Status | Guerrilla checks |
|---|---|---|
| 1.1.1 | Assessed by Guerrilla | ADDOM-001 |
| 1.1.2 | Assessed by Guerrilla | ADDOM-002 |
| 1.1.3 | Assessed by Guerrilla | ADDOM-003 |
| 1.1.4 | Assessed by Guerrilla | ADDOM-006 |
| 1.2.1 | Assessed by Guerrilla | ADDOM-004 |
| 1.2.2 | Assessed by Guerrilla | ADDOM-005 |
| 1.2.3 | Assessed by Guerrilla | ADDOM-019 |
| 1.2.4 | Assessed by Guerrilla | ADDOM-020 |
| 1.3.1 | Assessed by Guerrilla | ADDOM-007 (Not Assessed in live runs) |
| 1.4.1 | Assessed by Guerrilla | ADDOM-008 |
| 1.4.2 | Assessed by Guerrilla | ADDOM-009 |
| 1.5.1 | Assessed by Guerrilla | ADDOM-010 |
| 1.5.2 | Assessed by Guerrilla | ADDOM-011 |
| 1.6.1 | Assessed by Guerrilla | ADDOM-012 |
| 2.1.1 | Assessed by Guerrilla | ADDOM-013 |
| 2.1.2 | Assessed by Guerrilla | ADDOM-014 |
| 2.2.1 | Assessed by Guerrilla | ADDOM-015 |
| 2.3.1 | Assessed by Guerrilla | ADDOM-016 |
| 2.3.2 | Assessed by Guerrilla | ADDOM-017 |
| 2.4.1 | Assessed by Guerrilla | ADDOM-018 |
| 3.1.1 | Assessed by Guerrilla | ADTRUST-001 |
| 3.1.2 | Assessed by Guerrilla | ADTRUST-002 |
| 3.1.3 | Assessed by Guerrilla | ADTRUST-003 |
| 3.1.4 | Assessed by Guerrilla | ADTRUST-008 |
| 3.1.5 | Assessed by Guerrilla | ADTRUST-011 |
| 3.2.1 | Assessed by Guerrilla | ADTRUST-004 |
| 3.2.2 | Assessed by Guerrilla | ADTRUST-005 |
| 3.2.3 | Assessed by Guerrilla | ADTRUST-006 |
| 3.2.4 | Assessed by Guerrilla | ADTRUST-010 |
| 3.3.1 | Assessed by Guerrilla | ADTRUST-007 |
| 3.4.1 | Assessed by Guerrilla | ADTRUST-009 |
| 4.1.1 | Assessed by Guerrilla | ADPRIV-001 |
| 4.1.2 | Assessed by Guerrilla | ADPRIV-002 |
| 4.1.3 | Assessed by Guerrilla | ADPRIV-003 |
| 4.1.4 | Assessed by Guerrilla | ADPRIV-004 |
| 4.1.5 | Assessed by Guerrilla | ADPRIV-005 |
| 4.1.6 | Assessed by Guerrilla | ADPRIV-006 |
| 4.1.7 | Assessed by Guerrilla | ADPRIV-007 |
| 4.1.8 | Assessed by Guerrilla | ADPRIV-008 |
| 4.2.1 | Assessed by Guerrilla | ADPRIV-009 |
| 4.3.1 | Assessed by Guerrilla | ADPRIV-010 |
| 4.3.2 | Assessed by Guerrilla | ADPRIV-011 |
| 4.3.3 | Assessed by Guerrilla | ADPRIV-012 |
| 4.3.4 | Assessed by Guerrilla | ADPRIV-013 |
| 4.3.5 | Assessed by Guerrilla | ADPRIV-014 |
| 4.4.1 | Assessed by Guerrilla | ADPRIV-015 |
| 4.5.1 | Assessed by Guerrilla | ADPRIV-016 (Not Assessed in live runs) |
| 4.5.2 | Assessed by Guerrilla | ADPRIV-017 |
| 4.6.1 | Assessed by Guerrilla | ADPRIV-018 |
| 4.6.2 | Assessed by Guerrilla | ADPRIV-019 |
| 4.6.3 | Assessed by Guerrilla | ADPRIV-025 |
| 4.7.1 | Assessed by Guerrilla | ADPRIV-020 |
| 4.7.2 | Assessed by Guerrilla | ADPRIV-021 |
| 4.8.1 | Assessed by Guerrilla | ADPRIV-022 |
| 4.8.2 | Assessed by Guerrilla | ADPRIV-023 |
| 4.9.1 | Assessed by Guerrilla | ADPRIV-024 |
| 4.10.1 | Assessed by Guerrilla | ADPRIV-026 (Not Assessed in live runs) |
| 4.10.2 | Assessed by Guerrilla | ADPRIV-027 (Not Assessed in live runs) |
| 4.11.1 | Assessed by Guerrilla | ADPRIV-028 |
| 4.12.1 | Assessed by Guerrilla | ADPRIV-029 |
| 4.12.2 | Assessed by Guerrilla | ADPRIV-030 |
| 5.1.1 | Assessed by Guerrilla | ADPWD-001 |
| 5.1.2 | Assessed by Guerrilla | ADPWD-002 |
| 5.1.3 | Assessed by Guerrilla | ADPWD-003 |
| 5.2.1 | Assessed by Guerrilla | ADPWD-004 |
| 5.2.2 | Assessed by Guerrilla | ADPWD-005 |
| 5.2.3 | Assessed by Guerrilla | ADPWD-007 |
| 5.2.4 | Assessed by Guerrilla | ADPWD-008 |
| 5.3.1 | Assessed by Guerrilla | ADPWD-006 |
| 5.3.2 | Assessed by Guerrilla | ADPWD-021 |
| 5.3.3 | Assessed by Guerrilla | ADPWD-022 |
| 5.4.1 | Assessed by Guerrilla | ADPWD-009 |
| 5.5.1 | Assessed by Guerrilla | ADPWD-010 (Not Assessed in live runs) |
| 5.5.2 | Assessed by Guerrilla | ADPWD-011 (Not Assessed in live runs) |
| 5.5.3 | Assessed by Guerrilla | ADPWD-012 (Not Assessed in live runs) |
| 5.5.4 | Assessed by Guerrilla | ADPWD-013 (Not Assessed in live runs) |
| 5.5.5 | Assessed by Guerrilla | ADPWD-014 (Not Assessed in live runs) |
| 5.5.6 | Assessed by Guerrilla | ADPWD-019 (Not Assessed in live runs) |
| 5.6.1 | Assessed by Guerrilla | ADPWD-015 |
| 5.7.1 | Assessed by Guerrilla | ADPWD-016 |
| 5.7.2 | Assessed by Guerrilla | ADPWD-017 (Not Assessed in live runs) |
| 5.7.3 | Assessed by Guerrilla | ADPWD-018 |
| 5.8.1 | Assessed by Guerrilla | ADPWD-020 |
| 6.1.1 | Assessed by Guerrilla | ADNET-001, ADTRADE-005 |
| 6.1.2 | Assessed by Guerrilla | ADNET-002 |
| 6.2.1 | Assessed by Guerrilla | ADNET-003, ADTRADE-006 |
| 6.2.2 | Assessed by Guerrilla | ADNET-004, ADTRADE-008 |
| 6.3.1 | Assessed by Guerrilla | ADNET-005, ADTRADE-007 |
| 6.3.2 | Assessed by Guerrilla | ADNET-006 |
| 6.3.3 | Assessed by Guerrilla | ADNET-007 |
| 6.3.4 | Assessed by Guerrilla | ADNET-008 |
| 6.4.1 | Assessed by Guerrilla | ADNET-009, ADTRADE-009 |
| 6.4.2 | Assessed by Guerrilla | ADNET-010 |
| 6.5.1 | Assessed by Guerrilla | ADTRADE-010 |
| 7.1.1 | Assessed by Guerrilla | ADKERB-001 |
| 7.1.2 | Assessed by Guerrilla | ADKERB-002 |
| 7.1.3 | Assessed by Guerrilla | ADKERB-011 |
| 7.2.1 | Assessed by Guerrilla | ADKERB-003 |
| 7.3.1 | Assessed by Guerrilla | ADKERB-004 |
| 7.3.2 | Assessed by Guerrilla | ADKERB-005 |
| 7.3.3 | Assessed by Guerrilla | ADKERB-006 |
| 7.3.4 | Assessed by Guerrilla | ADKERB-007 |
| 7.3.5 | Assessed by Guerrilla | ADKERB-008 |
| 7.4.1 | Assessed by Guerrilla | ADKERB-009 |
| 7.5.1 | Assessed by Guerrilla | ADKERB-010 |
| 8.1.1 | Assessed by Guerrilla | ADTIER-001 |
| 8.2.1 | Assessed by Guerrilla | ADTIER-002 |
| 8.2.2 | Assessed by Guerrilla | ADTIER-003 |
| 8.2.3 | Assessed by Guerrilla | ADTIER-004 |
| 8.2.4 | Assessed by Guerrilla | ADTIER-005 |
| 8.3.1 | Assessed by Guerrilla | ADTIER-006 |
| 8.3.2 | Assessed by Guerrilla | ADTIER-007 |
| 9.1.1 | Assessed by Guerrilla | ADLOG-001, ADSTALE-001 |
| 9.1.2 | Assessed by Guerrilla | ADLOG-004, ADSTALE-002 |
| 9.2.1 | Assessed by Guerrilla | ADLOG-002, ADSTALE-003 |
| 9.2.2 | Assessed by Guerrilla | ADLOG-003, ADSTALE-004 |
| 9.3.1 | Assessed by Guerrilla | ADLOG-005, ADSTALE-005 |
| 9.3.2 | Assessed by Guerrilla | ADSTALE-006 |
| 9.4.1 | Assessed by Guerrilla | ADLOG-006, ADSTALE-007 |
| 9.4.2 | Assessed by Guerrilla | ADLOG-007, ADSTALE-008 |
| 9.5.1 | Assessed by Guerrilla | ADSTALE-009 |
| 9.5.2 | Assessed by Guerrilla | ADSTALE-010 |
| 9.5.3 | Assessed by Guerrilla | ADSTALE-011 |
| 10.1.1 | Assessed by Guerrilla | ADTRADE-001 |
| 10.2.1 | Assessed by Guerrilla | ADTRADE-002 |
| 10.3.1 | Assessed by Guerrilla | ADTRADE-003 |
| 10.4.1 | Assessed by Guerrilla | ADTRADE-004 |
CIS Microsoft 365 Benchmark
54 of 54 controls assessed by 83 checks. Coverage view: this table lists the controls Guerrilla maps, not the full baseline.
| Control | Status | Guerrilla checks |
|---|---|---|
| 1.1.1 | Assessed by Guerrilla | EIDGOV-001 (Not Assessed in live runs), EIDGOV-002 (Not Assessed in live runs), EIDGOV-003 (Not Assessed in live runs), EIDGOV-004 (Not Assessed in live runs), EIDGOV-005 (Not Assessed in live runs), EIDPIM-001, EIDPIM-013, EIDTNT-007 |
| 1.1.2 | Assessed by Guerrilla | EIDPIM-004 |
| 1.1.3 | Assessed by Guerrilla | EIDPIM-002, EIDPIM-003, EIDPIM-010, EIDTNT-015 (Not Assessed in live runs), EIDTNT-016 (Not Assessed in live runs) |
| 1.1.4 | Assessed by Guerrilla | EIDCA-006, EIDPIM-012 |
| 1.1.16 | Assessed by Guerrilla | M365EXO-011 |
| 1.1.17 | Assessed by Guerrilla | INTUNE-007 |
| 1.3 | Assessed by Guerrilla | EIDTNT-002 |
| 1.3.1 | Assessed by Guerrilla | EIDTNT-003, EIDTNT-004, EIDTNT-005, EIDTNT-006, EIDTNT-014 (Not Assessed in live runs) |
| 2.1.1 | Assessed by Guerrilla | M365EXO-001 (Not Assessed in live runs) |
| 2.1.2 | Assessed by Guerrilla | M365EXO-002 |
| 2.1.3 | Assessed by Guerrilla | M365EXO-003 (Not Assessed in live runs) |
| 2.1.4 | Assessed by Guerrilla | M365EXO-004 (Not Assessed in live runs) |
| 2.1.5 | Assessed by Guerrilla | M365EXO-005 |
| 2.1.6 | Assessed by Guerrilla | M365EXO-007 |
| 2.1.7 | Assessed by Guerrilla | M365EXO-010 (Not Assessed in live runs) |
| 2.1.8 | Assessed by Guerrilla | M365DEF-001 (Not Assessed in live runs) |
| 2.1.9 | Assessed by Guerrilla | M365EXO-006 |
| 2.1.11 | Assessed by Guerrilla | M365EXO-026 (Not Assessed in live runs) |
| 2.1.12 | Assessed by Guerrilla | M365EXO-035 (Not Assessed in live runs) |
| 2.1.13 | Assessed by Guerrilla | M365EXO-036 (Not Assessed in live runs) |
| 3.1 | Assessed by Guerrilla | EIDTNT-011, EIDTNT-012 |
| 3.1.1 | Assessed by Guerrilla | M365AUDIT-001 (Not Assessed in live runs), M365EXO-009 (Not Assessed in live runs) |
| 3.1.2 | Assessed by Guerrilla | M365AUDIT-002 (Not Assessed in live runs) |
| 5.1.6.1 | Assessed by Guerrilla | EIDAPP-020 (Not Assessed in live runs) |
| 5.2.1 | Assessed by Guerrilla | EIDAUTH-001, EIDCA-001, EIDCA-003 |
| 5.2.2 | Assessed by Guerrilla | EIDCA-002 |
| 5.2.2.1 | Assessed by Guerrilla | EIDAUTH-002, EIDAUTH-005, EIDAUTH-017, EIDCA-007, EIDPIM-006 |
| 5.2.2.2 | Assessed by Guerrilla | EIDCA-009 |
| 5.2.2.3 | Assessed by Guerrilla | EIDAUTH-015, EIDCA-008 |
| 5.2.2.4 | Assessed by Guerrilla | EIDAUTH-004 |
| 5.2.2.6 | Assessed by Guerrilla | EIDCA-014 |
| 5.2.2.7 | Assessed by Guerrilla | EIDCA-012 |
| 5.2.2.8 | Assessed by Guerrilla | EIDCA-013 |
| 5.2.3 | Assessed by Guerrilla | EIDAUTH-009 |
| 5.2.3.2 | Assessed by Guerrilla | EIDAUTH-018 |
| 5.2.4 | Assessed by Guerrilla | EIDAUTH-011, EIDAUTH-012 (Not Assessed in live runs) |
| 5.2.5 | Assessed by Guerrilla | EIDAUTH-013, EIDAUTH-014 |
| 5.3.1 | Assessed by Guerrilla | EIDAPP-002, EIDAPP-011, EIDAPP-012, EIDAPP-013 |
| 5.3.2 | Assessed by Guerrilla | EIDAPP-010 |
| 7.2.1 | Assessed by Guerrilla | M365SPO-001 (Not Assessed in live runs) |
| 7.2.2 | Assessed by Guerrilla | M365SPO-003 (Not Assessed in live runs) |
| 7.2.3 | Assessed by Guerrilla | M365SPO-002 (Not Assessed in live runs) |
| 7.2.4 | Assessed by Guerrilla | M365SPO-004 (Not Assessed in live runs) |
| 8.1.1 | Assessed by Guerrilla | M365TEAMS-001 (Not Assessed in live runs) |
| 8.1.2 | Assessed by Guerrilla | M365TEAMS-002 (Not Assessed in live runs) |
| 8.2.1 | Assessed by Guerrilla | M365TEAMS-006 (Not Assessed in live runs) |
| 8.4.1 | Assessed by Guerrilla | M365TEAMS-007 (Not Assessed in live runs) |
| 8.5.1 | Assessed by Guerrilla | M365TEAMS-003 (Not Assessed in live runs) |
| 8.5.2 | Assessed by Guerrilla | M365TEAMS-004 (Not Assessed in live runs) |
| 8.5.5 | Assessed by Guerrilla | M365TEAMS-005 (Not Assessed in live runs) |
| 8.6.1 | Assessed by Guerrilla | M365TEAMS-007 (Not Assessed in live runs) |
| 9.1 | Assessed by Guerrilla | M365PP-001 (Not Assessed in live runs) |
| 9.2 | Assessed by Guerrilla | M365PP-002 (Not Assessed in live runs) |
| 9.3 | Assessed by Guerrilla | M365PP-003 (Not Assessed in live runs) |
NIST SP 800-53
110 of 110 controls assessed by 590 checks. Coverage view: this table lists the controls Guerrilla maps, not the full baseline.
| Control | Status | Guerrilla checks |
|---|---|---|
| AC-2 | Assessed by Guerrilla | ADMIN-005, ADMIN-007, ADPRIV-009, ADPRIV-010, ADPRIV-011, ADPRIV-012, ADPRIV-018, ADPRIV-019, ADPRIV-025, ADPWD-002, ADPWD-003, ADSTALE-007, ADSTALE-008, ADTRADE-008, AIAGENT-004 (Not Assessed in live runs), AUTH-018 (Not Assessed in live runs), AZIAM-001 (Not Assessed in live runs), AZIAM-008 (Not Assessed in live runs), EIDCA-002, EIDFED-006 (Not Assessed in live runs), EIDFED-012, EIDGOV-001 (Not Assessed in live runs), EIDGOV-003 (Not Assessed in live runs), EIDGOV-004 (Not Assessed in live runs), EIDPIM-001, EIDPIM-002, EIDTNT-007, EIDTNT-009, EIDTNT-015 (Not Assessed in live runs), EIDTNT-016 (Not Assessed in live runs), GROUP-002 (Not Assessed in live runs), GROUP-004 (Not Assessed in live runs), GWS-K12-007 (Not Assessed in live runs), GWS-K12-009 (Not Assessed in live runs), GWS-K12-010 (Not Assessed in live runs) |
| AC-2(1) | Assessed by Guerrilla | EIDGOV-001 (Not Assessed in live runs) |
| AC-2(2) | Assessed by Guerrilla | ADPRIV-002, EIDCA-006, EIDPIM-012 |
| AC-2(3) | Assessed by Guerrilla | ADMIN-004, ADMIN-006, ADPRIV-018, ADPRIV-019, ADSTALE-001, ADSTALE-002, ADSTALE-003, AUTH-013, EIDAPP-009 (Not Assessed in live runs), EIDGOV-002 (Not Assessed in live runs), EIDGOV-003 (Not Assessed in live runs), EIDPIM-003, EIDPIM-008, EIDPIM-009 (Not Assessed in live runs), EIDTNT-016 (Not Assessed in live runs), M365SPO-002 (Not Assessed in live runs), OAUTH-009 |
| AC-2(4) | Assessed by Guerrilla | ADMIN-004, AUTH-010, AUTH-013, EIDPIM-010 |
| AC-2(7) | Assessed by Guerrilla | ADACL-015, ADMIN-001, ADMIN-002, ADMIN-013, ADPRIV-001, OAUTH-008 |
| AC-2(11) | Assessed by Guerrilla | EIDCA-010, EIDCA-011 |
| AC-3 | Assessed by Guerrilla | ADACL-002, ADACL-003, ADACL-004, ADACL-005, ADACL-011, ADACL-012, ADCS-006, ADCS-007, ADCS-008, ADDOM-018, ADGPO-007, ADGPO-009, ADGPO-011, ADMIN-003, ADMIN-008, ADMIN-009, ADMIN-010, ADMIN-012, ADMIN-014 (Not Assessed in live runs), ADMIN-015 (Not Assessed in live runs), ADMIN-017 (Not Assessed in live runs), ADMIN-018 (Not Assessed in live runs), ADMIN-020 (Not Assessed in live runs), ADPRIV-020, ADPRIV-021, ADPRIV-026 (Not Assessed in live runs), ADPRIV-027 (Not Assessed in live runs), ADPRIV-028, ADSCRIPT-001, ADSCRIPT-002, ADSCRIPT-007, ADSCRIPT-010, ADTIER-006, ADTRADE-007, ADTRUST-006, AIAGENT-001 (Not Assessed in live runs), AIAGENT-002 (Not Assessed in live runs), AIAGENT-004 (Not Assessed in live runs), COLLAB-001, COLLAB-002, COLLAB-003, COLLAB-006, COLLAB-008, COLLAB-012, COLLAB-015 (Not Assessed in live runs), DRIVE-001, DRIVE-002, DRIVE-003, DRIVE-005, DRIVE-006, DRIVE-007, DRIVE-009, DRIVE-011, DRIVE-014 (Not Assessed in live runs), DRIVE-016 (Not Assessed in live runs), DRIVE-017 (Not Assessed in live runs), EIDAPP-020 (Not Assessed in live runs), EIDCA-002, EIDGOV-004 (Not Assessed in live runs), EIDGOV-005 (Not Assessed in live runs), EIDTNT-015 (Not Assessed in live runs), EMAIL-010, EMAIL-025 (Not Assessed in live runs), EMAIL-028 (Not Assessed in live runs), GROUP-001 (Not Assessed in live runs), GROUP-002 (Not Assessed in live runs), GROUP-005 (Not Assessed in live runs), GTRADE-002 (Not Assessed in live runs), GTRADE-003 (Not Assessed in live runs), GWS-CLASS-001, GWS-CLASS-002, GWS-CLASS-003, GWS-CLASS-005, GWS-GEMINI-001, GWS-GEMINI-005 (Not Assessed in live runs), GWS-K12-002 (Not Assessed in live runs), GWS-K12-003 (Not Assessed in live runs), INTUNE-023 (Not Assessed in live runs), LOG-006, M365SPO-003 (Not Assessed in live runs), OAUTH-001, OAUTH-003, OAUTH-006, OAUTH-010 |
| AC-3(7) | Assessed by Guerrilla | ADACL-007 |
| AC-4 | Assessed by Guerrilla | ADMIN-010, ADMIN-012, ADMIN-016, ADMIN-019 (Not Assessed in live runs), ADTRUST-002, ADTRUST-003, ADTRUST-004, ADTRUST-006, COLLAB-004, COLLAB-006, COLLAB-009, COLLAB-013 (Not Assessed in live runs), COLLAB-017 (Not Assessed in live runs), DRIVE-001, DRIVE-006, DRIVE-014 (Not Assessed in live runs), EMAIL-009, EMAIL-014, EMAIL-018, EMAIL-019, EMAIL-020, EMAIL-022, EMAIL-023 (Not Assessed in live runs), EMAIL-027 (Not Assessed in live runs), EMAIL-030 (Not Assessed in live runs), GWS-CLASS-002, GWS-CLASS-004, GWS-GEMINI-005 (Not Assessed in live runs), GWS-K12-002 (Not Assessed in live runs), GWS-K12-006 (Not Assessed in live runs), LOG-004, M365EXO-007, M365EXO-008 (Not Assessed in live runs), M365EXO-012 (Not Assessed in live runs), M365EXO-013 (Not Assessed in live runs), M365EXO-021 (Not Assessed in live runs), M365EXO-022 (Not Assessed in live runs), M365EXO-050 (Not Assessed in live runs), M365PP-002 (Not Assessed in live runs), M365SPO-005 (Not Assessed in live runs) |
| AC-5 | Assessed by Guerrilla | ADCS-010 (Not Assessed in live runs), ADPATH-001, ADPATH-002, EIDPIM-013, GWS-K12-005 (Not Assessed in live runs) |
| AC-6 | Assessed by Guerrilla | ADACL-001, ADACL-002, ADACL-003, ADACL-004, ADACL-005, ADACL-006, ADACL-007, ADACL-008, ADACL-009, ADACL-010, ADACL-011, ADACL-012, ADACL-013, ADACL-014, ADACL-015, ADACL-016, ADCS-002, ADCS-003, ADCS-004, ADCS-005, ADCS-006, ADCS-007, ADCS-008, ADCS-009 (Not Assessed in live runs), ADCS-010 (Not Assessed in live runs), ADCS-012, ADCS-014 (Not Assessed in live runs), ADCS-016, ADDOM-020, ADGPO-015, ADGPO-017, ADGPO-023, ADKERB-004, ADKERB-005, ADKERB-006, ADKERB-007, ADKERB-008, ADMIN-011, ADMIN-014 (Not Assessed in live runs), ADMIN-017 (Not Assessed in live runs), ADMIN-020 (Not Assessed in live runs), ADMIN-021 (Not Assessed in live runs), ADPATH-001, ADPATH-002, ADPRIV-020, ADPRIV-021, ADPRIV-029, ADPRIV-030, ADPWD-016, ADSCRIPT-001, ADSCRIPT-002, ADSCRIPT-007, ADSTALE-003, ADTIER-001, ADTIER-002, ADTIER-003, ADTIER-004, ADTIER-005, ADTIER-006, ADTIER-007, ADTRADE-001, ADTRADE-003, ADTRADE-004, ADTRADE-005, ADTRADE-006, ADTRADE-007, ADTRADE-008, ADTRADE-009, ADTRADE-010, ADTRUST-004, ADTRUST-005, ADTRUST-006, AIAGENT-001 (Not Assessed in live runs), AIAGENT-004 (Not Assessed in live runs), AZIAM-001 (Not Assessed in live runs), AZIAM-003 (Not Assessed in live runs), AZIAM-004 (Not Assessed in live runs), AZIAM-009 (Not Assessed in live runs), DRIVE-002, DRIVE-004, DRIVE-011, DRIVE-017 (Not Assessed in live runs), EIDAPP-002, EIDAPP-005, EIDAPP-007 (Not Assessed in live runs), EIDAPP-011, EIDAPP-012, EIDAPP-013, EIDAPP-015, EIDAPP-020 (Not Assessed in live runs), EIDGOV-001 (Not Assessed in live runs), EIDGOV-004 (Not Assessed in live runs), EIDPIM-002, EIDTNT-002, EIDTNT-015 (Not Assessed in live runs), EMAIL-025 (Not Assessed in live runs), GROUP-004 (Not Assessed in live runs), GTRADE-001, GTRADE-003 (Not Assessed in live runs), GTRADE-004, GTRADE-005, GTRADE-006, GWS-CLASS-005, GWS-CLASS-006, GWS-K12-004 (Not Assessed in live runs), GWS-K12-005 (Not Assessed in live runs), INTUNE-023 (Not Assessed in live runs), OAUTH-003, OAUTH-010 |
| AC-6(1) | Assessed by Guerrilla | ADACL-002, ADACL-003, ADACL-004, ADACL-005, ADACL-007, ADCS-010 (Not Assessed in live runs), ADGPO-017, ADMIN-001, ADMIN-002, ADMIN-003, ADMIN-013, ADPRIV-001, ADPRIV-002, ADPRIV-003, ADPRIV-004, ADPRIV-005, ADPRIV-006, ADPRIV-007, ADPRIV-008, ADPRIV-009, ADPRIV-024, ADPRIV-025, ADPRIV-026 (Not Assessed in live runs), ADPRIV-027 (Not Assessed in live runs), ADPRIV-028, ADTRUST-005, AZIAM-002 (Not Assessed in live runs), DRIVE-005, EIDAPP-002, EIDAPP-006, EIDCA-004, EIDCA-005, EIDPIM-003, EIDPIM-010, EMAIL-010, OAUTH-008 |
| AC-6(2) | Assessed by Guerrilla | EIDPIM-013 |
| AC-6(3) | Assessed by Guerrilla | ADACL-008 |
| AC-6(5) | Assessed by Guerrilla | ADACL-001, ADACL-010, ADACL-015, ADPRIV-001, ADPRIV-002, ADPRIV-003, ADPRIV-004, ADPRIV-005, ADPRIV-006, ADPRIV-008, ADPRIV-024, AUTH-017, EIDAPP-014, EIDCA-005, EIDPIM-001, EIDPIM-004, EIDPIM-005, GTRADE-001, GTRADE-004 |
| AC-6(7) | Assessed by Guerrilla | EIDGOV-002 (Not Assessed in live runs), GTRADE-005 |
| AC-7 | Assessed by Guerrilla | ADPWD-006, ADPWD-021, ADPWD-022, DEVICE-003, EIDFED-010 |
| AC-11 | Assessed by Guerrilla | DEVICE-003 |
| AC-12 | Assessed by Guerrilla | ADKERB-010, AUTH-006, EIDCA-014 |
| AC-14 | Assessed by Guerrilla | ADDOM-018, AIAGENT-002 (Not Assessed in live runs), COLLAB-015 (Not Assessed in live runs), EIDTNT-003, EIDTNT-004, EMAIL-026 (Not Assessed in live runs), M365TEAMS-002 (Not Assessed in live runs), M365TEAMS-004 (Not Assessed in live runs) |
| AC-17 | Assessed by Guerrilla | ADPRIV-027 (Not Assessed in live runs), COLLAB-002, EMAIL-026 (Not Assessed in live runs), OAUTH-006 |
| AC-17(2) | Assessed by Guerrilla | EIDAUTH-015, EIDCA-008, EIDCA-009, EMAIL-011 |
| AC-19 | Assessed by Guerrilla | DEVICE-001, DEVICE-005, DEVICE-006, DEVICE-010, DRIVE-013, EIDCA-018, INTUNE-011, INTUNE-012, INTUNE-022 (Not Assessed in live runs) |
| AC-19(4) | Assessed by Guerrilla | DEVICE-002 |
| AC-20 | Assessed by Guerrilla | ADTRUST-001, ADTRUST-002, ADTRUST-003, ADTRUST-007, ADTRUST-008, ADTRUST-009, ADTRUST-011, DRIVE-009, EIDAPP-010, EIDTNT-005, EIDTNT-006, GWS-K12-004 (Not Assessed in live runs), M365PP-003 (Not Assessed in live runs), M365TEAMS-001 (Not Assessed in live runs), M365TEAMS-003 (Not Assessed in live runs), M365TEAMS-006 (Not Assessed in live runs) |
| AC-21 | Assessed by Guerrilla | M365EXO-021 (Not Assessed in live runs), M365EXO-022 (Not Assessed in live runs), M365SPO-001 (Not Assessed in live runs), M365TEAMS-008 (Not Assessed in live runs) |
| AC-22 | Assessed by Guerrilla | ADMIN-008, ADMIN-009, COLLAB-008, COLLAB-010, COLLAB-011, DRIVE-003, DRIVE-015 (Not Assessed in live runs), EIDGOV-005 (Not Assessed in live runs), GROUP-001 (Not Assessed in live runs), GROUP-005 (Not Assessed in live runs), GROUP-006 (Not Assessed in live runs), GTRADE-002 (Not Assessed in live runs), GWS-CLASS-001 |
| AT-2 | Assessed by Guerrilla | EMAIL-014 |
| AU-2 | Assessed by Guerrilla | ADCS-018 (Not Assessed in live runs), ADGPO-018, ADGPO-021, ADLOG-001, ADLOG-002, ADLOG-003, ADLOG-004, ADLOG-007, EIDTNT-011, M365AUDIT-001 (Not Assessed in live runs), M365EXO-009 (Not Assessed in live runs), M365EXO-037 (Not Assessed in live runs), M365EXO-043 (Not Assessed in live runs), M365EXO-046 (Not Assessed in live runs), M365EXO-047 (Not Assessed in live runs), M365TEAMS-005 (Not Assessed in live runs) |
| AU-3 | Assessed by Guerrilla | ADCS-018 (Not Assessed in live runs), ADGPO-018, ADGPO-021, ADLOG-001, ADLOG-004, COLLAB-005, EIDPIM-011 (Not Assessed in live runs), EIDTNT-011, GWS-GEMINI-003 (Not Assessed in live runs), M365AUDIT-001 (Not Assessed in live runs), M365EXO-009 (Not Assessed in live runs), M365EXO-037 (Not Assessed in live runs), M365EXO-046 (Not Assessed in live runs), M365EXO-047 (Not Assessed in live runs) |
| AU-4 | Assessed by Guerrilla | ADLOG-006, LOG-001 |
| AU-5 | Assessed by Guerrilla | EIDPIM-014 (Not Assessed in live runs), EIDTNT-013, LOG-005, M365DEF-002 (Not Assessed in live runs) |
| AU-6 | Assessed by Guerrilla | ADACL-001, ADLOG-006, ADPRIV-020, ADTRADE-006, EIDAPP-017 (Not Assessed in live runs), EIDCA-017 (Not Assessed in live runs), EIDPIM-011 (Not Assessed in live runs), EIDTNT-011, EMAIL-008, EMAIL-022, GROUP-006 (Not Assessed in live runs), INTUNE-021 (Not Assessed in live runs), LOG-003, M365AUDIT-003 (Not Assessed in live runs), M365EXO-019 (Not Assessed in live runs), M365EXO-044, M365EXO-045 (Not Assessed in live runs) |
| AU-9 | Assessed by Guerrilla | ADMIN-014 (Not Assessed in live runs), LOG-006 |
| AU-11 | Assessed by Guerrilla | COLLAB-005, COLLAB-014 (Not Assessed in live runs), EIDTNT-012, GWS-GEMINI-003 (Not Assessed in live runs), GWS-GEMINI-004 (Not Assessed in live runs), LOG-001, M365AUDIT-002 (Not Assessed in live runs), M365EXO-048 (Not Assessed in live runs) |
| AU-12 | Assessed by Guerrilla | ADACL-004, ADACL-010, ADCS-018 (Not Assessed in live runs), ADGPO-018, ADGPO-021, ADLOG-001, ADTRADE-002, COLLAB-014 (Not Assessed in live runs), M365EXO-046 (Not Assessed in live runs), M365EXO-047 (Not Assessed in live runs) |
| AU-14 | Assessed by Guerrilla | COLLAB-001 |
| CA-3 | Assessed by Guerrilla | ADTRUST-001, ADTRUST-008 |
| CA-8 | Assessed by Guerrilla | ADACL-016, EIDCA-015 |
| CM-2 | Assessed by Guerrilla | ADDOM-003, ADGPO-002, ADGPO-003, ADGPO-004, ADGPO-005, ADSTALE-009, ADSTALE-011, EIDCA-016, EIDTNT-001, GWS-K12-008 (Not Assessed in live runs), INTUNE-014 |
| CM-3 | Assessed by Guerrilla | ADGPO-005, ADGPO-006, ADGPO-008, ADGPO-010, ADGPO-024, ADSCRIPT-003, ADSCRIPT-009, ADSCRIPT-011, EIDAPP-018 (Not Assessed in live runs) |
| CM-5 | Assessed by Guerrilla | ADACL-008, ADACL-013, ADACL-014, ADGPO-013, ADGPO-014, ADGPO-015, ADSCRIPT-001, ADSCRIPT-002, ADSCRIPT-007, ADSCRIPT-008, ADSCRIPT-010, INTUNE-023 (Not Assessed in live runs) |
| CM-6 | Assessed by Guerrilla | ADACL-009, ADACL-012, ADACL-014, ADCS-002, ADCS-003, ADCS-004, ADCS-005, ADCS-009 (Not Assessed in live runs), ADCS-012, ADCS-014 (Not Assessed in live runs), ADCS-015, ADCS-016, ADCS-017, ADDOM-001, ADDOM-002, ADDOM-003, ADDOM-005, ADDOM-010, ADDOM-011, ADGPO-004, ADGPO-006, ADGPO-007, ADGPO-008, ADGPO-009, ADGPO-010, ADGPO-011, ADGPO-013, ADGPO-015, ADGPO-016, ADGPO-017, ADGPO-019, ADGPO-020, ADGPO-023, ADGPO-024, ADMIN-007, ADSCRIPT-005, ADSTALE-005, ADTRUST-009, AZIAM-007 (Not Assessed in live runs), AZIAM-010 (Not Assessed in live runs), DEVICE-001, DEVICE-007, DEVICE-009, DRIVE-016 (Not Assessed in live runs), EIDAPP-019, EIDCA-009, EIDCA-016, EIDFED-005, EIDFED-009, GWS-K12-001 (Not Assessed in live runs), INTUNE-002, INTUNE-003, INTUNE-005, INTUNE-017, INTUNE-018, M365SPO-004 (Not Assessed in live runs) |
| CM-6(1) | Assessed by Guerrilla | ADGPO-011, ADGPO-016 |
| CM-7 | Assessed by Guerrilla | ADDOM-019, ADGPO-002, ADGPO-003, ADGPO-020, ADMIN-011, ADMIN-017 (Not Assessed in live runs), ADMIN-021 (Not Assessed in live runs), ADMIN-022 (Not Assessed in live runs), ADNET-009, ADNET-010, ADPRIV-007, COLLAB-007, COLLAB-018 (Not Assessed in live runs), DEVICE-007, DEVICE-008, DRIVE-004, DRIVE-012, EMAIL-011, EMAIL-028 (Not Assessed in live runs), GWS-CLASS-003, GWS-CLASS-004, GWS-CLASS-006, GWS-GEMINI-001, GWS-GEMINI-002 (Not Assessed in live runs), GWS-K12-003 (Not Assessed in live runs), GWS-K12-008 (Not Assessed in live runs), GWS-SITES-001, INTUNE-009, M365PP-001 (Not Assessed in live runs), M365TEAMS-007 (Not Assessed in live runs), OAUTH-001, OAUTH-005, OAUTH-007 |
| CM-7(1) | Assessed by Guerrilla | ADDOM-019 |
| CM-7(2) | Assessed by Guerrilla | ADGPO-022 |
| CM-7(5) | Assessed by Guerrilla | ADGPO-014, ADGPO-022 |
| CM-8 | Assessed by Guerrilla | ADCS-001 (Not Assessed in live runs), ADCS-019, ADDOM-004, ADDOM-006, ADGPO-001, ADKERB-011, ADMIN-005, ADSCRIPT-003, ADSTALE-010, AIAGENT-003 (Not Assessed in live runs), DEVICE-011, EIDAPP-001, EIDAPP-016, EIDFED-001, EIDTNT-008, EIDTNT-010, INTUNE-001, INTUNE-004, INTUNE-020, OAUTH-002 |
| CM-8(1) | Assessed by Guerrilla | ADCS-001 (Not Assessed in live runs), ADCS-019, ADDOM-004, ADGPO-001, ADSCRIPT-003 |
| CM-11 | Assessed by Guerrilla | COLLAB-007, DEVICE-008, DRIVE-012, INTUNE-019, OAUTH-002, OAUTH-004, OAUTH-007 |
| CP-2 | Assessed by Guerrilla | ADDOM-006, EIDPIM-012 |
| CP-9 | Assessed by Guerrilla | ADDOM-008, ADDOM-009 |
| CP-10 | Assessed by Guerrilla | ADDOM-007 (Not Assessed in live runs), ADDOM-008, ADDOM-009 |
| IA-2 | Assessed by Guerrilla | ADPWD-010 (Not Assessed in live runs), ADTRUST-007, AIAGENT-002 (Not Assessed in live runs), COLLAB-003, EIDAUTH-001, EIDAUTH-015, EIDAUTH-016, EIDCA-008, EIDFED-008 (Not Assessed in live runs), EIDTNT-007, EMAIL-026 (Not Assessed in live runs), GTRADE-001, M365EXO-011, M365EXO-020 (Not Assessed in live runs) |
| IA-2(1) | Assessed by Guerrilla | ADPRIV-015, AUTH-001, AUTH-002, AUTH-003, AUTH-012, AUTH-014, AUTH-015, AUTH-016, EIDAUTH-002, EIDAUTH-003, EIDAUTH-004, EIDAUTH-005, EIDAUTH-017, EIDAUTH-018, EIDCA-007, EIDCA-018, EIDPIM-006, EIDPIM-007 |
| IA-2(2) | Assessed by Guerrilla | ADPRIV-015, AUTH-001, EIDAUTH-002, EIDAUTH-005, EIDAUTH-018, EIDCA-007, EIDPIM-006 |
| IA-2(6) | Assessed by Guerrilla | AUTH-007, EIDAUTH-006, EIDAUTH-007 (Not Assessed in live runs), EIDAUTH-008, EIDAUTH-009 |
| IA-2(11) | Assessed by Guerrilla | AUTH-012 |
| IA-2(12) | Assessed by Guerrilla | AUTH-003 |
| IA-2(13) | Assessed by Guerrilla | AUTH-011, EIDCA-012, EIDCA-013 |
| IA-3 | Assessed by Guerrilla | DEVICE-002, DEVICE-010, EIDFED-011 (Not Assessed in live runs), INTUNE-013 |
| IA-4 | Assessed by Guerrilla | AUTH-017 |
| IA-5 | Assessed by Guerrilla | ADTIER-001, ADTRADE-001, ADTRADE-005, ADTRADE-006, ADTRADE-009, ADTRADE-010, AUTH-018 (Not Assessed in live runs), EIDAPP-003, EIDAPP-004, EIDAPP-005, EIDAUTH-016, EIDCA-018, EIDFED-007 (Not Assessed in live runs), EIDTNT-014 (Not Assessed in live runs), GTRADE-006, GWS-K12-010 (Not Assessed in live runs) |
| IA-5(1) | Assessed by Guerrilla | ADACL-006, ADDOM-020, ADGPO-012, ADGPO-023, ADKERB-001, ADKERB-002, ADKERB-003, ADPRIV-010, ADPRIV-011, ADPRIV-013, ADPRIV-016 (Not Assessed in live runs), ADPRIV-017, ADPRIV-022, ADPWD-001, ADPWD-002, ADPWD-003, ADPWD-004, ADPWD-005, ADPWD-007, ADPWD-008, ADPWD-009, ADPWD-010 (Not Assessed in live runs), ADPWD-011 (Not Assessed in live runs), ADPWD-012 (Not Assessed in live runs), ADPWD-013 (Not Assessed in live runs), ADPWD-014 (Not Assessed in live runs), ADPWD-015, ADPWD-016, ADPWD-017 (Not Assessed in live runs), ADPWD-018, ADPWD-019 (Not Assessed in live runs), ADSCRIPT-004, ADSCRIPT-006, ADSTALE-004, ADTRUST-010, AUTH-004, AUTH-005, AUTH-009, AUTH-010, EIDAPP-008, EIDAUTH-010, EIDAUTH-011, EIDAUTH-012 (Not Assessed in live runs), EIDAUTH-013, EIDAUTH-014, EIDTNT-014 (Not Assessed in live runs), OAUTH-009 |
| IA-5(2) | Assessed by Guerrilla | ADCS-001 (Not Assessed in live runs), ADCS-002, ADCS-003, ADCS-004, ADCS-005, ADCS-006, ADCS-008, ADCS-009 (Not Assessed in live runs), ADCS-011 (Not Assessed in live runs), ADCS-012, ADCS-013 (Not Assessed in live runs), ADCS-014 (Not Assessed in live runs), ADCS-015, ADCS-016, ADCS-017, ADCS-019, ADDOM-016, ADDOM-017, ADPRIV-012, ADPRIV-029, ADPRIV-030, AUTH-008, EIDFED-002, EIDFED-003 |
| IA-5(7) | Assessed by Guerrilla | ADSCRIPT-004, ADSCRIPT-006 |
| IA-8 | Assessed by Guerrilla | AUTH-007, EIDPIM-004 |
| IA-8(4) | Assessed by Guerrilla | EIDFED-004, EIDFED-009 |
| IA-9 | Assessed by Guerrilla | EMAIL-017 |
| IR-4 | Assessed by Guerrilla | M365EXO-044, M365EXO-045 (Not Assessed in live runs) |
| IR-5 | Assessed by Guerrilla | LOG-002 |
| IR-6 | Assessed by Guerrilla | EIDCA-017 (Not Assessed in live runs) |
| MP-5 | Assessed by Guerrilla | DEVICE-004, DRIVE-007, LOG-004 |
| MP-6 | Assessed by Guerrilla | ADTRADE-003, INTUNE-021 (Not Assessed in live runs), M365EXO-025 (Not Assessed in live runs) |
| MP-7 | Assessed by Guerrilla | DRIVE-008 |
| PL-2 | Assessed by Guerrilla | ADTRUST-011 |
| PM-5 | Assessed by Guerrilla | DEVICE-011 |
| PM-10 | Assessed by Guerrilla | EIDGOV-001 (Not Assessed in live runs), EIDGOV-002 (Not Assessed in live runs), GROUP-004 (Not Assessed in live runs) |
| PS-7 | Assessed by Guerrilla | EIDTNT-015 (Not Assessed in live runs), EIDTNT-016 (Not Assessed in live runs) |
| RA-3 | Assessed by Guerrilla | OAUTH-004 |
| RA-5 | Assessed by Guerrilla | ADACL-016, EIDAUTH-007 (Not Assessed in live runs) |
| SA-9 | Assessed by Guerrilla | ADMIN-015 (Not Assessed in live runs), ADMIN-019 (Not Assessed in live runs), ADTRUST-008, AIAGENT-003 (Not Assessed in live runs), EIDGOV-004 (Not Assessed in live runs), EIDGOV-005 (Not Assessed in live runs), EIDTNT-015 (Not Assessed in live runs), EIDTNT-016 (Not Assessed in live runs), GWS-GEMINI-002 (Not Assessed in live runs) |
| SA-22 | Assessed by Guerrilla | ADDOM-005, ADMIN-022 (Not Assessed in live runs) |
| SC-7 | Assessed by Guerrilla | ADDOM-010, ADGPO-019, ADMIN-016, ADNET-007, ADSCRIPT-008, ADSCRIPT-010, AIAGENT-001 (Not Assessed in live runs), AZIAM-006 (Not Assessed in live runs), COLLAB-004, COLLAB-013 (Not Assessed in live runs), COLLAB-015 (Not Assessed in live runs), COLLAB-017 (Not Assessed in live runs), DRIVE-010, DRIVE-014 (Not Assessed in live runs), EIDCA-010, EMAIL-001, EMAIL-003, EMAIL-007, EMAIL-009, EMAIL-018, EMAIL-019, EMAIL-023 (Not Assessed in live runs), EMAIL-027 (Not Assessed in live runs), EMAIL-029 (Not Assessed in live runs), EMAIL-030 (Not Assessed in live runs), GROUP-001 (Not Assessed in live runs), GROUP-002 (Not Assessed in live runs), GROUP-003 (Not Assessed in live runs), INTUNE-016, M365EXO-024 (Not Assessed in live runs), M365EXO-025 (Not Assessed in live runs), M365EXO-035 (Not Assessed in live runs), M365EXO-036 (Not Assessed in live runs), M365EXO-049 (Not Assessed in live runs), M365EXO-050 (Not Assessed in live runs), M365SPO-005 (Not Assessed in live runs) |
| SC-7(5) | Assessed by Guerrilla | ADGPO-019, EMAIL-006 |
| SC-8 | Assessed by Guerrilla | ADCS-011 (Not Assessed in live runs), ADCS-013 (Not Assessed in live runs), ADDOM-013, ADDOM-014, ADDOM-015, ADDOM-016, ADDOM-017, ADNET-001, ADNET-002, ADNET-003, ADNET-004, ADNET-005, ADNET-006, ADNET-007, ADNET-008, ADTRUST-007, AZIAM-005 (Not Assessed in live runs), EMAIL-002, EMAIL-004, EMAIL-005 |
| SC-8(1) | Assessed by Guerrilla | ADCS-013 (Not Assessed in live runs), ADDOM-013, ADDOM-014, ADDOM-015, EMAIL-004, EMAIL-005, EMAIL-021 |
| SC-10 | Assessed by Guerrilla | EIDCA-014 |
| SC-12 | Assessed by Guerrilla | ADKERB-002, ADKERB-009, ADPRIV-014, ADPRIV-022, ADPRIV-023, ADTRUST-010, AZIAM-004 (Not Assessed in live runs), EMAIL-021 |
| SC-13 | Assessed by Guerrilla | ADKERB-009, ADPRIV-014, ADPRIV-023 |
| SC-20 | Assessed by Guerrilla | ADDOM-012 |
| SC-21 | Assessed by Guerrilla | ADDOM-012 |
| SC-23 | Assessed by Guerrilla | ADCS-011 (Not Assessed in live runs), ADDOM-013, ADDOM-014, ADNET-001, ADNET-002, ADNET-003, ADNET-004, AUTH-006, EMAIL-005 |
| SC-28 | Assessed by Guerrilla | ADGPO-012, ADMIN-018 (Not Assessed in live runs), ADPRIV-013, ADPWD-018, ADPWD-020, ADSCRIPT-004, ADSCRIPT-006, AZIAM-005 (Not Assessed in live runs), COLLAB-016 (Not Assessed in live runs), COLLAB-019 (Not Assessed in live runs), DEVICE-004, DRIVE-008, DRIVE-013, EMAIL-020, INTUNE-007, INTUNE-015 |
| SC-28(1) | Assessed by Guerrilla | ADPWD-020 |
| SC-36 | Assessed by Guerrilla | ADDOM-007 (Not Assessed in live runs), ADDOM-011 |
| SC-44 | Assessed by Guerrilla | EMAIL-024 (Not Assessed in live runs) |
| SI-2 | Assessed by Guerrilla | ADDOM-001, ADDOM-002, ADDOM-005, ADSTALE-005, ADSTALE-006, DEVICE-009, EIDFED-013, INTUNE-006, INTUNE-017 |
| SI-2(2) | Assessed by Guerrilla | EIDFED-013 |
| SI-3 | Assessed by Guerrilla | ADLOG-005, ADSCRIPT-005, ADSCRIPT-011, EMAIL-012, EMAIL-013, EMAIL-015, EMAIL-016, EMAIL-024 (Not Assessed in live runs), EMAIL-031 (Not Assessed in live runs), INTUNE-008, M365DEF-001 (Not Assessed in live runs), M365EXO-003 (Not Assessed in live runs), M365EXO-004 (Not Assessed in live runs), M365EXO-005, M365EXO-026 (Not Assessed in live runs), M365EXO-027 (Not Assessed in live runs), M365EXO-028 (Not Assessed in live runs), M365EXO-029, M365EXO-030, M365EXO-031 (Not Assessed in live runs), M365EXO-041 (Not Assessed in live runs), M365EXO-042 (Not Assessed in live runs), M365EXO-049 (Not Assessed in live runs) |
| SI-4 | Assessed by Guerrilla | ADGPO-021, ADLOG-002, ADLOG-003, ADLOG-005, ADLOG-007, ADTRADE-002, DEVICE-005, DRIVE-010, EIDAPP-018 (Not Assessed in live runs), EIDCA-017 (Not Assessed in live runs), EIDPIM-014 (Not Assessed in live runs), EMAIL-008, EMAIL-018, EMAIL-019, EMAIL-022, INTUNE-010, LOG-002, LOG-005, M365DEF-002 (Not Assessed in live runs), M365EXO-024 (Not Assessed in live runs), M365EXO-025 (Not Assessed in live runs), M365EXO-043 (Not Assessed in live runs), M365EXO-044, M365EXO-045 (Not Assessed in live runs), M365EXO-050 (Not Assessed in live runs) |
| SI-4(5) | Assessed by Guerrilla | LOG-003 |
| SI-5 | Assessed by Guerrilla | M365DEF-003 (Not Assessed in live runs) |
| SI-7 | Assessed by Guerrilla | ADGPO-010, ADGPO-013, ADGPO-014, ADGPO-020, ADGPO-022, ADSCRIPT-005, ADSCRIPT-008, ADSCRIPT-009, ADSCRIPT-011, DEVICE-006, OAUTH-005 |
| SI-8 | Assessed by Guerrilla | EMAIL-001, EMAIL-002, EMAIL-003, EMAIL-006, EMAIL-007, EMAIL-012, EMAIL-013, EMAIL-015, EMAIL-016, EMAIL-017, EMAIL-023 (Not Assessed in live runs), EMAIL-029 (Not Assessed in live runs), EMAIL-031 (Not Assessed in live runs), GROUP-003 (Not Assessed in live runs), M365DEF-001 (Not Assessed in live runs), M365EXO-001 (Not Assessed in live runs), M365EXO-002, M365EXO-006, M365EXO-010 (Not Assessed in live runs), M365EXO-014 (Not Assessed in live runs), M365EXO-015 (Not Assessed in live runs), M365EXO-016 (Not Assessed in live runs), M365EXO-017 (Not Assessed in live runs), M365EXO-018 (Not Assessed in live runs), M365EXO-019 (Not Assessed in live runs), M365EXO-023 (Not Assessed in live runs), M365EXO-032 (Not Assessed in live runs), M365EXO-033 (Not Assessed in live runs), M365EXO-034 (Not Assessed in live runs), M365EXO-035 (Not Assessed in live runs), M365EXO-036 (Not Assessed in live runs), M365EXO-038, M365EXO-039 (Not Assessed in live runs), M365EXO-040 (Not Assessed in live runs) |
| SI-10 | Assessed by Guerrilla | DRIVE-015 (Not Assessed in live runs) |
| SI-11 | Assessed by Guerrilla | COLLAB-009 |
| SI-12 | Assessed by Guerrilla | COLLAB-016 (Not Assessed in live runs), COLLAB-019 (Not Assessed in live runs) |