TITAN AI - GOVERNMENT AGENTS - LIVE PROOF

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

0 Conditional Access policies, 0 privileged accounts; role-based access enforced by Entra

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 40 min (~$97 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.1.2; DoD Assessment Methodology weight 5

directory audit logs: None, sign-in logs: None

Proposed fix
Enable unified audit logging and Entra diagnostic settings to a Log Analytics / Sentinel workspace.
Effort: 10 min (~$24 labour) · Expected annual loss: $27,183 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b

Citation: NIST SP 800-171 Rev 2 3.3.1; DoD Assessment Methodology weight 5

0 compliance + 0 configuration policies; 0/0 devices compliant (0%)

Proposed fix
Assign a security baseline (Windows / Edge / Defender) and a compliance policy to every device group; remediate non-compliant devices to 95%+.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.1; DoD Assessment Methodology weight 5

0 accounts hold privileged directory roles

Proposed fix
Reduce standing privileged accounts to the minimum; use PIM just-in-time activation and separate admin accounts.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.5; DoD Assessment Methodology weight 5

application control (AppLocker / WDAC) lives in configuration profiles

Proposed fix
Evidence: WDAC / AppLocker policy in enforce mode on CUI endpoints.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.8; DoD Assessment Methodology weight 5

No enabled policy requires MFA

Proposed fix
Add a Conditional Access policy requiring MFA (phishing-resistant strength for admins) for All users, no exclusions beyond break-glass.
Effort: 40 min (~$97 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.5.3; DoD Assessment Methodology weight 5

No enabled policy requires MFA

Proposed fix
Add a Conditional Access policy requiring MFA (phishing-resistant strength for admins) for All users, no exclusions beyond break-glass.
Effort: 40 min (~$97 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.7.5; DoD Assessment Methodology weight 5

Defender Vulnerability Management coverage needs the Defender API

Proposed fix
Evidence: monthly exposure report and remediation SLAs recorded in the POA&M.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.11.2; DoD Assessment Methodology weight 5

0 policies condition access on location or device state; all Microsoft 365 sessions are TLS-encrypted

Proposed fix
Require compliant or hybrid-joined devices and named locations for CUI apps so remote sessions are controlled.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.13.1; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.13.5; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.13.6; DoD Assessment Methodology weight 5

No enabled policy requires MFA

Proposed fix
Add a Conditional Access policy requiring MFA (phishing-resistant strength for admins) for All users, no exclusions beyond break-glass.
Effort: 40 min (~$97 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.13.15; DoD Assessment Methodology weight 5

Defender Vulnerability Management coverage needs the Defender API

Proposed fix
Evidence: monthly exposure report and remediation SLAs recorded in the POA&M.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.14.1; DoD Assessment Methodology weight 5

DFARS 252.204-7021 requires a C3PAO certification. TITAN delivers readiness and a defensible self-assessment; the certificate itself is issued by the C3PAO and its scheduling is outside our control.

Proposed fix
Scope and price the tenant migration before the gap assessment.
Effort: 60 min (~$145 labour) · Expected annual loss: $33,150 · Blast radius: \b(tenant|subscription|organization|root|global admin|management group|all accounts)\b

Citation: DFARS 252.204-7012

Enable transparent data encryption (TDE) on all databases handling PHI / cardholder data. Use customer-managed keys with annual rotation.

Proposed fix
Enable TDE / SSE-KMS. Verify with: SELECT name, is_encrypted FROM sys.databases (SQL); aws rds describe-db-instances; az sql db show
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(a)(2)(iv); PCI-DSS 3.4; SOC 2 CC6.1

Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL.

Proposed fix
Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service
Effort: 90 min (~$218 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(e)(1); PCI-DSS 4.1; SOC 2 CC6.7

Enforce phishing-resistant MFA (FIDO2 / WebAuthn) for all privileged accounts. Disable SMS as a factor for admin roles.

Proposed fix
Conditional Access policy + FIDO2 keys. AWS: SCP requiring MFA for assume-role; Azure: CA policy targeting admin roles; Okta: hardware MFA factor enforcement
Effort: 40 min (~$97 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(d); PCI-DSS 8.3; SOC 2 CC6.1; NIST 800-53 IA-2(1)

Enforce phishing-resistant MFA (FIDO2 / PIV) for all privileged accounts. SMS not acceptable for FedRAMP.

Proposed fix
Issue PIV / CAC / FIDO2 keys to admins. Enforce via Conditional Access. Disable SMS factor for privileged roles
Effort: 40 min (~$97 labour) · Expected annual loss: $19,227 · Blast radius: single resource

Citation: FedRAMP IA-2(1); CMMC IA.L2-3.5.3; NIST 800-171 3.5.3

Without an audit trail, nobody can ever answer who changed what. Every other forensic capability depends on this one.

Proposed fix
Enable the Activity Log / CloudTrail / Cloud Audit Logs and forward them to retained storage.
Effort: 10 min (~$24 labour) · Expected annual loss: $114,311 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b

Citation: NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)

Without an audit trail, nobody can ever answer who changed what. Every other forensic capability depends on this one.

Proposed fix
Enable the Activity Log / CloudTrail / Cloud Audit Logs and forward them to retained storage.
Effort: 10 min (~$24 labour) · Expected annual loss: $114,311 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b

Citation: NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)

Without an audit trail, nobody can ever answer who changed what. Every other forensic capability depends on this one.

Proposed fix
Enable the Activity Log / CloudTrail / Cloud Audit Logs and forward them to retained storage.
Effort: 10 min (~$24 labour) · Expected annual loss: $114,311 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b

Citation: NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)

Without an audit trail, nobody can ever answer who changed what. Every other forensic capability depends on this one.

Proposed fix
Enable the Activity Log / CloudTrail / Cloud Audit Logs and forward them to retained storage.
Effort: 10 min (~$24 labour) · Expected annual loss: $114,311 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b

Citation: NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)

Enable audit logging on the platform. Without it, no detection or forensics is possible.

Proposed fix
AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 800-53 AU-2

INCIDENT. Investigate for tampering or storage corruption. Preserve evidence chain.

Proposed fix
Trigger incident response. Pull from backup / immutable replica. Investigate gap source via cross-system corroboration
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2)

All privileged actions must be logged with user identity, timestamp, target, and command. Without this, no forensic accountability.

Proposed fix
Linux: configure auditd with rules for execve and setuid; Windows: enable Process Creation auditing GPO; Cloud: enable management plane logging
Effort: 10 min (~$24 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12

Log every read of PHI / CHD: user, timestamp, record-key, query type. Required for HIPAA breach assessment.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, pgaudit). Wire to immutable archive
Effort: 10 min (~$24 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); PCI-DSS 10.2.1

Enable transparent data encryption (TDE) on all databases handling PHI / cardholder data. Use customer-managed keys with annual rotation.

Proposed fix
Enable TDE / SSE-KMS. Verify with: SELECT name, is_encrypted FROM sys.databases (SQL); aws rds describe-db-instances; az sql db show
Effort: 60 min (~$145 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(a)(2)(iv); PCI-DSS 3.4; SOC 2 CC6.1

Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL.

Proposed fix
Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service
Effort: 90 min (~$218 labour) · Expected annual loss: $110,149 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(e)(1); PCI-DSS 4.1; SOC 2 CC6.7

Enforce phishing-resistant MFA (FIDO2 / WebAuthn) for all privileged accounts. Disable SMS as a factor for admin roles.

Proposed fix
Conditional Access policy + FIDO2 keys. AWS: SCP requiring MFA for assume-role; Azure: CA policy targeting admin roles; Okta: hardware MFA factor enforcement
Effort: 40 min (~$97 labour) · Expected annual loss: $97,664 · Blast radius: single resource

Citation: HIPAA 164.312(d); PCI-DSS 8.3; SOC 2 CC6.1; NIST 800-53 IA-2(1)

Replace non-FIPS crypto modules with FIPS-validated modules. Use FIPS-mode operating system and TLS libraries.

Proposed fix
Enable FIPS mode: Linux kernel fips=1; Windows GPO 'System cryptography: Use FIPS-compliant algorithms'; AWS GovCloud / Azure Government provide FIPS endpoints
Effort: 60 min (~$145 labour) · Expected annual loss: $19,227 · Blast radius: single resource

Citation: FIPS 140-2/3; FedRAMP SC-13; CMMC SC.L2-3.13.11

Enforce phishing-resistant MFA (FIDO2 / PIV) for all privileged accounts. SMS not acceptable for FedRAMP.

Proposed fix
Issue PIV / CAC / FIDO2 keys to admins. Enforce via Conditional Access. Disable SMS factor for privileged roles
Effort: 40 min (~$97 labour) · Expected annual loss: $19,227 · Blast radius: single resource

Citation: FedRAMP IA-2(1); CMMC IA.L2-3.5.3; NIST 800-171 3.5.3

Segregate CUI / FCI / PHI into separate authorization boundaries. Network segmentation + data classification labels.

Proposed fix
Move CUI workloads to dedicated VPC / VNet / subscription. Apply data classification labels. Block cross-boundary flows via firewall
Effort: 45 min (~$109 labour) · Expected annual loss: $69,360 · Blast radius: \b(tenant|subscription|organization|root|global admin|management group|all accounts)\b

Citation: CMMC AC.L2-3.1.3; NIST 800-171 3.1.3; FedRAMP SC-7

0 compliance + 0 configuration policies; 0/0 devices compliant (0%)

Proposed fix
Assign a security baseline (Windows / Edge / Defender) and a compliance policy to every device group; remediate non-compliant devices to 95%+.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.2; DoD Assessment Methodology weight 5

0 compliance + 0 configuration policies; 0/0 devices compliant (0%)

Proposed fix
Assign a security baseline (Windows / Edge / Defender) and a compliance policy to every device group; remediate non-compliant devices to 95%+.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.6; DoD Assessment Methodology weight 5

0 compliance + 0 configuration policies; 0/0 devices compliant (0%)

Proposed fix
Assign a security baseline (Windows / Edge / Defender) and a compliance policy to every device group; remediate non-compliant devices to 95%+.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.4.7; DoD Assessment Methodology weight 5

Secure Score None/None; 0 recent alerts visible via Graph - Defender XDR alerting is active

Proposed fix
Connect Defender XDR / Sentinel so alerts are centralised, triaged and retained.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.6.1; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.6.2; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.7.2; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.8.3; DoD Assessment Methodology weight 5

removable-storage control lives in device restriction / Defender device-control policies

Proposed fix
Evidence: the policy that blocks or allow-lists removable storage on every CUI endpoint.
Effort: 30 min (~$72 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.8.7; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.10.1; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.10.2; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.12.1; DoD Assessment Methodology weight 5

Secure Score None/None; 0 recent alerts visible via Graph - Defender XDR alerting is active

Proposed fix
Connect Defender XDR / Sentinel so alerts are centralised, triaged and retained.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.12.3; DoD Assessment Methodology weight 5

Examine / Interview required

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.13.2; DoD Assessment Methodology weight 5

tenant type unknown

Proposed fix
Document the implementation in the SSP and evidence it
Effort: 60 min (~$145 labour) · Expected annual loss: $33,150 · Blast radius: \b(tenant|subscription|organization|root|global admin|management group|all accounts)\b

Citation: NIST SP 800-171 Rev 2 3.13.11; DoD Assessment Methodology weight 5

Per-device AV state needs the Defender for Endpoint API, not Graph

Proposed fix
Evidence: Defender portal export showing real-time protection + current signatures on 100% of CUI endpoints.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.14.2; DoD Assessment Methodology weight 5

Secure Score None/None; 0 recent alerts visible via Graph - Defender XDR alerting is active

Proposed fix
Connect Defender XDR / Sentinel so alerts are centralised, triaged and retained.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.14.3; DoD Assessment Methodology weight 5

Per-device AV state needs the Defender for Endpoint API, not Graph

Proposed fix
Evidence: Defender portal export showing real-time protection + current signatures on 100% of CUI endpoints.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.14.4; DoD Assessment Methodology weight 5

Secure Score None/None; 0 recent alerts visible via Graph - Defender XDR alerting is active

Proposed fix
Connect Defender XDR / Sentinel so alerts are centralised, triaged and retained.
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource

Citation: NIST SP 800-171 Rev 2 3.14.6; DoD Assessment Methodology weight 5

Change all vendor defaults before production deployment. Disable default accounts entirely where possible.

Proposed fix
Audit script: enumerate accounts and reject any matching known defaults (admin/admin, root/root, sa/blank, etc.). Block at deploy time.
Effort: 10 min (~$24 labour) · Expected annual loss: $64,770 · Blast radius: \b(tenant|subscription|organization|root|global admin|management group|all accounts)\b

Citation: PCI-DSS 2.1; NIST 800-53 IA-5

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Only security and compliance staff should read audit logs. Operators should not see them by default.

Proposed fix
Apply RBAC: security-team-readonly role for log archive bucket. Remove read access from general operators
Effort: 40 min (~$97 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.308(a)(3); NIST 800-53 AU-9; PCI-DSS 10.5.1

All configuration changes must be logged. Otherwise change management cannot be audited.

Proposed fix
Enable management-plane audit logging on cloud + on-prem config sources (GPO change auditing, IAM events)
Effort: 40 min (~$97 labour) · Expected annual loss: $20,834 · Blast radius: single resource

Citation: PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2

All configuration changes must be logged. Otherwise change management cannot be audited.

Proposed fix
Enable management-plane audit logging on cloud + on-prem config sources (GPO change auditing, IAM events)
Effort: 40 min (~$97 labour) · Expected annual loss: $20,834 · Blast radius: single resource

Citation: PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2

Log both auth success AND failure. Failures are the primary signal for credential stuffing / brute-force attacks.

Proposed fix
Enable both success and failure audit categories. Verify SIEM is ingesting auth-failure events
Effort: 10 min (~$24 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)

Log both auth success AND failure. Failures are the primary signal for credential stuffing / brute-force attacks.

Proposed fix
Enable both success and failure audit categories. Verify SIEM is ingesting auth-failure events
Effort: 10 min (~$24 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Run quarterly access certification campaigns. Each privileged role gets reviewed by a manager who attests or revokes.

Proposed fix
Use access governance tool (SailPoint / Saviynt / Okta IGA) or manual quarterly process. Document the review with reviewer + date + outcome.
Effort: 40 min (~$97 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 8.1.4; SOC 2 CC6.3; HIPAA 164.308(a)(4)(ii)(C)

Encrypt all backups with KMS-managed keys. Store off-site in a different region. Test restore quarterly.

Proposed fix
AWS: cross-region snapshot copy with KMS; Azure: GRS / RA-GRS with backup vault; GCP: cross-region backup bucket. Document quarterly restore test.
Effort: 60 min (~$145 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.308(a)(7)(ii)(A); SOC 2 A1.2

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Configure audit log archival to immutable storage with retention matching the strictest framework that applies (HIPAA: 6 years).

Proposed fix
AWS S3 with object-lock (compliance mode), Azure Storage immutable blob retention, GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2); PCI-DSS 10.7; SOC 2 CC4.1

Run quarterly access certification campaigns. Each privileged role gets reviewed by a manager who attests or revokes.

Proposed fix
Use access governance tool (SailPoint / Saviynt / Okta IGA) or manual quarterly process. Document the review with reviewer + date + outcome.
Effort: 40 min (~$97 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 8.1.4; SOC 2 CC6.3; HIPAA 164.308(a)(4)(ii)(C)

Schedule authenticated vulnerability scans monthly internal, quarterly external. PCI requires ASV-attested external scans quarterly.

Proposed fix
Enable Defender for Cloud / Inspector / Security Command Center; schedule quarterly Nessus / Qualys / Rapid7 scans for external surface
Effort: 240 min (~$580 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 11.2; HIPAA 164.308(a)(8); SOC 2 CC7.1

Encrypt all backups with KMS-managed keys. Store off-site in a different region. Test restore quarterly.

Proposed fix
AWS: cross-region snapshot copy with KMS; Azure: GRS / RA-GRS with backup vault; GCP: cross-region backup bucket. Document quarterly restore test.
Effort: 60 min (~$145 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.308(a)(7)(ii)(A); SOC 2 A1.2

Maintain BAA registry. Each vendor handling PHI must have an executed BAA before data flows. Renew before expiry.

Proposed fix
Build BAA tracking sheet (vendor / executed date / expiry / scope of PHI). Block payment to vendors without active BAA via procurement workflow.
Effort: 60 min (~$145 labour) · Expected annual loss: $18,796 · Blast radius: single resource

Citation: HIPAA 164.314(a); 164.308(b)

Run PHI workloads in dedicated subscriptions / accounts / VPCs. Enforce network segmentation to prevent dev access to prod PHI.

Proposed fix
Separate AWS account / Azure subscription / GCP project for PHI prod. SCPs / Azure Policy / Org Policy block cross-environment data flow.
Effort: 30 min (~$72 labour) · Expected annual loss: $23,423 · Blast radius: \b(tenant|subscription|organization|root|global admin|management group|all accounts)\b

Citation: HIPAA 164.312(a)(1); 164.308(a)(4)

Log every read of PHI columns. Capture user, timestamp, record-key, query type. Send to SIEM with 6-year retention.

Proposed fix
Enable database-level audit (SQL Server Audit, Oracle Unified Audit, PostgreSQL pgaudit). Wire to central log store with immutable retention.
Effort: 10 min (~$24 labour) · Expected annual loss: $20,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.312(b); 164.308(a)(1)(ii)(D)

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Set retention to the strictest applicable framework (HIPAA 6yr).

Proposed fix
Configure log archive bucket with WORM/immutable retention policy matching framework requirement
Effort: 30 min (~$72 labour) · Expected annual loss: $938,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX - 7yr

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Ship logs to immutable storage. Mutable logs are not admissible as evidence and can be tampered with by attackers.

Proposed fix
AWS S3 with object-lock compliance mode; Azure Storage immutable blob; GCS bucket retention policy
Effort: 30 min (~$72 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Investigate cause. Gaps may indicate log pipeline failure or attacker clearing logs.

Proposed fix
Add heartbeat events every minute. Alert on gaps > 5min. Verify log forwarder daemon is running and shipping
Effort: 60 min (~$145 labour) · Expected annual loss: $36,796 · Blast radius: single resource

Citation: PCI-DSS 10.6; HIPAA 164.312(b)

Only security and compliance staff should read audit logs. Operators should not see them by default.

Proposed fix
Apply RBAC: security-team-readonly role for log archive bucket. Remove read access from general operators
Effort: 40 min (~$97 labour) · Expected annual loss: $38,779 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b

Citation: HIPAA 164.308(a)(3); NIST 800-53 AU-9; PCI-DSS 10.5.1