Skip to main content
This category contains 1 automated control definitions and 3 manual checks across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ. Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See Choose a baseline before enabling anything.

Automated controls

Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.
Each selected domain should have at least two observed name servers.Part of External exposure.Applies toSubjects with a recorded name server count observation.What the result tells youTwo or more name servers do not prove independent providers, fault domains or recovery readiness.

Manual checks

These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.
Review every 30 days · External exposureReconcile the approved public asset register with current DNS, cloud and vendor records. Pass when every internet-facing hostname, address, service owner and business purpose is recorded, and retired assets are removed or blocked. Fail when an exposed asset is unknown, ownerless or no longer required. Evidence: attach the dated inventory export and record the source systems checked. Alignr does not run an external asset scanner for this check.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
Review every 30 days · External exposureFor each approved internet-facing asset, inspect firewall, cloud security group and service configuration for management ports and interfaces. Pass when administration is private or restricted to approved source networks with MFA and logging. Fail when RDP, SSH, database or appliance administration is exposed broadly, uses an unapproved source or lacks compensating controls. Evidence: record the asset, port, rule, allowed sources and owner; Alignr does not scan ports.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
Review every 30 days · External exposureReview VPN, zero-trust and remote support services against the approved user, group, device and destination register. Pass when each path has an owner, MFA, least-privilege scope, logging and a current access review. Fail when a path is anonymous, stale, over-broad or lacks a recent owner review. Evidence: attach the access export and record the test of a representative path; Alignr does not perform an external reachability scan.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Investigate a result

Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.

Next steps

Create a custom control · Parameters and client overrides · Record a manual check