Automated controls
Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.DNS nameserver count
DNS nameserver count
- Explanation
- Definition
Each selected domain should have at least two observed name servers.Part of External exposure.Applies toSubjects with a recorded name server count observation.What the result tells youTwo or more name servers do not prove independent providers, fault domains or recovery readiness.
Manual checks
These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.Review external asset inventory
Review external asset inventory
Review every 30 days · External exposureReconcile the approved public asset register with current DNS, cloud and vendor records. Pass when every internet-facing hostname, address, service owner and business purpose is recorded, and retired assets are removed or blocked. Fail when an exposed asset is unknown, ownerless or no longer required. Evidence: attach the dated inventory export and record the source systems checked. Alignr does not run an external asset scanner for this check.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
Review exposed administration ports
Review exposed administration ports
Review every 30 days · External exposureFor each approved internet-facing asset, inspect firewall, cloud security group and service configuration for management ports and interfaces. Pass when administration is private or restricted to approved source networks with MFA and logging. Fail when RDP, SSH, database or appliance administration is exposed broadly, uses an unapproved source or lacks compensating controls. Evidence: record the asset, port, rule, allowed sources and owner; Alignr does not scan ports.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
Review remote access paths
Review remote access paths
Review every 30 days · External exposureReview VPN, zero-trust and remote support services against the approved user, group, device and destination register. Pass when each path has an owner, MFA, least-privilege scope, logging and a current access review. Fail when a path is anonymous, stale, over-broad or lacks a recent owner review. Evidence: attach the access export and record the test of a representative path; Alignr does not perform an external reachability scan.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.