> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.

# External exposure

> DNS resilience and human reviews of internet-facing assets and access.

This category contains **1 automated control definitions** and **3 manual checks** across the sources named below. Similar controls from different standards are listed separately because names, thresholds or severity can differ.

Whether the seeded Alignr Baseline is available depends on how your workspace was provisioned. Library templates are copied as disabled drafts. See [Choose a baseline](/controls/baselines/overview) before enabling anything.

## Automated controls

Expand a control to see the exact population, expectation and defaults. A pass requires usable evidence for the selected population. A known contrary observation can prove failure; missing observations or an empty population must not become a pass.

<AccordionGroup>
  <Accordion title="DNS nameserver count">
    <Tabs sync={false}>
      <Tab title="Explanation">
        Each selected domain should have at least two observed name servers.

        Part of **External exposure**.

        **Applies to**

        Subjects with a recorded name server count observation.

        **What the result tells you**

        Two or more name servers do not prove independent providers, fault domains or recovery readiness.
      </Tab>

      <Tab title="Definition">
        | Setting           | Value             |
        | ----------------- | ----------------- |
        | Standard          | External exposure |
        | Severity          | Medium            |
        | Declared autonomy | Suggest only      |

        **Population condition**

        **Name server count** (`external_nameserver_count`) has an observation.

        **Expected evidence**

        * **Name server count** (`external_nameserver_count`) is at least `2`.

        **Required predicates:** `external_nameserver_count`.

        ```json theme={null}
        {
          "match": {
            "predicate": "external_nameserver_count"
          },
          "expect": [
            {
              "fact": "external_nameserver_count",
              "op": "gte",
              "value": 2
            }
          ],
          "severity": "medium",
          "title": "Domain has fewer than two nameservers",
          "evidence": [
            "external_nameserver_count"
          ]
        }
        ```
      </Tab>
    </Tabs>
  </Accordion>
</AccordionGroup>

## Manual checks

These are human reviews, not automated evidence. The interval below is the template default; review ownership, evidence and suitability for the client.

<AccordionGroup>
  <Accordion title="Review external asset inventory">
    **Review every 30 days** · External exposure

    Reconcile the approved public asset register with current DNS, cloud and vendor records. Pass when every internet-facing hostname, address, service owner and business purpose is recorded, and retired assets are removed or blocked. Fail when an exposed asset is unknown, ownerless or no longer required. Evidence: attach the dated inventory export and record the source systems checked. Alignr does not run an external asset scanner for this check.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review exposed administration ports">
    **Review every 30 days** · External exposure

    For each approved internet-facing asset, inspect firewall, cloud security group and service configuration for management ports and interfaces. Pass when administration is private or restricted to approved source networks with MFA and logging. Fail when RDP, SSH, database or appliance administration is exposed broadly, uses an unapproved source or lacks compensating controls. Evidence: record the asset, port, rule, allowed sources and owner; Alignr does not scan ports.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>

  <Accordion title="Review remote access paths">
    **Review every 30 days** · External exposure

    Review VPN, zero-trust and remote support services against the approved user, group, device and destination register. Pass when each path has an owner, MFA, least-privilege scope, logging and a current access review. Fail when a path is anonymous, stale, over-broad or lacks a recent owner review. Evidence: attach the access export and record the test of a representative path; Alignr does not perform an external reachability scan.

    **Record:** who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.
  </Accordion>
</AccordionGroup>

## Investigate a result

Confirm the client and the account, device or other item being assessed. Check the source, observation time and effective settings, then compare the recorded evidence with the expectation. Missing evidence needs investigation; a change to the environment requires a separate review.

## Next steps

[Create a custom control](/controls/create-custom) · [Parameters and client overrides](/controls/parameters) · [Record a manual check](/controls/manual-checks)