Vulnerabilities and governance

No open critical vulnerabilities

Explanation
Definition

The recorded maximum vulnerability severity should not be critical.Part of Alignr Baseline (seeded).Applies toSubjects with a recorded highest vulnerability severity observation.What the result tells youThis excludes the exact value critical. A non-critical value does not mean zero vulnerabilities, and absent severity evidence does not pass.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Suggest only

Population conditionHighest vulnerability severity (vulnerability_max_severity) has an observation.Expected evidence

Highest vulnerability severity (vulnerability_max_severity) does not equal "critical".

Required predicates: vulnerability_max_severity.

{
  "match": {
    "predicate": "vulnerability_max_severity"
  },
  "expect": [
    {
      "fact": "vulnerability_max_severity",
      "op": "neq",
      "value": "critical"
    }
  ],
  "severity": "high",
  "title": "Scanned host has an open critical vulnerability",
  "evidence": [
    "vulnerability_max_severity"
  ]
}

Open vulnerability count stays within limits

Explanation
Definition

The recorded open-vulnerability count should be at or below the configured limit.Part of Alignr Baseline (seeded).Applies toSubjects with a recorded open vulnerability count observation.Default settings

Setting	Default	Allowed range
Maximum open vulnerabilities	`5`	0–1000

Client overrides can change these values. Check the effective settings when interpreting a result.What the result tells youThe limit applies to the source-reported count for a subject. Keep scanner scopes comparable; a low count is not proof of low business risk.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	Medium
Declared autonomy	Suggest only

Population conditionOpen vulnerability count (vulnerability_open_count) has an observation.Expected evidence

Open vulnerability count (vulnerability_open_count) is at most parameter max_open_vulnerabilities.

Required predicates: vulnerability_open_count.

{
  "match": {
    "predicate": "vulnerability_open_count"
  },
  "expect": [
    {
      "fact": "vulnerability_open_count",
      "op": "lte",
      "value": {
        "param": "max_open_vulnerabilities"
      }
    }
  ],
  "severity": "medium",
  "title": "Scanned host exceeds the open-vulnerability limit",
  "evidence": [
    "vulnerability_open_count"
  ]
}

Managed endpoints have no missing patches

Explanation
Definition

The selected device needs an explicit null observation for missing patches to satisfy this comparison.Part of Alignr Baseline (seeded).Applies toDevices reported as managed by an RMM.What the result tells youImportant limitation: not_exists compares an observed null value. No missing_patch row is unknown, not a clean patch result. An observed missing patch fails; do not use a lack of rows as proof that the endpoint is patched.

Setting	Value
Standard	Alignr Baseline (seeded)
Severity	High
Declared autonomy	Change ticket

Population conditionDevice management (device_managed_by) equals "rmm".Expected evidence

Missing patch (missing_patch) has an observed null value.

Required predicates: device_managed_by, missing_patch.

{
  "match": {
    "predicate": "device_managed_by",
    "object": "rmm"
  },
  "expect": [
    {
      "fact": "missing_patch",
      "op": "not_exists"
    }
  ],
  "severity": "high",
  "title": "Managed endpoint has an outstanding missing-patch finding",
  "evidence": [
    "device_managed_by",
    "missing_patch"
  ]
}

No critical vulnerabilities remain open

Explanation
Definition

The recorded maximum vulnerability severity should not be critical.Part of BIOS Vulnerability and Governance.Applies toSubjects with a recorded highest vulnerability severity observation.What the result tells youThis excludes the exact value critical. A non-critical value does not mean zero vulnerabilities, and absent severity evidence does not pass.

Setting	Value
Standard	BIOS Vulnerability and Governance
Severity	High
Declared autonomy	Suggest only

Population conditionHighest vulnerability severity (vulnerability_max_severity) has an observation.Expected evidence

Highest vulnerability severity (vulnerability_max_severity) does not equal "critical".

Required predicates: vulnerability_max_severity.

{
  "match": {
    "predicate": "vulnerability_max_severity"
  },
  "expect": [
    {
      "fact": "vulnerability_max_severity",
      "op": "neq",
      "value": "critical"
    }
  ],
  "severity": "high",
  "title": "Critical vulnerability remains open",
  "evidence": [
    "vulnerability_max_severity"
  ]
}

Open vulnerabilities stay below threshold

Explanation
Definition

The recorded open-vulnerability count should be at or below the configured limit.Part of BIOS Vulnerability and Governance.Applies toSubjects with a recorded open vulnerability count observation.Default settings

Setting	Default	Allowed range
Maximum open vulnerabilities	`5`	0–1000

Setting	Value
Standard	BIOS Vulnerability and Governance
Severity	Medium
Declared autonomy	Suggest only

Population conditionOpen vulnerability count (vulnerability_open_count) has an observation.Expected evidence

Open vulnerability count (vulnerability_open_count) is at most parameter maximum.

Required predicates: vulnerability_open_count.

{
  "match": {
    "predicate": "vulnerability_open_count"
  },
  "expect": [
    {
      "fact": "vulnerability_open_count",
      "op": "lte",
      "value": {
        "param": "maximum"
      }
    }
  ],
  "severity": "medium",
  "title": "Host exceeds vulnerability threshold",
  "evidence": [
    "vulnerability_open_count"
  ]
}

Review configuration drift governance

Review every 30 days · BIOS Vulnerability and GovernanceReview approved baselines, exception ownership and drift evidence across systems. Current facts do not prove a complete cross-domain baseline.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review incident response readiness

Review every 90 days · BIOS Vulnerability and GovernanceConfirm contacts, roles, escalation paths, communications and exercise evidence are current.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Review email security posture

Review every 30 days · BIOS Vulnerability and GovernanceReview SPF, DKIM, DMARC, threat protection, forwarding and audit retention in the source consoles. Current emitted mail facts do not prove the full set of expectations.Record: who performed the review, when it was performed, the evidence, the conclusion and any follow-up or approved exception. A due review is not evidence of a completed review.

Start here

Explore Alignr

Vulnerabilities and governance

Automated controls

Manual checks

Investigate a result

Next steps

​Automated controls

​Manual checks

​Investigate a result

​Next steps

Automated controls

Manual checks

Investigate a result

Next steps