Fixture Subscription
Last run 2026-09-09T03:27:45Z
Observed posture
Collection completeness
Accepted risk
Effective posture
Freshness
Audit readiness
Ready for the audit binder: automated checks plus manually tracked status and evidence. Mapped to, not certified against.
Identity
Network
Storage
Data
Logging
Governance
Compute
Defender
Microsoft Secure Score: 68.2% (Azure says).
ProofKit observed posture: 24%.
ProofKit effective posture with 2 compensating controls: 26%.
Secure Score only sees controls inside the tenant.
Microsoft 365: Entra baseline
Microsoft 365: SharePoint and OneDrive
Microsoft 365: collected by script
Checks
From the run on 2026-09-09T03:27:45Z. Full run history › · Access reviews › · Policies › · Microsoft 365 › · Trust center ›
30 of 145 checks map to HITRUST CSF: 6 pass, 16 fail, 8 warn.
No audit target set for HITRUST CSF yet. · Scope
This control list is the public HITRUST CSF v9.2 reference set. Real e1/i1/r2 assessment scoping (which controls actually apply at a given assessment level) needs the licensed CSF; ProofKit does not invent or approximate that scoping here.
| Check | Family | Severity | Status | HITRUST CSF control | Affected |
|---|---|---|---|---|---|
| Number of Global Administrators | identity | medium | pass | 01.c Privilege Management | |
| Privileged role membership over 5 | identity | medium | warn | 01.c Privilege Management | 6 |
| Guest accounts in a directory role | identity | high | fail | 01.c Privilege Management | 1 |
| Application credentials with no owner | identity | low | warn | 01.c Privilege Management | 1 |
| Risky OAuth consent grants | identity | high | fail | 01.c Privilege Management | 3 |
| Banned password protection and lockout | identity | medium | fail | 01.d Password Management | 2 |
| NSGs open to the internet on management ports | network | high | fail | 01.c Privilege Management | 1 |
| NSGs allowing any port from the internet | network | high | pass | 09.m Network Security Management | |
| VMs with a public IP | network | medium | warn | 01.n Network Access Control | 2 |
| Subnets without an NSG | network | medium | fail | 01.n Network Access Control | 1 |
| Storage accounts open to the public network | network | high | fail | 09.m Network Security Management | 1 |
| SQL server firewall allows every IP | network | high | pass | 01.m Network Access Control | |
| Key vaults open to the public network | network | high | fail | 01.m Network Access Control | 1 |
| No Azure Bastion for VMs with a public IP | network | medium | warn | 01.l Access Control | 1 |
| App Service sites not HTTPS-only | network | high | fail | 01.n Network Access Control | 1 |
| App Service minimum TLS version below 1.2 | network | medium | fail | 01.n Network Access Control | 1 |
| HTTPS not enforced | storage | high | pass | 01.n Network Access Control | |
| Public storage with no private endpoint | storage | low | warn | 01.m Network Access Control | 1 |
| SQL server auditing disabled | data | medium | fail | 09.aa Audit Logging & Monitoring | 1 |
| Transparent data encryption disabled | data | high | pass | 09.o Portable Media Security | |
| Key vault has no diagnostic logging | data | medium | pass | 09.aa Audit Logging & Monitoring | |
| SQL Vulnerability Assessment disabled | data | medium | fail | 10.m Vulnerability Management | 1 |
| PostgreSQL/MySQL do not require a secure connection | data | high | fail | 01.n Network Access Control | 1 |
| Cosmos DB open to every IP address | data | high | fail | 01.m Network Access Control | 1 |
| Activity log not exported | logging | medium | fail | 09.aa Audit Logging & Monitoring | 1 |
| Log Analytics retention below 90 days | logging | medium | warn | 09.aa Audit Logging & Monitoring | 1 |
| Missing activity log alerts for key changes | logging | medium | fail | 09.ad Audit Logging & Monitoring | 7 |
| Public VMs without Just-In-Time access | compute | medium | warn | 01.l Access Control | 1 |
| VMs without a backup | compute | medium | warn | 09.l Back-up | 2 |
| AKS clusters without Kubernetes RBAC | compute | high | fail | 01.c Privilege Management | 1 |