Back to Security and compliance
RGPD
175 complying controls out of 175
Last synchronised :
The counter is the one produced by our continuous monitoring platform Aikido Security, and the detail lists the controls it reports as satisfied. The two figures may differ slightly.
Assessment, type and control names are those of the original frameworks.
Request the security audit report
Enforces Multi-Factor Authentication (MFA)
| Control | Status |
|---|---|
| Users are logging in securely | complying |
Proper Access Management for Resources
| Control | Status |
|---|---|
| Access Approval is enabled for the project | complying |
| AKS local admin account is still enabled | complying |
| Compute instances have OS Login enabled | complying |
| Dangerous Impersonate permission given to ServiceAccount or node | complying |
| GKE clusters have the Kubernetes Dashboard disabled | complying |
| Kubernetes pods are isolated | complying |
| No instance uses the default service account | complying |
| No user has both the Service Account User and Service Account Admin role | complying |
| Project-wide SSH keys are blocked | complying |
| Service accounts have strict access permissions | complying |
| ServiceAccount or node can read all secrets | complying |
| VM instances have strict access permissions | complying |
Proper Access Management for Users
| Control | Status |
|---|---|
| Users are only allowed to use corporate emails | complying |
Proper Access Management to Resources
| Control | Status |
|---|---|
| Access to BigQuery datasets are restricted | complying |
| AKS API server does not limit access by IP ranges | complying |
| Amazon EKS Clusters public endpoints should not allow traffic from any IP | complying |
| API Gateway endpoints do not require an API key or authorization | complying |
| AWS EKS Node groups have implicit SSH access from any IP | complying |
| Azure Cognitive Services allows unrestricted public network access | complying |
| Azure Cosmos DB is publicly reachable | complying |
| Azure Key Vault allows public network access | complying |
| Azure Storage Account allow public access | complying |
| Azure Storage blobs do not restrict public access for nested items | complying |
| BigQuery table is anonymously or publicly accessible | complying |
| Cloud functions are not publicly accessible | complying |
| Cloud functions have strict access policies | complying |
| Cloud Storage bucket does not enforce public access prevention | complying |
| Cloud Storage bucket does not enforce uniform bucket-level access | complying |
| Cloud Storage bucket is publicly accessible | complying |
| Dataproc cluster is anonymously or publicly accessible | complying |
| Default network exists in GCP project | complying |
| Firewall rule prevents Docker API access from anywhere | complying |
| Firewall rule prevents RDP access from anywhere | complying |
| Firewall rule prevents SSH access from anywhere | complying |
| Firewall rules allow RDP access from any public IP | complying |
| Firewall rules allow SSH from any public IP | complying |
| Firewall rules allow SSH from any public IP | complying |
| Firewall rules allow unrestricted RDP access | complying |
| Firewall rules allow unrestricted SSH access | complying |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | complying |
| Firewall rules restrict public ingress to port 23 | complying |
| Firewall rules restrict public ingress to port 2379 | complying |
| Firewall rules restrict public ingress to port 3000 | complying |
| Firewall rules restrict public ingress to port 5500 | complying |
| Firewall rules restrict public ingress to port 5800 | complying |
| Key Vault is publicly accessible | complying |
| KMS cryptographic key policy allows public access | complying |
| KMS keys have strict access permissions | complying |
| Kubernetes dashboard might be deployed | complying |
| Kubernetes master endpoint is not publicly available | complying |
| Profiling endpoint automatically exposed on /debug/pprof | complying |
| Pub/Sub topic is anonymously or publicly accessible | complying |
| S3 bucket grants public access to all contents | complying |
| S3 Buckets should have block public access globally | complying |
| SQL instance root user has strict access permissions | complying |
| SQL instances do not have a public IP assigned | complying |
| SQL instances have strict access permission | complying |
| SQL Server is publicly reachable | complying |
| Storage Buckets have proper access rules | complying |
| Storage buckets have public access prevention enabled | complying |
| Vertex AI notebook instance has a public IP address | complying |
Encryption at Rest Enabled
| Control | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | complying |
| API Gateway REST API caching is unencrypted | complying |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | complying |
| Docker image repository not encrypted at rest | complying |
| Elasticsearch domain is not encrypted at rest | complying |
| Ensure all data stored in the RDS is securely encrypted at rest | complying |
| KMS keys have key rotation enabled | complying |
| SNS topics are not encrypted at rest | complying |
| SQS queue data is not encrypted | complying |
| Virtual Machines have confidential computing enabled | complying |
Enforces HTTPS traffic to cloud instances
| Control | Status |
|---|---|
| Cloud functions require HTTPS invocations | complying |
| Load Balancers only accept HTTPS connections | complying |
Runtimes are up to date
| Control | Status |
|---|---|
| AWS MQBroker version is outdated | complying |
| GKE clusters use stable release channels with automatic upgrades | complying |
| GKE node pools have node auto-upgrade enabled | complying |
| No AKS cluster upgrade channel is chosen | complying |
| No Critical End-of-Life (EOL) Issues | complying |
| No High End-of-Life (EOL) Issues | complying |
Use of Cryptography Libraries
| Control | Status |
|---|---|
| Hashes should include an unpredictable salt | complying |
| Usage of deprecated or broken encryption detected | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Using deprecated cryptographic library | complying |
Use of Cryptography: Enforces SSL
| Control | Status |
|---|---|
| Cloud SQL db not enforcing SSL | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| NodeJS talks to database without encryption | complying |
| SSL certificate verification turned off during requests | complying |
| SSL certificate verification turned off during requests | complying |
Use of Cryptography: Enforces TLS
| Control | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | complying |
| Azure Storage Accounts does not enforce latest TLS version | complying |
| Elasticsearch domain might have outdated TLS version | complying |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | complying |
| Storage account does not enforce HTTPS-only traffic | complying |
Use of Cryptography: Secure Cookies
| Control | Status |
|---|---|
| Cookie missing HttpOnly flag | complying |
| Laravel cookies can be sent unencrypted | complying |
Backups Enabled
| Control | Status |
|---|---|
| Databases have automated backups enabled | complying |
| DynamoDB backups are off | complying |
Logging Enabled
| Control | Status |
|---|---|
| Amazon EKS Clusters should have control plane logging enabled | complying |
| Audit Configuration logging is enabled | complying |
| Logging and alerts are enabled for Project Ownership assignments | complying |
| Storage Permissions logging is enabled | complying |
| VPC Firewall has Rule logging enabled | complying |
Threat Detection Enabled
| Control | Status |
|---|---|
| Alerting policies have a notification channel configured | complying |
Encryption at Rest Enabled
| Control | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | complying |
| API Gateway REST API caching is unencrypted | complying |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | complying |
| Docker image repository not encrypted at rest | complying |
| Elasticsearch domain is not encrypted at rest | complying |
| Ensure all data stored in the RDS is securely encrypted at rest | complying |
| KMS keys have key rotation enabled | complying |
| SNS topics are not encrypted at rest | complying |
| SQS queue data is not encrypted | complying |
| Virtual Machines have confidential computing enabled | complying |
Enforces HTTPS traffic to cloud instances
| Control | Status |
|---|---|
| Cloud functions require HTTPS invocations | complying |
| Load Balancers only accept HTTPS connections | complying |
Use of Cryptography Libraries
| Control | Status |
|---|---|
| Hashes should include an unpredictable salt | complying |
| Usage of deprecated or broken encryption detected | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Using deprecated cryptographic library | complying |
Use of Cryptography: Enforces SSL
| Control | Status |
|---|---|
| Cloud SQL db not enforcing SSL | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| NodeJS talks to database without encryption | complying |
| SSL certificate verification turned off during requests | complying |
| SSL certificate verification turned off during requests | complying |
Use of Cryptography: Enforces TLS
| Control | Status |
|---|---|
| API Gateway stages are not using TLS 1.2 or higher | complying |
| Azure Storage Accounts does not enforce latest TLS version | complying |
| Elasticsearch domain might have outdated TLS version | complying |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | complying |
| Storage account does not enforce HTTPS-only traffic | complying |
Use of Cryptography: Secure Cookies
| Control | Status |
|---|---|
| Cookie missing HttpOnly flag | complying |
| Laravel cookies can be sent unencrypted | complying |