Back to Security and compliance
NIS2
148 complying controls out of 148
Last synchronised :
The counter is the one produced by our continuous monitoring platform Aikido Security, and the detail lists the controls it reports as satisfied. The two figures may differ slightly.
Assessment, type and control names are those of the original frameworks.
Request the security audit report
Applies the least privilege principle for cloud resource
| Control | Status |
|---|---|
| Access Approval is enabled for the project | complying |
| Compute instances have OS Login enabled | complying |
| GKE clusters have the Kubernetes Dashboard disabled | complying |
| Kubernetes pods are isolated | complying |
| No instance uses the default service account | complying |
| No user has both the Service Account User and Service Account Admin role | complying |
| Project-wide SSH keys are blocked | complying |
| Service accounts have strict access permissions | complying |
| VM instances have strict access permissions | complying |
Applies the least privilege principle for cloud users
| Control | Status |
|---|---|
| Firewall rules restrict public ingress to port 636 | complying |
| Users are logging in securely | complying |
| Users are only allowed to use corporate emails | complying |
Applies the least privilege principle to cloud resources
| Control | Status |
|---|---|
| Access to BigQuery datasets are restricted | complying |
| Cloud functions are not publicly accessible | complying |
| Cloud functions have strict access policies | complying |
| Firewall rule prevents Docker API access from anywhere | complying |
| Firewall rule prevents RDP access from anywhere | complying |
| Firewall rule prevents SSH access from anywhere | complying |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | complying |
| Firewall rules restrict public ingress to port 23 | complying |
| Firewall rules restrict public ingress to port 2379 | complying |
| Firewall rules restrict public ingress to port 3000 | complying |
| Firewall rules restrict public ingress to port 5500 | complying |
| Firewall rules restrict public ingress to port 5800 | complying |
| KMS keys have strict access permissions | complying |
| Kubernetes master endpoint is not publicly available | complying |
| SQL instance root user has strict access permissions | complying |
| SQL instances do not have a public IP assigned | complying |
| SQL instances have strict access permission | complying |
| Storage Buckets have proper access rules | complying |
| Storage buckets have public access prevention enabled | complying |
Has backups for stateful cloud resources
| Control | Status |
|---|---|
| Databases have automated backups enabled | complying |
Configured SLAs to resolve issues
| Control | Status |
|---|---|
| Configure SLAs | complying |
Tracks progress via an issue tracker
| Control | Status |
|---|---|
| Integration with issue tracker enabled | complying |
Configured monitoring for code repositories
| Control | Status |
|---|---|
| Configured monitoring for all code repositories | complying |
Configured monitoring for container images
| Control | Status |
|---|---|
| Configured monitoring for cloud environment | complying |
Configured monitoring for public facing domains
| Control | Status |
|---|---|
| Configured monitoring for public facing domains | complying |
Has configured exposure for repositories
| Control | Status |
|---|---|
| Has configured exposure for resources | complying |
Has measurements against unauthorized network access
| Control | Status |
|---|---|
| Access to BigQuery datasets are restricted | complying |
| Firewall rule prevents Docker API access from anywhere | complying |
| Firewall rules do not allow unrestricted ingress to all ports and protocols | complying |
| Firewall rules restrict public ingress to port 23 | complying |
| Firewall rules restrict public ingress to port 2379 | complying |
| Firewall rules restrict public ingress to port 3000 | complying |
| Firewall rules restrict public ingress to port 5500 | complying |
| Firewall rules restrict public ingress to port 5800 | complying |
| Kubernetes master endpoint is not publicly available | complying |
Has separate production and test environments
| Control | Status |
|---|---|
| No cloud environment used for mixed purposes (eg production and staging) | complying |
Uses firewalls
| Control | Status |
|---|---|
| Firewall rules restrict public ingress to port 11214 | complying |
| Firewall rules restrict public ingress to port 11215 | complying |
| Firewall rules restrict public ingress to port 135 | complying |
| Firewall rules restrict public ingress to port 137 | complying |
| Firewall rules restrict public ingress to port 138 | complying |
| Firewall rules restrict public ingress to port 139 | complying |
| Firewall rules restrict public ingress to port 1433 | complying |
| Firewall rules restrict public ingress to port 1434 | complying |
| Firewall rules restrict public ingress to port 2383 | complying |
| Firewall rules restrict public ingress to port 2484 | complying |
| Firewall rules restrict public ingress to port 27017 | complying |
| Firewall rules restrict public ingress to port 27018 | complying |
| Firewall rules restrict public ingress to port 27019 | complying |
| Firewall rules restrict public ingress to port 3020 | complying |
| Firewall rules restrict public ingress to port 3306 | complying |
| Firewall rules restrict public ingress to port 389 | complying |
| Firewall rules restrict public ingress to port 4505 | complying |
| Firewall rules restrict public ingress to port 4506 | complying |
| Firewall rules restrict public ingress to port 61621 | complying |
| Firewall rules restrict public ingress to port 636 | complying |
| Firewall rules restrict public ingress to port 7001 | complying |
| Firewall rules restrict public ingress to port 8000 | complying |
| Firewall rules restrict public ingress to port 9200 | complying |
| Firewall rules restrict public ingress to port 9300 | complying |
| No firewall rule allows access to Open Telemtry metrics endpoint from the internet | complying |
| No firewall rule allows access to port 1720 from the internet | complying |
| No firewall rule allows cPanel access from the internet | complying |
| No firewall rule allows etcd access from the internet | complying |
| No firewall rule allows MongoDB access from the internet | complying |
| No firewall rule allows NFS access from the internet | complying |
| No firewall rule allows Telnet access from the internet | complying |
| No firewall rule allows Tomcat Cluster Receiver access from the internet | complying |
No issues outside of sla
| Control | Status |
|---|---|
| No issues outside of sla | complying |
Uses Lockfiles to pin code dependencies
| Control | Status |
|---|---|
| Use lockfiles in repos | complying |
Enforces safe SSL protocol usage
| Control | Status |
|---|---|
| Amazon EKS Clusters should have secrets encryption enabled | complying |
| API Gateway REST API caching is unencrypted | complying |
| API Gateway stages are not using TLS 1.2 or higher | complying |
| App does not validate SSL certificates properly | complying |
| App uses an outdated TLS protocol | complying |
| App uses an outdated TLS protocol | complying |
| AWS ElastiCache Redis cluster should have encryption at rest enabled | complying |
| AWS ElastiCache Replication Group should encrypt data in transit and enable Redis AUTH | complying |
| Azure Network Security Rule allows plaintext HTTP connections | complying |
| Azure Network Security Rule allows plaintext HTTP connections | complying |
| Azure Storage Account allows plaintext HTTP connections | complying |
| Azure Storage Account allows plaintext HTTP connections | complying |
| Azure Storage Accounts does not enforce latest TLS version | complying |
| Cloud functions require HTTPS invocations | complying |
| Cloud SQL db not enforcing SSL | complying |
| Cloud SQL instance requires SSL connections | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| Deprecated SSL Protocol Usage Detected | complying |
| DNSSEC is disabled | complying |
| DNSSEC is enabled for all managed zones | complying |
| Docker image repository not encrypted at rest | complying |
| Elasticsearch domain is not encrypted at rest | complying |
| Elasticsearch domain might have outdated TLS version | complying |
| Ensure all data stored in the RDS is securely encrypted at rest | complying |
| Express is not emitting security headers | complying |
| Firewall rules restrict public ingress to port 2484 | complying |
| Firewall rules restrict public ingress to port 636 | complying |
| HTTP Client misconfigured with SSL validation disabled | complying |
| Insecure gRPC connection can lead to remote code execution | complying |
| Insecure gRPC connection can lead to remote code execution | complying |
| Insecure HTTP Request detected | complying |
| Insecure TLS configuration detected | complying |
| Insecure usage of `requests` sends data over cleartext | complying |
| Insecure websocket connection sends data over cleartext | complying |
| KMS keys have key rotation enabled | complying |
| Load balancer allows invalid HTTP headers | complying |
| Load balancer allows unencrypted or encrypted traffic with outdated TLS policy | complying |
| Load Balancers only accept HTTPS connections | complying |
| NodeJS talks to database without encryption | complying |
| NodeJS talks to database without encryption | complying |
| Outbound Ansible connections are not encrypted | complying |
| Outbound Ansible connections are not encrypted | complying |
| Server certificates are not verified during SSL/TLS connections | complying |
| Server hostnames not verified during SSL/TLS connections | complying |
| Signature validation for dnf packages is off | complying |
| SNS topics are not encrypted at rest | complying |
| SQS queue data is not encrypted | complying |
| SSL certificate verification turned off during requests | complying |
| SSL certificate verification turned off during requests | complying |
| Storage account does not enforce HTTPS-only traffic | complying |
| TLS Certificate Validation Disabled | complying |
| TLS Certificate Validation Disabled | complying |
| Turning off TLS verification enables man-in-the-middle attacks | complying |
| Using potentially unsafe FTP connections to move data | complying |
| Using potentially unsafe FTP connections to move data | complying |
| Virtual Machines have confidential computing enabled | complying |
| Weak SSL/TLS protocols used | complying |
Uses secure cookies
| Control | Status |
|---|---|
| Cookie missing HttpOnly flag | complying |
| Laravel cookies can be sent unencrypted | complying |
Uses up-to-date cryptographic libraries
| Control | Status |
|---|---|
| Hashes should include an unpredictable salt | complying |
| Usage of deprecated or broken encryption detected | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Use of broken or outdated encryption | complying |
| Using deprecated cryptographic library | complying |
Requires MFA for cloud users
| Control | Status |
|---|---|
| Users are logging in securely | complying |