Configuration drift, scored as it lands

Change impact

7 changes on the security estate reduced assurance on 10 controls and moved 2 CCSA domain tiers. The first time anyone learns a control moved should not be the exam.

MFA exception for the legacy branch group outlived its approval
Entra ID · System · 9 h ago
```
Policy CA-014 · exclusion GRP-BRANCH-OPS-LEGACY
Exception approval expired 63 days ago; exclusion still in place
Members still excluded: 84
```
PR-02Phishing-resistant MFA for privileged accessEvidenced → Partial
Three new service accounts hold domain privilege outside the vault
Privilege Cloud · Discovery · 26 h ago
```
New unmanaged privileged accounts: SVC-RECON-ETL, SVC-SWIFT-GW, SVC-CORE-BATCH
All three: domain-privileged, no rotation, oldest credential 604 days
```
PR-01Privileged accounts are vaulted and attributablePartial → Gap
Model-provider traffic found leaving a production segment, outside the gateway
Panorama · Discovery · 34 h ago
```
New destination pattern on ALLOW-APP-EGRESS-443 from PROD-APP-BRANCHKB
Commercial model API endpoints · TLS not decrypted · 6.4 GB in 7 days
```
GV-02Every AI system is inventoried and observablePartial → Gap PR-09Prompts leaving the bank are inspectedEvidenced → Gap
Core banking log retention cut from 365 to 180 days for licence headroom
Enterprise · jdelacruz · 2 days ago
```
Index cbs_app · frozenTimePeriodInSecs 31536000 → 15552000
Change record: none · commit message: licence headroom
```
DE-01Security logs are kept for the required periodEvidenced → Gap
Payments gateway passed 12 months without a restore test
Security Cloud · System · 3 days ago
```
Tier-one SLA requires an isolated restore test every 12 months
Payments gateway: last tested 16 months ago · card management: 14 months ago
```
RC-02Restores are tested every yearEvidenced → Gap CCSA Recover: Established → Foundational
Branch refresh added 740 hosts the CMDB does not hold
Falcon · System · 4 days ago
```
New hosts reporting: 740 over 14 days
Matched to CMDB: 0 · prevention policy applied: 4
```
ID-01Asset inventory matches the networkEvidenced → Partial PR-08Endpoint protection runs on every hostEvidenced → Partial CCSA Identify: Foundational → Below Foundational
Permissive corporate-to-cardholder rule committed during the payments migration
Panorama · rmontero · 9 days ago
```
Commit 4471 · device group CDE-EDGE
+ TEMP-MIGRATION-CDE-DB  src CORP-ANY  dst CDE-DB-TIER  svc tcp/1521  allow
No expiry · change record: none · peer review: none
```
PR-06Cardholder and SWIFT zones are segmentedEvidenced → Gap PR-07Security changes follow approved change recordsPartial → Gap

Change impact

Search

Change impact