Coverage
What each system's read proves.
For each system it connects: the permission the read needs, every check that read gives evidence for, how long one read stands before the check is stale, the clauses each check maps to, and what the check cannot see there. Written from the checks' own code.
The matrix
Choose a system to see its checks.
51 of the 72 checks read these 15 systems; the other 21 check records and registers. Written from the checks' own code
Choose a system
AWS
Ready to connect
Connected with: An IAM user's access key, with only the SecurityAudit policy.
Admin access is approved and uses two-step sign-in
High- Needs
- As the directory's own read
- Stands for
- each event, as it arrives
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)NIS2 Article 21(2)(i)NIS2 Article 21(2)(j)DORA Article 9ISO/IEC 27001 A.5.15ISO/IEC 27001 A.5.18ISO/IEC 27001 A.8.2ISO/IEC 27001 A.8.5
- What it cannot see
- Approval is recorded in Eurus; two-step sign-in is as the directory reports it.
Outside access is analysed
Low- Needs
- An IAM user with the AWS managed policy SecurityAudit (access-analyzer:ListAnalyzers)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)ISO/IEC 27001 A.5.15ISO/IEC 27001 A.8.2
- What it cannot see
- The home region.
Remote admin ports are closed to the internet
High- Needs
- An IAM user with the AWS managed policy SecurityAudit (ec2:DescribeSecurityGroups)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)DORA Article 9ISO/IEC 27001 A.8.20
- What it cannot see
- The home region only; network ACLs and firewalls in front are not read.
Activity in the cloud account is logged
High- Needs
- An IAM user with the AWS managed policy SecurityAudit (cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus)
- Stands for
- 2 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)ISO/IEC 27001 A.8.15ISO/IEC 27001 A.8.16
- What it cannot see
- Trails seen from the home region, shadow trails included.
Backups are planned
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (backup:ListBackupPlans)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)DORA Article 12ISO/IEC 27001 A.8.13
- What it cannot see
- Shows a plan exists; which resources it covers, and whether a restore works, are not read.
Configuration changes are recorded
Low- Needs
- An IAM user with the AWS managed policy SecurityAudit (config:DescribeConfigurationRecorderStatus)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)DORA Article 8ISO/IEC 27001 A.8.9ISO/IEC 27001 A.8.15
- What it cannot see
- The home region.
Databases are encrypted
High- Needs
- An IAM user with the AWS managed policy SecurityAudit (rds:DescribeDBInstances)
- Stands for
- 3 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)ISO/IEC 27001 A.8.24
- What it cannot see
- The home region; up to 100 databases.
Databases are private
Critical- Needs
- An IAM user with the AWS managed policy SecurityAudit (rds:DescribeDBInstances)
- Stands for
- 3 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)DORA Article 9ISO/IEC 27001 A.8.20
- What it cannot see
- The home region; up to 100 databases.
New disks are encrypted by default
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (ec2:GetEbsEncryptionByDefault)
- Stands for
- 3 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)ISO/IEC 27001 A.8.24
- What it cannot see
- The home region given when connecting; other regions are not read.
Cloud access keys are replaced regularly
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (iam:GetCredentialReport)
- Stands for
- 2 days
- Maps to
- NIS2 Article 21(1) to (4)ISO/IEC 27001 A.5.17ISO/IEC 27001 A.8.5
- What it cannot see
- Nothing known.
Encryption keys are rotated
Low- Needs
- An IAM user with the AWS managed policy SecurityAudit (kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)ISO/IEC 27001 A.8.24
- What it cannot see
- The home region; up to 100 keys.
IAM passwords are at least 14 characters
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (iam:GetAccountPasswordPolicy)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)ISO/IEC 27001 A.5.17
- What it cannot see
- Nothing known.
The cloud account's root user is locked down
Critical- Needs
- An IAM user with the AWS managed policy SecurityAudit (iam:GetCredentialReport)
- Stands for
- 2 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)DORA Article 9ISO/IEC 27001 A.8.2ISO/IEC 27001 A.8.5
- What it cannot see
- Nothing known.
No S3 bucket is open to the public
Critical- Needs
- An IAM user with the AWS managed policy SecurityAudit (s3:GetAccountPublicAccessBlock, s3:ListAllMyBuckets, s3:GetBucketPolicyStatus)
- Stands for
- 3 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)DORA Article 9ISO/IEC 27001 A.8.3ISO/IEC 27001 A.8.12
- What it cannot see
- Reads up to 200 buckets; the rest count as not read.
Threat detection is on
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (guardduty:ListDetectors, guardduty:GetDetector)
- Stands for
- 3 days
- Maps to
- NIS2 Article 21(1) to (4)DORA Article 10ISO/IEC 27001 A.8.16
- What it cannot see
- The home region; other regions are not read.
Audit trail files can be proved untouched
Low- Needs
- An IAM user with the AWS managed policy SecurityAudit (cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus)
- Stands for
- 2 days
- Maps to
- NIS2 Article 21(1) to (4)ISO/IEC 27001 A.8.15
- What it cannot see
- Nothing known.
Accounts nobody uses are switched off
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (iam:GetCredentialReport)
- Stands for
- 2 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)DORA Article 9ISO/IEC 27001 A.5.18ISO/IEC 27001 A.8.2
- What it cannot see
- Counts an IAM user's console sign-in and an access key's last use; a key never used counts from the day it was read.
Every account uses two-step sign-in
Medium- Needs
- An IAM user with the AWS managed policy SecurityAudit (iam:GetCredentialReport)
- Stands for
- 2 days
- Maps to
- GDPR Article 32(1)NIS2 Article 21(1) to (4)NIS2 Article 21(2)(j)DORA Article 9ISO/IEC 27001 A.5.15ISO/IEC 27001 A.8.5
- What it cannot see
- IAM users with a console password; users with access keys only sign in as programs and are left out.
Out of reach from this system
- Regions other than the home region: One region is read for services that are regional; IAM, S3 and CloudTrail are read for the whole account.
- What is inside S3, databases and secrets: SecurityAudit lists and describes; Eurus reads no data.
Evidence that has an age
A pass while its read is fresh
A check on a system's read counts as kept only while its latest read is within the window shown. Past it, the check is stale.
Partial, when a part was refused
Where the system refused part of the read, the check is partial, and the part it could not see is named.
Limits said beside each check
Each check says what it cannot see: a setting the system does not report, or one that rests on what the system says.
Try this in a copy of your own, for two hours, with nothing to sign up for.
Open your own copyThe law the library holds
Three parts, counted from the rows. The FourWinds law catalogue covers personal data, technology and security, and selling to consumers, as fourwinds.ie sets out under How we check the law. Eurus adds DORA's 20 articles and NIS2's 10 Article 21(2) measures, and a register of 120 more duties from 83 EU and Irish laws: 35 an employer keeps, 6 on anti-money laundering and sanctions, and 20 for financial services, among others.
What the checks test
The automated checks map to the laws and the standard the compliance page names. The register's duties are recorded and tracked by the audit, the requirements and the clocks.
Read against the official text
Each duty in the register says what it asks, who it binds, what shows it, and the official text it was read against, with the date.
Each row with its source
Every DORA and NIS2 row carries the address of its text in the Official Journal.
Independent review
No duty has had an independent review yet. A review pack holds every duty in the register, as it now reads, with a box for each.
Start here
See it on a business of your own.
Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.