1 partial
Device Inventory
Local device details (hostname, serial, hardware, OS, network adapters). Agent self-reports installed asset. Does NOT include network-wide discovery or DHCP logging.
2 full
Software Inventory
Installed programs (MSI + registry), Windows Store apps, running services, startup programs, browser versions, .NET/Java/Office versions. Supports allowlisting comparison.
3 partial
Data Protection
BitLocker encryption status (TPM, drive encryption, key protectors), NTFS permissions on shares, removable media encryption. Does NOT cover data classification, data flows, or DLP deployment.
4 full
Secure Configuration
Windows Firewall profiles & rules, risky rule detection, session lock/screen saver settings, default account status, unnecessary services, DNS configuration, UAC settings, SMBv1/LLMNR/NetBIOS status, Remote Desktop configuration.
5 full
Account Management
Local user & admin account inventory, service accounts, admin group membership, default Administrator (SID-500) status, dormant account detection, password policy (complexity, age, lockout).
6 partial
Access Control
MFA status for external apps, remote access, and admin accounts via Entra ID Conditional Access policies. Local security policy audit (user rights assignments, logon restrictions). Domain join and Group Policy application status. Does NOT cover documented access granting/revoking processes or RBAC policy definitions.
7 full
Patch and Vulnerability Management
Windows Update service status, installed/pending updates (critical, security), days since last update, auto-update settings, WSUS configuration. Application patch status for known software.
8 full
Audit Logging
Event log configuration (max sizes, retention, overwrite policy), audit policy settings, PowerShell logging status, command-line auditing, Security/System/Application log status, NTP time synchronization.
9 partial
Email and Browser Protection
Installed browser versions and currency, browser extensions inventory, email client versions. Does NOT cover DNS filtering, DMARC, URL filtering, or email server protections.
10 full
Malware Defense
Windows Defender + third-party AV detection, real-time protection, signature age/version, behavior monitoring, scan history, autorun/autoplay settings, exploit protection (ASLR/DEP), Attack Surface Reduction rules.
11 partial
Backup and Recovery
Veeam Backup services, job status/success rates, last run times, repository health. Windows Backup status, System Restore status, VSS service. Does NOT verify isolated recovery instances or test recovery.
12 partial
Network Configuration
VPN connection status, secure protocol configuration (from endpoint), network adapter driver versions. Does NOT assess network device firmware, architecture, or AAA centralization.
13 partial
Network Monitoring
Host-based IDS/IPS agent presence, Windows Firewall logging, remote access settings, connection security rules. Does NOT cover network IDS/IPS, traffic flow logs, port-level access control, or SIEM centralization.
