AC-2
Access Control
Residual access after termination
Identity still enabled after the recorded termination date, with no unexpired access extension.
CISA CPG 3.D
Control library
Every control, on every platform
13 control objectives from NIST SP 800-53, each with a ready-to-run query for Microsoft Sentinel, AWS Athena and Splunk — 39 in all. Every page states the evidence it needs, the settings you decide, and what a result does not prove.
Platform
Family
Validation
Validation belongs to each platform path. Select a status to highlight only the matching platform queries within each control.
Showing all 13 controls
AC-2(3)
Access Control
Stale privileged access
Privileged role held by an identity with no successful authentication inside the inactivity threshold.
CISA CPG 3.H
AC-6(7)
Access Control
Privileged role without documented ownership
Privileged role lacking a documented owner or justification, or overdue for its required review.
CISA CPG 3.H
IA-2(1)
Identification and Authentication
Privileged access without multifactor authentication
Privileged identity with no MFA enrolled, or observed authenticating with a single factor.
CISA CPG 3.F
IA-5(1)
Identification and Authentication
Credentials past required rotation
Active credential older than the rotation interval, or approaching hard expiry.
AC-7
Access Control
Repeated failed sign-ins without lockout
An account exceeded the defined consecutive-failure threshold within the counting window, and no lockout was recorded during the burst or in the hour following it.
CISA CPG 3.E
AU-9
Audit and Accountability
Audit logging disabled or deleted
Audit logging configuration stopped, deleted, or modified; the reviewer determines whether the actor was authorized.
CISA CPG 3.Q
AU-12
Audit and Accountability
Required audit logging not enabled
Asset declared as requiring audit logging is producing no observed telemetry in the observation window.
CISA CPG 3.Q, 4.B
CM-6 / CM-3
Configuration Management
Configuration deviation without an approved change
Security-relevant configuration differs from the approved baseline with no matching approved change record.
CISA CPG 3.N
SC-7
System and Communications Protection
Unrestricted inbound exposure without approval
Inbound rule permitting unrestricted source access with no current, unexpired entry in the approved exposure register.
CISA CPG 3.S, 3.I
CP-9
Contingency Planning
Backup missing for assets requiring it
Asset declared as requiring backup has no successful backup within twice its recovery point objective.
CISA CPG 3.O
CM-8
Configuration Management
Device active in the estate but absent from the inventory
A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.
CISA CPG 3.R, 2.A
SI-2
System and Information Integrity
Known-exploited vulnerability past its remediation date
An asset still reports an active finding for a CVE in CISA's Known Exploited Vulnerabilities catalogue, after the remediation date CISA published for that entry.
CISA CPG 2.B
No control matches those filters.
What these checks are, and are not
Each check finds a specific, defined condition in systems you already run. Resolving what it finds is your work, and a result is not a compliance determination. Every page says what its own result does not establish.
Lab-validated means the query was executed against a real search engine in a controlled instance on a recorded date. Not tenant-validated means it has passed the automated suites but has not been run anywhere real. The distinction is shown per platform rather than averaged away.