Evidence for review
Root causeAction planFiles · 3
Root-cause analysis · Ishikawa (6M)
CAPA-024 · approved Oct 6 by Dana WhitfieldMethod · root
- –No coverage reconciliation in PRC-014
- –Rollout tracker counts attempts
Machine
- –Windows Server 2012 R2 unsupported
- –Agent install fails silently
Man
- –Rollout owned by one engineer
- –No peer review of exclusions
Password-only privileged console logon on 4 enclave servers
Material
- –Duo agent v4 drops 2012 R2
Measurement
- –Coverage KPI excludes servers
Environment
- –Enclave scope added after the rollout
Root cause: Change procedure PRC-014 lacks a coverage reconciliation step, so legacy servers excluded from the Duo rollout (unsupported OS build) were never raised as exceptions.
Proposed action plan
Submitted Oct 9 by Tom Okafor · 5 actions- A1Upgrade the 4 servers to Windows Server 2022 or isolate them behind a jump hostTO2026-11-01
- A2Deploy Duo Windows Logon with offline MFA to all enclave serversTO2026-11-05
- A3Revise PRC-014 with a coverage-reconciliation step against the asset inventoryML2026-11-08
- A4Add "MFA coverage = 100% of enclave hosts" KRI to the dashboardDW2026-11-10
- A5Re-score RSK-039 and update the POA&M entry for 3.5.3DW2026-11-15
Effectiveness criteria: 0 password-only privileged console logons across all enclave hosts for 90 consecutive days (Sentinel query), and 100% Duo coverage on two monthly reconciliations.
Duo coverage report — enclave.pdf
Asset inventory reconciliation.xlsx
PRC-014 redline draft.docx