Mockup persona switcherHome for:

The product picks the home from the user's role, chosen on the onboarding role-card picker (Gamma e584c14b, Vapi 7f28fb45).

Your queue, Tom

10 things need you · 2 overdue · Northbridge fieldwork ends Oct 17

Returned to you

2Fix and resubmit to Marcus

3.5.3[b]
MFA is implemented for local access to privileged accounts.IMP-0353b
MLMarcus Lee returned this 10-10: “Say which servers are excluded and reference CAPA-024 so the assessor sees the known gap.”
Missing:WhoWhereWhen
Due 10-14
Local console logon to enclave servers requires Duo for Windows Logon with a FIDO2 key [1]. Applies to 8 of 12 enclave servers; cad-lic-01, eng-fs-02, nx-build-03 and cad-lic-02 run an unsupported OS build and are tracked in CAPA-024 with a jump-host compensating control. IT Operations verifies enrollment monthly.
Answers:
Answer all five prompts to resubmit (click a prompt once the text covers it).
3.8.9
Protect the confidentiality of backup CUI at storage locationsIMP-0809
MLMarcus Lee returned this 10-06: “Too thin, and the vendor evidence is expired. Describe key management and where backups live.”
Missing:WhoHowWhereWhenVND-009 expired
Due 10-20

Assessor requests assigned to you

3Rachel Kim · Northbridge C3PAO · final-form evidence only

3.12.4[b]
Updated system boundary diagram showing the M365 GCC High tenant and on-prem enclave interconnects.
REQ-014 · requested Oct 10 · Your reply: SSP v2.4 with the boundary update is with Marcus for approval.
Due Oct 14
3.5.3[b]
Duo for Windows Logon configuration export for the 4 sampled enclave servers.
REQ-013 · requested Oct 8 · Your reply: Exports attached (EVD-0318…0321). cad-lic-01 and eng-fs-02 are covered by CAPA-024.
With assessor
3.1.12[d]
Remote access session logs (VPN + RDP gateway) for 10 sampled sessions in the last 30 days.
REQ-012 · requested Oct 7
Was due Oct 10

Evidence backing your statements

3Expired evidence breaks the statement for the assessor

EVD-0302
Access review sign-off — ERP Q2.xlsx
Backs IMP-0353a · 3.5.3[a]
Expires Oct 14
EVD-0288
Firewall rule export.txt
Backs 3.13.1[a] · 2 statements
Expired Jul 11
VND-009
Atlas Cloud Backup — SOC 2 report
Backs IMP-0809 · 3.8.9
Expired Sep 1
POL-004
Access Control Policy v3.0
Changing · §4.3 is cited by IMP-0353, IMP-0353b, IMP-0350 — re-check citations
In review
PRC-011
User Access Provisioning Procedure v2.1
You own this · annual review due 2026-12-20
Published

CAPA actions you own

2CAPA-024 · Enforce MFA on local privileged console access · from FND-031 (Major NC)

Upgrade cad-lic-01 to a Duo-supported OS buildCAPA-024Due Oct 24
Install Duo for Windows Logon on eng-fs-02 and nx-build-03CAPA-024Due Oct 31
Document interim compensating control (jump host only)CAPA-024Done
Stage: Action plan · plan with Marcus for approval · CAPA due 2026-11-15

Patterns: Vanta evidence readiness, Jira 463a7839 comments in context, Aboard 002ebeab approver chain, Vanta category progress ecd5d521.

Continue writing

1 of 6 unwritten

3.1.12[a]5-point

3.1.12 Monitor and control remote access sessions

Determine if: Remote access sessions are permitted.

Who?What?How?Where?When?

Suggested sources

PLN-002 SSP §5.1 remote access

AST-0097 M365 GCC High

PRC-011 §4 VPN provisioning

My controls

7 families · 211 objectives

Statements written22 of 24
3.5Identification and AuthenticationApproved
3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accountsIn review
3.5.3[a]Privileged accounts are identified.Approved
3.5.3[b]MFA is implemented for local access to privileged accounts.Returned
3.5.3[c]MFA is implemented for network access to privileged accounts.Approved
3.5.3[d]MFA is implemented for network access to non-privileged accounts.Approved