Coverage trace
Every risk followed down to the evidence that proves its controls work. Breaks in the chain are highlighted.
Assessment objectives in this trace5 of 9 met
Met 5 Partial 3 Not met 1
Objectives with current evidence
5 of 9
verified, not expiring
Coverage gaps
4
+ 5 warnings
Findings → CAPA
1 → 1
CAPA-024 in review
Trace from
| Trace | Status | Coverage | Gaps | Owner |
|---|---|---|---|---|
RSK-042Ransomware encrypts engineering file shares containing CUIRisk← CTX-02, CTX-04 | In progress | 2 of 5 | DW | |
3.8.9Protect the confidentiality of backup CUI at storage locationsControl | Partial | 0 of 1 | TO | |
3.8.9[a]The confidentiality of backup CUI is protected at storage locations.Objective | Partial | 1 evidence | Partially met | |
EVD-0296Veeam immutability + encryption config.pngEvidence | Expired | Evidence expired | TO | |
3.13.11Employ FIPS-validated cryptography to protect CUIControl | Partial | 0 of 1 | DW | |
3.13.11[a]FIPS-validated cryptography is employed to protect the confidentiality of CUI.Objective | Partial | 1 evidence | Partially met | |
EVD-0280BitLocker FIPS 140-2 cert #3920.pdfEvidence | Verified | DW | ||
3.5.3Use multifactor authentication for local and network accessControlalso under RSK-039 | Not met | 2 of 3 | DW | |
3.5.3[b]MFA is implemented for local access to privileged accounts.Objective | Not met | 0 evidence | No evidenceNot met | |
FND-031MFA not enforced for local privileged access on 4 of 12 serversFinding | Open | TO | ||
CAPA-024Enforce MFA on local privileged console accessCAPAtreats 3.5.3, RSK-039 | In review | CAPA open | TO | |
3.5.3[c]MFA is implemented for network access to privileged accounts.Objective | Met | 1 evidence | ||
EVD-0311Duo MFA enrollment report — Sep 2026.pdfEvidencealso under 3.5.3[d] | Verified | TO | ||
3.5.3[d]MFA is implemented for network access to non-privileged accounts.Objective | Met | 1 evidence | ||
EVD-0311Duo MFA enrollment report — Sep 2026.pdfEvidencealso under 3.5.3[c] | Verified | TO | ||
RSK-039Privileged admin accounts lack MFA on local console accessRisk← CTX-02, CTX-01 | Overdue | 2 of 3 | TO | |
3.5.3Use multifactor authentication for local and network accessControlalso under RSK-042 | Not met | 2 of 3 | DW | |
3.5.3[b]MFA is implemented for local access to privileged accounts.Objective | Not met | 0 evidence | No evidenceNot met | |
FND-031MFA not enforced for local privileged access on 4 of 12 serversFinding | Open | TO | ||
CAPA-024Enforce MFA on local privileged console accessCAPAtreats 3.5.3, RSK-039 | In review | CAPA open | TO | |
3.5.3[c]MFA is implemented for network access to privileged accounts.Objective | Met | 1 evidence | ||
EVD-0311Duo MFA enrollment report — Sep 2026.pdfEvidencealso under 3.5.3[d] | Verified | TO | ||
3.5.3[d]MFA is implemented for network access to non-privileged accounts.Objective | Met | 1 evidence | ||
EVD-0311Duo MFA enrollment report — Sep 2026.pdfEvidencealso under 3.5.3[c] | Verified | TO | ||
RSK-035Departing engineers retain access to CUI enclaveRisk← CTX-04 | In progress | 3 of 4 | 3 below | SA |
RSK-033Cloud email tenant misconfiguration exposes FCIRisk← CTX-01 | Open | 2 of 2 | 1 below | TO |