| Clause | Control Pillar | CE v3.3 Verdict | Technical Finding | Required Remediation |
|---|---|---|---|---|
| CE33-A1.4 | 1. Firewalls, Cloud Scope & Home VPN All SaaS/PaaS Cloud Services & Home-Worker VPN Boundary Documented |
PASS | 5/5 Cloud services (M365, Intune, Xero, GitHub, Cloudflare) documented in register; host firewall + full-tunnel VPN enforced for home workers. | Maintain Cloud-Asset-And-Shadow-IT-Register.csv quarterly prior to IASME submission. |
| CE33-A4.5-USER | 2. Secure Config, Cloud MFA & Passwordless 100% Cloud MFA (Admins + Users + Service Accounts) & PIN Throttling |
FAIL (AUTO-FAIL RISK) | 2 enabled accounts (contractor.lee@ Guest & svc-legacy-scan@ Service Account) lack MFA registration; CA02 is currently in Report-Only mode. | Switch CA02 from Report-Only to On; disable contractor.lee@; migrate svc-legacy-scan@ to OAuth2 Workload Identity with Named Location IP restriction. |
| CE33-A4.2-DORMANT | 3. User Access Control & Dormancy 1-Day Leaver Offboarding & <=30-Day Account Dormancy Limit |
FAIL | 1 enabled Guest account (contractor.lee@oakfield-legal.co.uk) has 67 days of sign-in inactivity (exceeds 30-day CE v3.3 threshold). | Disable accounts inactive >30 days and enforce automated Entra ID Access Reviews for external guests. |
| CE33-A3.1-PATCH | 4. Security Update Management (14-Day SLA) Supported OS & <=14-Day Patching for CVSS >= 7.0 / CISA KEV |
FAIL (AUTO-FAIL RISK) | Endpoint LON-LT-029 is running End-of-Life Windows 10 22H2 (10.0.19045) with last patch sync 21 days ago (>14-day SLA). | Upgrade LON-LT-029 to Windows 11 24H2 via Intune Feature Update Ring or retire device from corporate network access. |
| CE33-A5.1-MALWARE | 5. Malware Protection & Allowlisting Defender Real-Time Antimalware, Tamper Protection & BitLocker |
PASS | 100% of in-scope Windows 11 and macOS Sequoia endpoints report active antimalware signatures, Tamper Protection, and full-disk encryption. | Retain Intune Endpoint Security Antivirus compliance snapshot for assessor verification. |