Assess
Migration Control Library
Structured library of Directory migration controls. Each control traces to tests, findings and evidence.
Pass126
Action required13
Critical5
Not assessed5
Exception0
149 of 149
| Method | Evidence | |||||||
|---|---|---|---|---|---|---|---|---|
| DIR-001 | Directory API endpoint migrated | Directory API | Critical | 3 | Configuration scan | CRITICAL | 3 | 10 Sept, 01:20 |
| DIR-002 | Directory API v2.2 supported | Directory API | High | 2 | API probe | ACTION REQUIRED | 1 | 11 Sept, 02:20 |
| OAUTH-001 | New token endpoint configured | OAuth & Authentication | High | 2 | Static analysis | PASS | 1 | 12 Sept, 03:20 |
| OAUTH-002 | OAuth audience uses new issuer | OAuth & Authentication | Critical | 1 | Network probe | CRITICAL | 2 | 10 Sept, 04:20 |
| OAUTH-003 | Directory OAuth scopes migrated | OAuth & Authentication | Medium | 1 | Certificate inspection | ACTION REQUIRED | — | 11 Sept, 05:20 |
| SCIM-001 | Legacy SCIM dependency removed | TPP Registration | High | 2 | Engineer attestation | ACTION REQUIRED | — | 12 Sept, 06:20 |
| JWKS-001 | RFC 7517 JWKS content type supported | JWKS | Medium | 2 | Architecture review | ACTION REQUIRED | 1 | 10 Sept, 07:20 |
| JWKS-002 | Signing keys selected dynamically using kid | JWKS | Critical | 1 | Configuration scan | CRITICAL | 1 | 11 Sept, 08:20 |
| PKI-001 | Keyfactor trust chain installed | PKI | Critical | 4 | API probe | CRITICAL | 5 | 12 Sept, 01:20 |
| PKI-002 | Entrust and Keyfactor dual trust supported | PKI | Critical | 2 | Static analysis | PASS | 3 | 10 Sept, 02:20 |
| PKI-003 | No hard-coded Entrust issuer assumptions | PKI | High | 2 | Network probe | ACTION REQUIRED | — | 11 Sept, 03:20 |
| PKI-004 | 4096-bit issuing CA supported | PKI | High | 3 | Certificate inspection | PASS | 1 | 12 Sept, 04:20 |
| PKI-005 | Certificate path building validated | Certificate Validation | High | 1 | Engineer attestation | PASS | 1 | 10 Sept, 05:20 |
| REV-001 | Keyfactor OCSP connectivity validated | Revocation | High | 3 | Architecture review | PASS | 2 | 11 Sept, 06:20 |
| REV-002 | Keyfactor CRL connectivity validated | Revocation | Medium | 2 | Configuration scan | ACTION REQUIRED | 1 | 12 Sept, 07:20 |
| TPP-001 | TPP organisation lookup validated | TPP Registration | High | 1 | API probe | PASS | 2 | 10 Sept, 08:20 |
| TPP-002 | TPP role/permission validation confirmed | TPP Registration | Critical | 2 | Static analysis | CRITICAL | 2 | 11 Sept, 01:20 |
| TPP-003 | TPP certificate validation confirmed | Certificate Validation | High | 2 | Network probe | PASS | 2 | 12 Sept, 02:20 |
| SSA-001 | SSA signature validation confirmed | SSA | High | 1 | Certificate inspection | PASS | 2 | 10 Sept, 03:20 |
| DIR-003 | Directory API TLS 1.2+ enforced | Directory API | Low | 2 | API probe | PASS | 1 | 09 Sept, 11:05 |
| DIR-004 | Directory rate-limit handling | Directory API | Low | 2 | Static analysis | PASS | 1 | 10 Sept, 12:05 |
| DIR-005 | Directory API error handling | Directory API | Low | 2 | Network probe | PASS | — | 11 Sept, 13:05 |
| DIR-006 | Directory pagination supported | Directory API | Medium | 2 | Certificate inspection | PASS | 1 | 12 Sept, 14:05 |
| DIR-007 | Directory API retry policy | Directory API | Low | 2 | Engineer attestation | PASS | 1 | 08 Sept, 15:05 |
| DIR-008 | Directory health probe configured | Directory API | Low | 2 | Architecture review | PASS | 1 | 09 Sept, 16:05 |
| DIR-009 | Directory API timeout tuned | Directory API | Low | 1 | Configuration scan | PASS | 1 | 10 Sept, 17:05 |
| DIR-010 | Directory API logging redacted | Directory API | Medium | 2 | API probe | PASS | 1 | 11 Sept, 18:05 |
| OAUTH-004 | Client credentials flow uses private_key_jwt | OAuth & Authentication | High | 2 | Static analysis | PASS | 1 | 12 Sept, 10:05 |
| OAUTH-005 | Token cache TTL within limits | OAuth & Authentication | Low | 2 | Network probe | PASS | — | 08 Sept, 11:05 |
| OAUTH-006 | Token endpoint mTLS bound | OAuth & Authentication | Low | 2 | Certificate inspection | NOT ASSESSED | — | — |
| OAUTH-007 | Refresh of Directory tokens automated | OAuth & Authentication | Medium | 2 | Engineer attestation | PASS | 1 | 10 Sept, 13:05 |
| OAUTH-008 | OAuth error mapping | OAuth & Authentication | Low | 2 | Architecture review | PASS | 1 | 11 Sept, 14:05 |
| OAUTH-009 | Clock skew tolerance configured | OAuth & Authentication | Low | 1 | Configuration scan | PASS | 1 | 12 Sept, 15:05 |
| OAUTH-010 | Token introspection migrated | OAuth & Authentication | Low | 2 | API probe | PASS | 1 | 08 Sept, 16:05 |
| OAUTH-011 | OAuth logging redacted | OAuth & Authentication | Medium | 2 | Static analysis | PASS | 1 | 09 Sept, 17:05 |
| TPP-004 | DCR request schema v3.3 | TPP Registration | Low | 2 | Network probe | PASS | 1 | 10 Sept, 18:05 |
| TPP-005 | Registration idempotency | TPP Registration | High | 2 | Certificate inspection | PASS | — | 11 Sept, 10:05 |
| TPP-006 | Software statement revocation handled | TPP Registration | Low | 2 | Engineer attestation | ACTION REQUIRED | — | 12 Sept, 11:05 |
| TPP-007 | Redirect URI validation | TPP Registration | Medium | 2 | Architecture review | PASS | 1 | 08 Sept, 12:05 |
| TPP-008 | Registration audit trail | TPP Registration | Low | 1 | Configuration scan | PASS | 1 | 09 Sept, 13:05 |
| TPP-009 | Legacy DCR adapter decommission plan | TPP Registration | Low | 2 | API probe | PASS | 1 | 10 Sept, 14:05 |
| TPP-010 | Duplicate client detection | TPP Registration | Low | 2 | Static analysis | PASS | 1 | 11 Sept, 15:05 |
| TPP-011 | Registration rate limiting | TPP Registration | Medium | 2 | Network probe | PASS | 1 | 12 Sept, 16:05 |
| SSA-002 | SSA expiry enforced | SSA | Low | 2 | Certificate inspection | PASS | 1 | 08 Sept, 17:05 |
| SSA-003 | SSA issuer validated | SSA | Low | 2 | Engineer attestation | PASS | — | 09 Sept, 18:05 |
| SSA-004 | SSA software roles mapped | SSA | High | 2 | Architecture review | PASS | 1 | 10 Sept, 10:05 |
| SSA-005 | SSA org_jwks_endpoint honoured | SSA | Medium | 1 | Configuration scan | PASS | 1 | 11 Sept, 11:05 |
| SSA-006 | SSA revocation checked | SSA | Low | 2 | API probe | PASS | 1 | 12 Sept, 12:05 |
| SSA-007 | SSA schema validation | SSA | Low | 2 | Static analysis | PASS | 1 | 08 Sept, 13:05 |
| SSA-008 | SSA claims logged | SSA | Low | 2 | Network probe | PASS | 1 | 09 Sept, 14:05 |
| JWKS-003 | JWKS cache refresh on rotation | JWKS | Medium | 2 | Certificate inspection | PASS | 1 | 10 Sept, 15:05 |
| JWKS-004 | JWKS endpoint TLS validated | JWKS | Low | 2 | Engineer attestation | ACTION REQUIRED | — | 11 Sept, 16:05 |
| JWKS-005 | Unknown kid triggers refetch | JWKS | Low | 2 | Architecture review | PASS | — | 12 Sept, 17:05 |
| JWKS-006 | JWKS size limits | JWKS | Low | 1 | Configuration scan | PASS | 1 | 08 Sept, 18:05 |
| JWKS-007 | JWKS negative caching | JWKS | High | 2 | API probe | PASS | 1 | 09 Sept, 10:05 |
| JWKS-008 | JWKS fetch timeout | JWKS | Low | 2 | Static analysis | NOT ASSESSED | — | — |
| JWKS-009 | JWKS x5c chain validated | JWKS | Low | 2 | Network probe | PASS | 1 | 11 Sept, 12:05 |
| CERT-001 | Certificate expiry monitoring | Certificates | Low | 2 | Certificate inspection | PASS | 1 | 12 Sept, 13:05 |
| CERT-002 | SAN/CN policy enforced | Certificates | Medium | 2 | Engineer attestation | PASS | 1 | 08 Sept, 14:05 |
| CERT-003 | EKU validation | Certificates | Low | 2 | Architecture review | PASS | 1 | 09 Sept, 15:05 |
| CERT-004 | Certificate inventory complete | Certificates | Low | 1 | Configuration scan | PASS | — | 10 Sept, 16:05 |
| CERT-005 | QWAC/QSealC distinction | Certificates | Low | 2 | API probe | PASS | 1 | 11 Sept, 17:05 |
| CERT-006 | Certificate pinning removed | Certificates | Medium | 2 | Static analysis | PASS | 1 | 12 Sept, 18:05 |
| CERT-007 | Key usage validated | Certificates | High | 2 | Network probe | PASS | 1 | 08 Sept, 10:05 |
| CERT-008 | Certificate renewal runbook | Certificates | Low | 2 | Certificate inspection | PASS | 1 | 09 Sept, 11:05 |
| CERT-009 | Signing certificate rotation tested | Certificates | Low | 2 | Engineer attestation | PASS | 1 | 10 Sept, 12:05 |
| CERT-010 | Transport certificate rotation tested | Certificates | Medium | 2 | Architecture review | ACTION REQUIRED | — | 11 Sept, 13:05 |
| CERT-011 | Certificate CN policy for sandbox | Certificates | Low | 1 | Configuration scan | PASS | 1 | 12 Sept, 14:05 |
| CERT-012 | Wildcard certificates prohibited | Certificates | Low | 2 | API probe | PASS | — | 08 Sept, 15:05 |
| CERT-013 | Certificate issuance SLA | Certificates | Low | 2 | Static analysis | PASS | 1 | 09 Sept, 16:05 |
| PKI-006 | Keyfactor root distributed | PKI | Medium | 2 | Network probe | PASS | 1 | 10 Sept, 17:05 |
| PKI-007 | Cross-certificate handled | PKI | Low | 2 | Certificate inspection | PASS | 1 | 11 Sept, 18:05 |
| PKI-008 | Policy OID validation | PKI | High | 2 | Engineer attestation | PASS | 1 | 12 Sept, 10:05 |
| PKI-009 | Chain depth limits | PKI | Low | 2 | Architecture review | PASS | 1 | 08 Sept, 11:05 |
| PKI-010 | PKI change management | PKI | Medium | 1 | Configuration scan | PASS | 1 | 09 Sept, 12:05 |
| PKI-011 | HSM key ceremony evidence | PKI | Low | 2 | API probe | PASS | — | 10 Sept, 13:05 |
| PKI-012 | CA bundle version pinned | PKI | Low | 2 | Static analysis | ACTION REQUIRED | — | 11 Sept, 14:05 |
| PKI-013 | PKI monitoring alerts | PKI | Low | 2 | Network probe | PASS | 1 | 12 Sept, 15:05 |
| TS-001 | Trust store inventory complete | Trust Stores | Medium | 2 | Certificate inspection | PASS | 1 | 08 Sept, 16:05 |
| TS-002 | Trust store version control | Trust Stores | Low | 2 | Engineer attestation | PASS | 1 | 09 Sept, 17:05 |
| TS-003 | Trust store distribution automated | Trust Stores | Low | 2 | Architecture review | PASS | 1 | 10 Sept, 18:05 |
| TS-004 | Trust store rollback tested | Trust Stores | High | 1 | Configuration scan | NOT ASSESSED | — | — |
| TS-005 | No expired anchors present | Trust Stores | Medium | 2 | API probe | PASS | 1 | 12 Sept, 11:05 |
| TS-006 | Trust store access controlled | Trust Stores | Low | 2 | Static analysis | PASS | 1 | 08 Sept, 12:05 |
| TS-007 | Trust store checksum verified | Trust Stores | Low | 2 | Network probe | PASS | — | 09 Sept, 13:05 |
| TS-008 | Sandbox trust store aligned | Trust Stores | Low | 2 | Certificate inspection | PASS | 1 | 10 Sept, 14:05 |
| TS-009 | Trust store change alerting | Trust Stores | Medium | 2 | Engineer attestation | PASS | 1 | 11 Sept, 15:05 |
| TS-010 | Trust store owner assigned | Trust Stores | Low | 2 | Architecture review | PASS | 1 | 12 Sept, 16:05 |
| TS-011 | Trust store backup verified | Trust Stores | Low | 1 | Configuration scan | PASS | 1 | 08 Sept, 17:05 |
| TS-012 | Legacy anchors removal plan | Trust Stores | Low | 2 | API probe | PASS | 1 | 09 Sept, 18:05 |
| CV-001 | Revocation failure policy defined | Certificate Validation | High | 2 | Static analysis | PASS | 1 | 10 Sept, 10:05 |
| CV-002 | Soft-fail configuration reviewed | Certificate Validation | Low | 2 | Network probe | PASS | — | 11 Sept, 11:05 |
| CV-003 | Validation latency SLO | Certificate Validation | Low | 2 | Certificate inspection | PASS | 1 | 12 Sept, 12:05 |
| CV-004 | Validation cache TTL | Certificate Validation | Low | 2 | Engineer attestation | PASS | 1 | 08 Sept, 13:05 |
| CV-005 | Name constraints handled | Certificate Validation | Medium | 2 | Architecture review | PASS | 1 | 09 Sept, 14:05 |
| CV-006 | Validation errors alerted | Certificate Validation | Low | 1 | Configuration scan | ACTION REQUIRED | — | 10 Sept, 15:05 |
| CV-007 | Validation service HA | Certificate Validation | Low | 2 | API probe | PASS | 1 | 11 Sept, 16:05 |
| NET-001 | Egress allow-list updated | Network Connectivity | Low | 2 | Static analysis | PASS | 1 | 12 Sept, 17:05 |
| NET-002 | DNS resolution for new endpoints | Network Connectivity | Medium | 2 | Network probe | PASS | 1 | 08 Sept, 18:05 |
| NET-003 | Firewall rules for OCSP | Network Connectivity | High | 2 | Certificate inspection | PASS | — | 09 Sept, 10:05 |
| NET-004 | Firewall rules for CRL | Network Connectivity | Low | 2 | Engineer attestation | PASS | 1 | 10 Sept, 11:05 |
| NET-005 | Proxy authentication configured | Network Connectivity | Low | 2 | Architecture review | PASS | 1 | 11 Sept, 12:05 |
| NET-006 | Network latency baseline | Network Connectivity | Medium | 1 | Configuration scan | PASS | 1 | 12 Sept, 13:05 |
| NET-007 | TLS inspection bypass | Network Connectivity | Low | 2 | API probe | PASS | 1 | 08 Sept, 14:05 |
| NET-008 | Sandbox connectivity validated | Network Connectivity | Low | 2 | Static analysis | PASS | 1 | 09 Sept, 15:05 |
| NET-009 | Failover path validated | Network Connectivity | Low | 2 | Network probe | PASS | 1 | 10 Sept, 16:05 |
| NET-010 | MTU / fragmentation validated | Network Connectivity | Medium | 2 | Certificate inspection | PASS | — | 11 Sept, 17:05 |
| NET-011 | Egress logging enabled | Network Connectivity | Low | 2 | Engineer attestation | NOT ASSESSED | — | — |
| GW-001 | Gateway client cert forwarding | API Gateway | High | 2 | Architecture review | PASS | 1 | 08 Sept, 10:05 |
| GW-002 | Gateway header sanitisation | API Gateway | Low | 1 | Configuration scan | PASS | 1 | 09 Sept, 11:05 |
| GW-003 | Gateway policy versioning | API Gateway | Medium | 2 | API probe | PASS | 1 | 10 Sept, 12:05 |
| GW-004 | Gateway certificate cache | API Gateway | Low | 2 | Static analysis | PASS | 1 | 11 Sept, 13:05 |
| GW-005 | Gateway error responses | API Gateway | Low | 2 | Network probe | PASS | 1 | 12 Sept, 14:05 |
| GW-006 | Gateway rate limits | API Gateway | Low | 2 | Certificate inspection | PASS | 1 | 08 Sept, 15:05 |
| GW-007 | Gateway logging | API Gateway | Medium | 2 | Engineer attestation | PASS | — | 09 Sept, 16:05 |
| GW-008 | Gateway rollback tested | API Gateway | Low | 2 | Architecture review | PASS | 1 | 10 Sept, 17:05 |
| IAM-001 | Client store migration | IAM | Low | 1 | Configuration scan | PASS | 1 | 11 Sept, 18:05 |
| IAM-002 | IAM HA validated | IAM | High | 2 | API probe | PASS | 1 | 12 Sept, 10:05 |
| IAM-003 | IAM config as code | IAM | Medium | 2 | Static analysis | PASS | 1 | 08 Sept, 11:05 |
| IAM-004 | IAM secrets rotated | IAM | Low | 2 | Network probe | PASS | 1 | 09 Sept, 12:05 |
| IAM-005 | IAM audit logging | IAM | Low | 2 | Certificate inspection | PASS | 1 | 10 Sept, 13:05 |
| IAM-006 | IAM performance test | IAM | Low | 2 | Engineer attestation | PASS | — | 11 Sept, 14:05 |
| IAM-007 | IAM rollback tested | IAM | Medium | 2 | Architecture review | ACTION REQUIRED | — | 12 Sept, 15:05 |
| IAM-008 | IAM Sandbox parity | IAM | Low | 1 | Configuration scan | PASS | 1 | 08 Sept, 16:05 |
| IAM-009 | IAM client migration dry-run | IAM | Low | 2 | API probe | PASS | 1 | 09 Sept, 17:05 |
| IAM-010 | IAM certificate bound tokens | IAM | Low | 2 | Static analysis | PASS | 1 | 10 Sept, 18:05 |
| REV-003 | OCSP stapling enabled | Revocation | High | 2 | Network probe | PASS | 1 | 11 Sept, 10:05 |
| REV-004 | OCSP response caching | Revocation | Low | 2 | Certificate inspection | PASS | 1 | 12 Sept, 11:05 |
| REV-005 | CRL size handling | Revocation | Low | 2 | Engineer attestation | PASS | 1 | 08 Sept, 12:05 |
| REV-006 | Revocation check timeout | Revocation | Low | 2 | Architecture review | PASS | — | 09 Sept, 13:05 |
| REV-007 | Revocation monitoring | Revocation | Medium | 1 | Configuration scan | PASS | 1 | 10 Sept, 14:05 |
| REV-008 | Revocation soft-fail alerting | Revocation | Low | 2 | API probe | PASS | 1 | 11 Sept, 15:05 |
| OPS-001 | Runbooks updated | Operational Readiness | Low | 2 | Static analysis | PASS | 1 | 12 Sept, 16:05 |
| OPS-002 | On-call briefed | Operational Readiness | Low | 2 | Network probe | NOT ASSESSED | — | — |
| OPS-003 | Monitoring dashboards updated | Operational Readiness | Medium | 2 | Certificate inspection | PASS | 1 | 09 Sept, 18:05 |
| OPS-004 | Alerting thresholds tuned | Operational Readiness | High | 2 | Engineer attestation | PASS | 1 | 10 Sept, 10:05 |
| OPS-005 | Rollback plan approved | Operational Readiness | Low | 2 | Architecture review | PASS | 1 | 11 Sept, 11:05 |
| OPS-006 | Cutover communications plan | Operational Readiness | Low | 1 | Configuration scan | PASS | — | 12 Sept, 12:05 |
| OPS-007 | Incident bridge tested | Operational Readiness | Medium | 2 | API probe | PASS | 1 | 08 Sept, 13:05 |
| OPS-008 | Post-cutover hypercare defined | Operational Readiness | Low | 2 | Static analysis | PASS | 1 | 09 Sept, 14:05 |
| OPS-009 | TPP communications issued | Operational Readiness | Low | 2 | Network probe | ACTION REQUIRED | — | 10 Sept, 15:05 |
| OPS-010 | Change freeze scheduled | Operational Readiness | Low | 2 | Certificate inspection | PASS | 1 | 11 Sept, 16:05 |
| OPS-011 | Capacity validated | Operational Readiness | Medium | 2 | Engineer attestation | PASS | 1 | 12 Sept, 17:05 |
| OPS-012 | Disaster recovery reviewed | Operational Readiness | Low | 2 | Architecture review | PASS | 1 | 08 Sept, 18:05 |
| OPS-013 | Data retention reviewed | Operational Readiness | High | 1 | Configuration scan | PASS | 1 | 09 Sept, 10:05 |
| OPS-014 | Third-party notified | Operational Readiness | Low | 2 | API probe | PASS | — | 10 Sept, 11:05 |
| OPS-015 | Cutover rehearsal completed | Operational Readiness | Medium | 2 | Static analysis | PASS | 1 | 11 Sept, 12:05 |
| OPS-016 | Evidence pack reviewed | Operational Readiness | Low | 2 | Network probe | PASS | 1 | 12 Sept, 13:05 |
| OPS-017 | Go/No-Go criteria agreed | Operational Readiness | Low | 2 | Certificate inspection | PASS | 1 | 08 Sept, 14:05 |