COVERAGE / STATUS / LIMITS
Useful evidence.
Explicit boundaries.
Review the workflow today with fictional data or a CSV. Use this page to understand the scope of each review before relying on its result.
Available now
CSV inventory and retirement review, declared API/runtime evidence, owned actions, decision history and estate reports. Fictional scenarios exercise the configuration and account-notice workflows.
Implemented, awaiting validation
Authorised live-provider acceptance remains outstanding for the cloud and Freshdesk adapters. A passing contract test is not proof of permissions, connectivity or compatibility in your account.
01 / REVIEW SCOPE
Retirement notices and inventory
What it reviews
CSV inventory, sourced Microsoft catalogue, action ownership, evidence and estate reports.
How to interpret it
A catalogue match is a candidate. Unknown technologies or an empty queue do not establish that the estate is unaffected.
02 / REVIEW SCOPE
Azure App Service
What it reviews
HTTPS-only, application/SCM minimum TLS and approved IP access restrictions, including supported SCM inheritance.
How to interpret it
Top-level sites only. Deployment slots and advanced service tags, headers or subnet restrictions are outside the supported review.
03 / REVIEW SCOPE
Azure Storage and Key Vault
What it reviews
Storage anonymous/shared-key permissions, minimum TLS and network-policy changes; Key Vault firewall/network policy and enabled secret/certificate expiry metadata.
How to interpret it
Storage changes require consecutive complete observations. Key Vault covers latest listed enabled objects; missing expiry is unknown. Purge protection is not included.
04 / REVIEW SCOPE
Azure networking
What it reviews
Internet-wide NSG SSH/RDP rule candidates, sensitive TCP/UDP broadening and public-IP attachment changes.
How to interpret it
Rule configuration does not prove effective reachability. First, incomplete, reference-based or unsupported evidence can remain unknown.
05 / REVIEW SCOPE
Azure diagnostics and recovery
What it reviews
Diagnostic category/destination requirements for explicit resources, and selected Azure IaaS VM backup protection/recovery-point freshness.
How to interpret it
No proof of log delivery, recovery-point usability or successful restoration. Unprotected VM discovery and other backup workloads are excluded.
06 / REVIEW SCOPE
AWS configuration
What it reviews
Security-group SSH/RDP candidates and sensitive-port broadening; explicit S3 Block Public Access, RDS public access/backup retention, CloudTrail logging and Amazon-issued ACM expiry.
How to interpret it
One approved commercial account/region with explicit family limits. No proof of internet reachability, public object access, log delivery, certificate deployment or restore success.
07 / REVIEW SCOPE
Declared API/runtime evidence
What it reviews
Reviewed caller/version evidence for identified resources, including the Key Vault management API and selected Lambda, EKS and RDS schedules.
How to interpret it
Declarations are supplied by your team, not observed application traffic. Unlisted or stale facts remain unknown. RDS minor/patch support and broader compatibility are unassessed.
08 / REVIEW SCOPE
Provider-observed AWS versions
What it reviews
Explicit RDS major-engine, managed-ZIP Lambda $LATEST and regional EKS control-plane metadata compared with reviewed schedules.
How to interpret it
Live collection is disabled pending authorised validation. Published Lambda versions, aliases, images, EKS nodes/add-ons and actual support entitlement are outside scope.
09 / REVIEW SCOPE
AWS Health account notices
What it reviews
Open/upcoming scheduled-change and account-notification events for 1–20 approved RDS instance, unqualified Lambda function or EKS cluster ARNs, including matching global notices.
How to interpret it
Exact affected-resource ARN matches only. Unknown IDs/groups and partial evidence stay unknown. Health API access needs an eligible AWS support plan; a pass is only no matching active notice under these filters.
10 / REVIEW SCOPE
Connections and handoffs
What it reviews
Azure inventory/Advisor, AWS Resource Explorer, Google Cloud Asset Inventory, DigitalOcean project inventory and the Freshdesk connector are implemented.
How to interpret it
Authorised live-account validation remains outstanding. Generic inventory does not imply equivalent lifecycle evidence. Other service desks use manual ticket CSVs.
Unknown is a result worth keeping.
Denied access, unsupported settings, stale facts and incomplete collection cannot establish compliance. A positive match can still need attention when other evidence is incomplete. A pass describes only the selected check and its evidence, not complete estate security or support.
Generic inventory for Google Cloud, DigitalOcean or on-premises exports does not imply full lifecycle matching for those platforms. Microsoft SSO, customer-specific workspace permissions and an external customer portal are not included.
Capacity and consent
Inventory and configuration share the published resource allowance: the same identified resource in an estate counts once. Retained configuration identities continue to count until the estate is removed. Fictional samples are exempt. Collection also has technical and family-specific limits; additional selected scope requires renewed consent.
Compare current plan limits →START WITH ONE USEFUL REVIEW
Give the next step an owner.
Try a fictional estate, review its evidence and prepare a report. No card or cloud connection needed.