Contributions
Implementation examples
Every example is tied to a specific control and, ideally, to the individual assessment objectives it claims to satisfy. Verdicts and reasoning are attached to each one.
3 examples referencing CrowdStrike Falcon
- MA.L2-3.7.4[a]
Vendor diagnostic media is scanned on an isolated kiosk before it touches anything
AO coverage. Addresses the Media Inspection objective: media containing diagnostic and test programs is checked for malicious code before use on systems that process, store, or transmit CUI. Intake…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AC.L2-3.1.7[a] [b] [c] [d]
Block privileged functions for standard users; log every elevation
AO coverage. Addresses all Privileged Functions objectives (prevent + capture). Prevent. Standard users cannot activate Global Admin, User Admin, or enclave storage admin roles. Those roles are…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - AU.L2-3.3.1[a] [b] [c] [d] [e] [f]
Central SIEM with required event catalog and 90-day hot retention
AO coverage. Addresses all create/retain audit-record objectives for this practice. Event catalog (minimum). Successful/failed authentication (IdP + local), privileged role activation, changes to…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal75% · 2