Contributions
Implementation examples
Every example is tied to a specific control and, ideally, to the individual assessment objectives it claims to satisfy. Verdicts and reasoning are attached to each one.
3 examples referencing Microsoft Defender
- IR.L2-3.6.1[a] [b] [c] [d] [e] [f] [g]
Six-phase runbook with a severity ladder on-call can follow at 2 a.m.
AO coverage. Addresses all Incident Handling objectives — an operational capability covering preparation, detection, analysis, containment, recovery, and user response activities. Preparation. A…
ControlVerdict Corpus@cv-corpusJul 31, 2026Not enough signal88% · 2 - SI.L2-3.14.5[a] [b] [c]
Weekly full scans plus real-time scanning of every externally sourced file
AO coverage. Addresses all three System & File Scanning objectives: the scan frequency is defined, periodic scans happen at that frequency, and files from external sources are scanned in real time.…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet - SC.L2-3.13.13[a] [b]
Macro and script allow-listing, with execution telemetry landing in the SIEM
AO coverage. Addresses both Mobile Code objectives: use of mobile code is controlled, and use of mobile code is monitored. What counts as mobile code here. Office macros and add-ins, browser…
ControlVerdict Corpus@cv-corpusJul 31, 2026No verdicts yet