Beacon runs 190 automated checks across Azure, AWS, and Google Cloud every 6 hours — agentlessly, through native read-only APIs. Each check below shows what it evaluates, its severity, and how it maps to the CIS Benchmarks, NIST Cybersecurity Framework, and ISO/IEC 27001:2022.
The checks documented below are representative examples from each category. The full 190-check suite expands these families across all three clouds; new checks ship continuously and are included on every plan at no extra cost.
CIS Microsoft 365, Azure, AWS Foundations, and GCP Foundation Benchmarks — prescriptive, control-level hardening guidance.
NIST Cybersecurity Framework functions — Identify, Protect, Detect, Respond, Recover.
ISO/IEC 27001:2022 Annex A controls — the international standard for information security management.
MFA, Conditional Access, privileged account hygiene, risky users, guest accounts, and app credential expiry — evaluated through Microsoft Graph.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| ID-001 | Privileged accounts without MFA Admin roles with no strong authentication method registered |
Critical | CIS M365 1.1.1 | PR.AC-7 | A.5.17 |
| ID-002 | Missing Conditional Access controls No policy blocking legacy auth or requiring MFA for all users |
High | CIS M365 1.1.3 | PR.AC-3 | A.5.15 |
| ID-003 | Risky users detected by Identity Protection Accounts flagged at-risk or confirmed compromised |
Critical | CIS M365 1.2.x | DE.CM-7 | A.5.7 |
| ID-004 | App registration credential expiry Client secrets or certificates expired or expiring within 30 days |
High | CIS Azure 1.x | PR.AC-1 | A.5.16 |
| ID-005 | Stale guest accounts Guests with no sign-in in 90 days, or never signed in |
Medium | CIS M365 1.1.4 | PR.AC-1 | A.5.18 |
| ID-006 | Privileged admin synced from on-prem AD Cloud privileged role held by an on-premises-synced account |
Medium | CIS M365 1.1.x | PR.AC-4 | A.5.15 |
Network exposure, storage and Key Vault configuration, soft-delete and backup retention, Defender for Cloud coverage, and end-of-life operating systems — evaluated through Azure Resource Manager.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| AZ-001 | NSG exposes management ports Inbound Allow from Internet on RDP, SSH, SQL and other sensitive ports |
High | CIS Azure 6.x | PR.AC-5 | A.8.20 |
| AZ-002 | Storage account security configuration Public blob access, HTTP allowed, or minimum TLS below 1.2 |
High | CIS Azure 3.x | PR.DS-1 | A.8.24 |
| AZ-003 | Key Vault soft-delete & purge protection Soft-delete or purge protection disabled on a Key Vault |
High | CIS Azure 8.x | PR.DS-1 | A.8.24 |
| AZ-004 | Storage account soft-delete Blob or container soft-delete disabled |
High | CIS Azure 3.x | PR.IP-4 | A.8.13 |
| AZ-005 | Recovery Services Vault soft-delete Backup vault soft-delete disabled — backups can be permanently destroyed |
High | CIS Azure 9.x | PR.IP-4 | A.8.13 |
| AZ-006 | VM with public IP and no Bastion Virtual machine directly internet-reachable without Azure Bastion |
Medium | CIS Azure 6.x | PR.AC-5 | A.8.20 |
| AZ-007 | SQL backup retention below 14 days Point-in-time restore retention under the recommended window |
Medium | CIS Azure 4.x | PR.IP-4 | A.8.13 |
| AZ-008 | Defender for Cloud on Free tier Critical resource plans left on the posture-only Free tier |
High | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| AZ-009 | VM running end-of-life OS Image matches a known EOL operating system (e.g. Windows Server 2012) |
Medium | CIS Controls 7.x | PR.IP-12 | A.8.8 |
Device enrollment, compliance state, sync freshness, supported OS builds, and Windows Update rings.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| EP-001 | Unenrolled devices Devices not enrolled in Intune MDM |
Medium | CIS Controls 1.x | ID.AM-1 | A.8.1 |
| EP-002 | Non-compliant devices Devices marked non-compliant by Intune policy |
High | CIS Controls 4.x | PR.IP-1 | A.8.9 |
| EP-003 | Unsupported Windows build Devices running Windows older than build 18362 (19H1) |
Medium | CIS Controls 7.x | PR.IP-12 | A.8.8 |
| EP-004 | Stale device sync Devices that have not synced in 14+ days |
Low | CIS Controls 1.x | ID.AM-1 | A.8.1 |
| EP-005 | Update ring not configured No Windows Update ring policy assigned to the device group |
Medium | CIS Controls 7.x | PR.IP-12 | A.8.8 |
Exchange, SharePoint, and Teams: email authentication, legacy auth, anonymous sharing, and external federation.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| M365-002 | Legacy auth not blocked No CA policy blocking legacy authentication protocols |
High | CIS M365 1.2.x | PR.AC-3 | A.5.15 |
| M365-004 | DKIM not configured DKIM signing not enabled for the primary Exchange Online domain |
Medium | CIS M365 2.1.x | PR.DS-2 | A.8.24 |
| M365-005 | DMARC missing or p=none DMARC record absent or set to monitoring-only |
Medium | CIS M365 2.1.x | PR.DS-2 | A.8.24 |
| M365-006 | SharePoint anonymous links Anonymous sharing links enabled on one or more sites |
High | CIS M365 7.2.x | PR.AC-4 | A.5.14 |
| M365-007 | SharePoint external sharing External sharing policy allows new and existing guests |
Medium | CIS M365 7.2.x | PR.AC-4 | A.5.14 |
| M365-009 | Teams external federation unrestricted Any external domain can initiate contact |
Medium | CIS M365 8.x | PR.AC-5 | A.5.14 |
Workload protection coverage, active alerts, stale recommendations, and regulatory compliance score.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| DEF-001 | Stale recommendations Unresolved recommendations older than 30 days |
Low | CIS Azure 2.x | ID.RA-1 | A.8.8 |
| DEF-002 | Active high/critical alerts Open high or critical security alerts |
Critical | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| DEF-003 | VM protection off Defender for Servers not enabled |
High | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| DEF-004 | SQL protection off Defender for SQL not enabled |
High | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| DEF-005 | Storage protection off Defender for Storage not enabled |
High | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| DEF-006 | Container protection off Defender for Containers not enabled |
High | CIS Azure 2.x | DE.CM-1 | A.8.16 |
| DEF-007 | Compliance score low Regulatory compliance score below 70% |
Medium | CIS Azure 2.x | ID.GV-3 | A.5.36 |
Pipeline secrets, service-connection scope, branch protection, project visibility, and Action pinning.
| ID | Check | Severity | CIS | NIST CSF | ISO 27001 |
|---|---|---|---|---|---|
| DEV-001 | Public ADO projects Azure DevOps projects discoverable by the public internet |
High | CIS SW Supply Chain | PR.AC-4 | A.8.31 |
| DEV-002 | Subscription-scope service connections Over-privileged service principals on pipelines |
High | CIS SW Supply Chain | PR.AC-4 | A.8.2 |
| DEV-003 | Branch policy missing Default branch has no blocking reviewer policy |
Medium | CIS SW Supply Chain | PR.IP-3 | A.8.31 |
| DEV-004 | Unencrypted pipeline secrets Secret-like variables stored as plaintext |
High | CIS SW Supply Chain | PR.DS-1 | A.8.24 |
| DEV-005 | No branch protection GitHub default branch has no protection rules |
Medium | CIS SW Supply Chain | PR.IP-3 | A.8.31 |
| DEV-006 | No required PR reviews Protection exists but does not require reviews |
Medium | CIS SW Supply Chain | PR.IP-3 | A.8.31 |
| DEV-007 | Unpinned Actions Third-party Actions referenced by tag rather than pinned SHA |
Medium | CIS SW Supply Chain | ID.SC-2 | A.8.30 |
Beyond the Azure and Microsoft 365 families above, Beacon runs 44 AWS checks (IAM, S3 public access and encryption, security groups, CloudTrail, KMS, RDS, and GuardDuty) mapped to the CIS AWS Foundations Benchmark, and 46 GCP checks (IAM, Cloud Storage, VPC firewall, Cloud KMS, logging, and Security Command Center) mapped to the CIS GCP Foundation Benchmark — every one scanned agentlessly through native read-only APIs and rolled into the same severity-weighted compliance score.
Each check is weighted by severity — a failing Critical control moves the score roughly 20× more than a failing Informational one — producing a single severity-weighted compliance score from 0–100 per client. Read how scoring works in the docs.
Connect a read-only credential per cloud account and Beacon takes it from there — across Azure, AWS, and GCP.