Six checks were claiming compliance controls they can't see

Six of Wegweiser's checks were mapped to compliance controls their data can't show. Since 12 October the chips on a finding, the compliance section of the onboarding report and the QBR list only the controls each check evidences.

We found them while reading what every check collects, as groundwork for mapping Japanese frameworks. The map has one rule: a chip means the check speaks to that control. These six broke it.

• Network configuration claimed three firewall controls: Cyber Essentials Firewalls, BSI NET.3.2 and DIN SPEC 27076 requirement 21. It reads interface names, addresses and link speeds, and nothing about a firewall.
• Backup health claimed restore testing, CIS 11.5 and DIN SPEC 27076 14-2. The check's own definition says a restore can't be seen from the machine.
• The Linux authentication log claimed CIS 6.3, MFA for remote access. It shows who signed in and how, and can't show whether MFA is required.
• Storage claimed CIS 11.1, a data recovery process, from drive sizes and free space.
• Disk health claimed four backup and recovery controls for S.M.A.R.T. data. A drive predicting its own failure shows the equipment is watched, so it now claims ISO 27001 A.7.13, equipment maintenance.
• The scanner claimed anti-malware deployment: CIS 10.1, Cyber Essentials Malware Protection and DIN SPEC 27076 requirement 18. It hunts with YARA rules and isn't an antivirus.

The firewall and anti-malware controls stay where the evidence is: the security posture checks, which read the host firewall, Defender and XProtect. Backup health keeps the backup controls it does evidence, CIS 11.2 and 11.3 among them.

On 13 September we wrote here that MFA was absent from the map. It wasn't: the Linux authentication log claimed it.

One check claimed too little

macOS security posture has read the application firewall, FileVault, the update switches and XProtect's version since 5 October. It claimed none of the controls those evidence.

It now claims CIS 4.5, 3.6, 7.3 and 10.2, the Cyber Essentials host firewall and DIN SPEC 27076 requirement 21.

Reports made before 12 October keep the old list

Wegweiser draws the chips and the compliance sections from the map each time a page or report is made, so pages and reports made now show the corrected list.

A PDF made before 12 October keeps what it said. An onboarding report or a QBR from then may list restore testing, MFA for remote access or a deployed antivirus as controls at risk, on the word of a check that couldn't see them. If one went to a client, make a fresh copy.

Each changed line in the map records what it claimed until 12 October and why it no longer does.