Deficiencies raised against controls, ordered by severity then remediation SLA
13 findings
Nine production container images are running base layers with unpatched critical CVEs first detected between 41 and 78 days ago, exceeding the one-month patch window required by PCI DSS 6.3.3.
Remediation Rebuild affected images against the hardened base tag 2026.08 and enable the automated base-image bump job.
Access reconciliation for the July sample identified three contractor accounts that remained active in the identity provider for 6, 9, and 14 days after their termination date. All three retained group membership granting read access to the production data warehouse.
Remediation Wire the HRIS termination webhook directly to the IdP deprovisioning job and add a daily reconciliation alert for orphaned accounts.
Eleven engineering accounts hold a permanently attached AdministratorAccess policy in the production AWS account rather than obtaining privileges through just-in-time elevation. Standing privilege contradicts the documented least-privilege model.
Remediation Migrate all eleven principals to Teleport JIT roles with a four-hour maximum session and approval-on-elevation.
Two internet-facing services depend on a library version affected by a remote code execution vulnerability listed in the CISA Known Exploited Vulnerabilities catalog.
Remediation Patch to 4.9.2 in both services, then confirm remediation with an authenticated rescan before closing.
The vendor register lists four vendors with expired security reviews that continue to process customer personal data under active contracts.
Remediation Complete refreshed security reviews and suspend data flows for any vendor not cleared within 30 days.
Twenty-two role assignments in production do not appear in the approved role definition matrix. Six of them grant write access to payment service configuration.
Remediation Reconcile the role matrix, revoke unapproved assignments, and enforce matrix changes through Terraform review.
Scanner enrolment reconciliation shows seven repositories deploying to production without software composition analysis configured, so dependency vulnerabilities in those services are never detected.
Remediation Apply the shared compliance CI template at group level and set the scanning job to required rather than opt-in.
The vulnerability register contains 34 entries with no assigned risk ranking or owner, so they are excluded from SLA tracking entirely. PCI DSS 6.3.1 requires a risk ranking on every identified vulnerability.
Remediation Backfill rankings using the CVSS-plus-exploitability rubric and reject scanner output that lacks a ranking.
A severity-2 incident from June closed without a documented post-incident review, so root cause and corrective actions were never recorded.
Remediation Produce the retrospective review and block incident closure in the tooling until the review is attached.
Fourteen hosts have drifted from the declared baseline, most commonly re-enabled password authentication over SSH and disabled audit daemon.
Remediation Re-apply the hardening playbook and enable drift auto-remediation for the sshd and auditd resources.
Three services reached production without a recorded threat model, contrary to the secure development lifecycle requirement.
Remediation Complete retrospective threat models and add the artifact as a release checklist gate.
Two approved external sharing channels operate without DLP inspection, leaving an unmonitored egress path for regulated data.
Remediation Extend the DLP policy set to both channels and validate with a synthetic regulated-data test file.
The Q3 internal scan was executed but no rescan evidence was retained to demonstrate that high-risk findings were resolved and verified.
Remediation Re-run the internal scan and archive both the initial and clean rescan reports to the evidence store.