Internet-facing service protection
System state changed after the previous control assessment. Affected control conclusions may no longer be reliable.
Do the affected controls remain effective under the changed system state?
The exposure change recorded against Azure API Management alters the threat model the affected controls were assessed against. Existing conclusions are preserved but flagged as potentially stale until reassessed with current evidence.
3
Controls to reassess
6
Evidence artefacts
- Direct observation
Network exposure evidence
Endpoint now Internet Accessible
- Source
- Azure Resource Inventory
- Timestamp
- Today 09:42
- Method
- Automated collector
- Confidence
- High
- Supporting
WAF policy configuration
Front Door WAF enabled
- Source
- Azure Front Door
- Timestamp
- Today 09:41
- Method
- Machine observed
- Confidence
- Medium
Reassess with current evidence
MEDIUM confidenceThe prior conclusion predates the exposure change; current WAF and gateway evidence should be re-examined before confirming effectiveness.
A recommendation only. It is not an approval. The accountable human below remains responsible for the decision.
Requires Control Effectiveness authority (Security Assessor). Acting as Security Assessor in this demonstration.
- Security Architect
May validate system-model assertions and architecture conflicts.
- Security AssessorRequired
May determine control effectiveness.
- System Owner
May approve treatments and operational exceptions within delegated authority.
- Risk Owner
May accept residual risk within delegated authority.
- Authorising Officer
May authorise system operation.
Authority is not transferable by discovery. A Security Architect cannot accept residual organisational risk merely because they identified it, and a Security Assessor cannot issue system authorisation.
- 10:24Model assertion updated (DEC-024)
- 10:243 dependent controls flagged for reassessment
- 10:25Assigned to Security Assessor