IT Audit Factory — evidence-first audit & compliance operations
Free • Professional • MSP
IT Audit Factory iconIT AUDIT FACTORYAudit, Evidence & Compliance Operations
Frameworks & Controls

NIST SP 800-171 Rev. 3

97 active requirements; NIST assessment objectives and organization-defined parameters. Former family reviews require reassessment.

All available frameworks

What the app checks

Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.

03.01;03.03;03.04;03.05;03.08;03.11;03.12;03.13;03.14

Collector modules: ADSEC, ASSETREC, BACKUP, CERTTLS, ENTRA, GPO, NETWORK, STORAGE, VMWARE, VULN, WINDOWS.

No automatic requirement pass. These module groups identify supporting scope; individual checks still need an explicit mapping.

Explicit requirement-to-test mappings

RequirementCollector / testWhat it checks or supports
03.01.05ADSEC / AD-PRIV-001Supporting observation for 03.01.05. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.01.05ENTRA / ENTRA-ROLE-001Supporting observation for 03.01.05. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.01.01ENTRA / ENTRA-GUEST-001Supporting observation for 03.01.01. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.13.01WINDOWS / WIN-FW-001Supporting observation for 03.13.01. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.03.07VMWARE / VMW-TIME-001Supporting observation for 03.03.07. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.04.02GPO / GPO-DETAIL-001Supporting observation for 03.04.02. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.04.06WINDOWS / WIN-SMB1-001Supporting observation for 03.04.06. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.04.10ADSEC / AD-COMPUTER-INVENTORY-001Supporting observation for 03.04.10. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.04.10ASSETREC / ASSETREC-AD-001Supporting observation for 03.04.10. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.04.10WINDOWS / WIN-INVENTORY-COVERAGE-001Supporting observation for 03.04.10. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.05.03ENTRA / ENTRA-MFA-REG-001Supporting observation for 03.05.03. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.08.09BACKUP / VEEAM-REPO-001Supporting observation for 03.08.09. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.11.02VULN / VULN-IMPORT-001Supporting observation for 03.11.02. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.11.02VULN / VULN-HIGH-001Supporting observation for 03.11.02. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.11.02VULN / VULN-AGING-001Supporting observation for 03.11.02. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.13.08CERTTLS / CERTTLS-POSTURE-001Supporting observation for 03.13.08. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.13.08STORAGE / STOR-DATA-IN-FLIGHT-ENCRYPTION-001Supporting observation for 03.13.08. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.14.01WINDOWS / WIN-PATCH-FRESHNESS-001Supporting observation for 03.14.01. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.14.02WINDOWS / WIN-AV-001Supporting observation for 03.14.02. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.
03.13.08STORAGE / STOR-AT-REST-ENCRYPTION-001Supporting observation for 03.13.08. Verify scoped population, configuration, effectiveness and the remaining requirement; this test alone cannot establish conformity.

What requires manual review

Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.

Public federal source material.

Where it is available

This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.

Coverage shown here comes from the application’s C32 requirement and mapping catalogs.