Prepared by Cellpagepa for the practice's Qualified Individual
57% · Needs attention
The basics are in place: firewall, antivirus, automatic updates and sign-in logging all pass. Screen locking, password rules and part of the audit logging are not set yet. Disk encryption still needs to be checked directly.
First report for this practice, so this month is the baseline.
A PC left open at a desk is the easiest way for client files to be seen or copied. One setting fixes it on every PC.
Require 14+ characters and lock the account after 5 wrong tries. This stops password guessing.
If a laptop is stolen, an encrypted drive keeps every return unreadable. We are adding a direct check for next month.
| Area | Check | Check ID | Result |
|---|---|---|---|
| Needs fixing · 6 | |||
| Access control §314.4(c)(1) | Screen locks after 15 minutes idleStops walk-up access to an unattended PC. | 26025 | Fail |
| Access control §314.4(c)(1) | Passwords at least 14 charactersShort passwords can be guessed in hours. | 26003 | Fail |
| Access control §314.4(c)(1) | Account locks after 5 wrong passwordsBlocks automated password guessing. | 26006 | Fail |
| Logging §314.4(c)(8) | Account changes recordedNew users and password resets leave a trail. | 26142 | Fail |
| Network §314.4(c) | Local name broadcasts (LLMNR) offA common trick for stealing passwords on office networks. | 26193 | Fail |
| Malware §314.4(c) | USB AutoRun offPlugged-in drives can't start programs by themselves. | 26302 · 26303 | Fail |
| Not measured · 1 | |||
| Encryption §314.4(c)(3) | Disk encryption (BitLocker) turned onDirect status check being added; the benchmark only checks policy. | — | Not measured |
| Passing · 8 | |||
| Access control §314.4(c)(1) | Guest account disabledNo sign-in without a named account. | 26009 | Pass |
| Access control §314.4(c)(1) | Admin approval prompts on (UAC)Programs can't quietly gain admin rights. | 26069 | Pass |
| Logging §314.4(c)(8) | Sign-ins recorded, success and failureShows who used the PC and failed attempts. | 26148 | Pass |
| Network §314.4(c) | Firewall on for all network typesBlocks unsolicited connections. | 26116 · 26123 · 26130 | Pass |
| Network §314.4(c) | Old file-sharing protocol (SMBv1) offThe protocol used by WannaCry-style attacks. | 26172 · 26173 | Pass |
| Network §314.4(c) | Remote Desktop requires sign-in firstNetwork Level Authentication is on. | 26426 | Pass |
| Malware §314.4(c) | Antivirus real-time protection onMicrosoft Defender is running and not disabled. | 26395 · 26403 | Pass |
| Patching §314.4(c) | Automatic Windows updates onSecurity fixes install without anyone remembering. | 26474 | Pass |
Check IDs refer to the CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0 as scanned by Wazuh. The full benchmark result (482 checks: 122 pass, 351 fail, 9 not applicable) is kept as supporting evidence.
Backup monitoring is not yet connected for this device. These rows show what the section will contain.
The first vulnerability scan is still running. Results appear in next month's report.
| Device | System | Monitoring | Full benchmark | Last scan |
|---|---|---|---|---|
| cpwd0011 | Windows 11, domain-joined | Active | 25% (122 / 482) | 2026-10-11 11:03 |