This is not an official U.S. federal government website.
The Federal Modernization Workbook is independent technical analysis. It does not represent the position of,
and has not been reviewed or endorsed by, any federal agency.
Reference · Draft
Zero Trust Closure Coverage
Which workbook pages carry each item of the Zero Trust Assessment closure update, and which are still planned
Research draft: a tracker of the workbook’s Zero Trust Assessment closure update, generated from data/zta-closure/coverage.yml. For each instruction ID, from the global conventions to the closure map, it gives the wave, the book or guide, the status of the workbook’s guidance, the pages that carry it and the pull request. It tracks guidance coverage, not any tenant’s implementation.
Status — Draft
This page is still being written. Expect gaps and changes; it is not part of the workbook's production guidance. Last reviewed 2026-11-11.
Zero Trust assessments of Microsoft cloud tenants keep raising the same families of finding: emergency access, standing privilege, Conditional Access gaps, application secrets, device compliance, labels and encryption, skipped tests. In November 2026 the workbook’s owner turned those families into an anonymized update plan for the workbook: eight global conventions, line-by-line additions to existing books, a new book on information protection, three engineering guides, and a closure map from each finding family to the books and guides that carry it. This page tracks that plan, item by item.
ImportantGuidance coverage, not implementation
This page says which workbook pages give guidance for each item. It says nothing about any organization’s tenant. A row marked Implemented means the workbook now carries the guidance; it doesn’t mean any agency has built the control, and it never means a control or finding is closed. Whether an organization has done the work is shown by its own evidence, in the five control states of Book 00, Appendix D, and whether a finding is closed is its authorizing official’s or assessor’s decision. The plan holds no agency name, tenant, person, application, count or identifier from any assessment, and neither does this page.
How to read it
- ID is the instruction’s own ID. G-01 to G-08 are the global conventions; B02-01 to B18-02 are additions to existing books; B20-01 to B20-12 are the chapters of the planned twentieth book, Information Protection & Microsoft Purview (the plan numbers it nineteenth; the workbook’s Book 19 already exists); GSA, XDR and AZS items are sections of three implementation guides; CM-01 to CM-15 are the closure-map rows; ZTA-GUIDE is the Zero Trust Assessment tool guide.
- Wave is the plan’s priority, 1 to 4: privileged identity, Conditional Access, application credentials, devices, auditing and assessment evidence first; then information protection; then Zero Trust network access; then Defender XDR and Azure security.
- Status is the workbook’s guidance: Implemented (the pages carry it), Partial (some of it, or defined but not yet applied everywhere), Planned, Deferred (with a reason), or Not applicable (with a reason). macOS hardening is not applicable because macOS and Linux are outside the workbook’s scope.
- Where links the pages that carry the item; PR is the pull request that added it.
The data is in data/zta-closure/coverage.yml. Everything below is generated from it by scripts/zta_coverage.py; edit the data file and regenerate.
Summary
103 instruction IDs: Implemented 101; Partial 0; Planned 1; Deferred 0; Not applicable 1.
| Group | IDs | Implemented | Partial | Planned | Deferred | Not applicable |
|---|---|---|---|---|---|---|
| Global conventions | 8 | 8 | 0 | 0 | 0 | 0 |
| Updates to existing books | 35 | 34 | 0 | 0 | 0 | 1 |
| B20: Information Protection & Microsoft Purview (planned book) | 12 | 12 | 0 | 0 | 0 | 0 |
| Implementation guides | 33 | 32 | 0 | 1 | 0 | 0 |
| Closure map | 15 | 15 | 0 | 0 | 0 | 0 |
Global conventions
Defined once in Book 00, Appendix D.
| ID | Item | Wave | Book | Status | Where | PR | Note |
|---|---|---|---|---|---|---|---|
| G-01 | Five-state control model: Designed, Configured, Enforced, Evidenced, Operated | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#control-states; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-02 | How-section template: prerequisites, pilot, report-only or audit, enforcement, rollback, exclusions, telemetry, evidence, day-two ownership | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#how-section-template; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-03 | Source policy: primary sources and last-verified dates for product behavior and licensing | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#source-policy; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-04 | Terminology: organization, agency or tenant; no organization-specific identifiers | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#terminology; check_identifiers.py; check_neutrality.py | #555 | Defined in Book 00 Appendix D; check_identifiers.py added (quiet on every published page at the time), beside the salted-hash neutrality check. |
| G-05 | Authority labels: mandated, Microsoft-recommended, risk-based recommended, optional, license-dependent, environment-dependent | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#authority-labels; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-06 | Evidence pattern: configuration, operational, test, exception evidence and the assessor-ready artifact | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#evidence-pattern; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-07 | Change safety: rings, emergency-access exclusions, change windows, backout triggers, post-change validation | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#change-safety; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
| G-08 | Assessment mapping: Zero Trust pillar, cross-pillar dependencies, attack chain interrupted | 1 | all | Implemented | appendix-d-control-states-and-evidence.md#assessment-mapping; 09-access-governance.md#b04-ar-rollout; 07-patch-configuration-and-baselines.md#b12-07-control-states; privileged-access-implementation.md | #576 | Defined in Book 00 Appendix D (#555) and applied to every procedure section: new content in Phases 2-3 (#559-#569); existing chapters and guides in Phase 4 (#571 guides, #572 Books 00-03, #573 Books 11-14, #574 Books 07-10, #575 Books 04-06, #576 Books 15-19). Conceptual chapters are out of scope by Mike’s trimmed plan. |
Updates to existing books
| ID | Item | Wave | Book | Status | Where | PR | Note |
|---|---|---|---|---|---|---|---|
| B02-01 | Managed authentication versus federation decision tree | 1 | B02 | Implemented | 09-building-the-entra-target.md#managed-or-federated-decision | #561 | Decision tree; the federation conversion time stays Mike’s open decision (both Learn figures cited). |
| B02-02 | Directory synchronization identities: named locations, rotation, least privilege, alerting | 1 | B02 | Implemented | 09-building-the-entra-target.md#hardening-the-synchronization-identities | #561 | Includes a location policy for the legacy sync account not yet numbered in Book 04’s library. |
| B04-01 | Two cloud-only emergency-access identities: reference architecture | 1 | B04 | Implemented | 04-privileged-roles-and-tiers.md#emergency-access-reference-architecture | #560 | Build steps stay in the Privileged Access guide, Step 2. |
| B04-02 | PIM role-setting pattern | 1 | B04 | Implemented | 08-pim-self-request-with-approval.md#role-setting-export-and-exception-register | #560 | — |
| B04-03 | Conditional Access policy design matrix | 1 | B04 | Implemented | 07-the-conditional-access-policy-library.md#policy-design-matrix | #560 | Token protection is an unnumbered candidate policy. |
| B04-04 | Privileged-session pattern: sign-in frequency, persistent browser, CAE | 1 | B04 | Implemented | 07-the-conditional-access-policy-library.md#privileged-sessions | #560 | — |
| B04-05 | Rollout runbooks for passkeys/FIDO2, Windows Hello for Business and certificate-based authentication | 1 | B04 | Implemented | appendix-d-phishing-resistant-authentication-runbooks.md | #560 | New draft Appendix D. |
| B04-06 | Centralized consent governance | 1 | B04 | Implemented | 05-applications-and-workload-identities.md#governing-consent-over-time | #560 | — |
| B04-07 | External identities: partner inventory, cross-tenant access, tenant restrictions, guest lifecycle | 1 | B04 | Implemented | appendix-c-partner-access-profile-entra.md#defaults-allowlist-criteria-and-the-partner-register | #560 | — |
| B04-08 | Restrict non-admin tenant creation; Tenant Creator workflow and monitoring | 1 | B04 | Implemented | 09-access-governance.md#tenant-creation | #560 | Tenant Creator placed at Tier 2 as program design. |
| B05-01 | Platform baselines: Windows, iOS/iPadOS, Android Enterprise, personally owned devices | 1 | B05 | Implemented | 10-operating-and-evidencing-the-fleet.md#compliance-architecture | #564 | Windows, iOS/iPadOS, Android Enterprise and personally owned; macOS dropped (out of scope, Mike, Nov 9). |
| B05-02 | Windows hardening patterns: Defender Antivirus, Firewall, BitLocker, Windows LAPS, baselines, ASR, tamper protection, update rings | 1 | B05 | Implemented | 08-gpo-to-intune-policy-migration.md#windows-hardening-rollout; 10-operating-and-evidencing-the-fleet.md#expedited-quality-updates | #564 | Windows LAPS automatic account management stays Mike’s open decision. |
| B05-03 | macOS hardening | 1 | B05 | Not applicable | — | #555 | macOS and Linux are out of the workbook’s scope (Mike, Nov 9, 2026). |
| B05-04 | Enrollment: automatic enrollment, Autopilot, ownership, restrictions, stale-device cleanup | 1 | B05 | Implemented | 04-intune-first-onboarding.md#enrollment-controls | #564 | — |
| B05-05 | Endpoint analytics: data collection, privacy review, drift and patch delay | 1 | B05 | Implemented | 10-operating-and-evidencing-the-fleet.md#endpoint-analytics | #564 | — |
| B07-01 | Certificate credential governance for applications | 1 | B07 | Implemented | 08-lifecycle-monitoring-and-decommissioning.md#application-certificate-credentials | #561 | Wave not stated in the instructions’ priority table; assigned by the item’s subject. |
| B08-01 | Application redirect-URI and DNS ownership pattern | 1 | B08 | Implemented | 06-dns-identity-and-dnssec.md#redirect-uris-and-dns-ownership | #561 | Wave not stated in the instructions’ priority table; assigned by the item’s subject. |
| B09-01 | Bridge from TIC/SASE architecture to identity-aware access | 3 | B09 | Implemented | 05-sd-wan-sase-and-governed-transport.md#the-bridge-to-identity-aware-access | #563 | — |
| B10-01 | Azure ingress and resilience: Front Door, Application Gateway, WAF, DDoS, Private Link, Firewall, public IP governance | 4 | B10 | Implemented | 05-the-landing-zone.md#internet-facing-workloads | #563 | Includes AWS, Google Cloud and OCI equivalents. |
| B11-01 | Normalized assessment result taxonomy; skipped is not failed | 1 | B11 | Implemented | 10-evidence-not-verdicts.md#a-normalized-result-taxonomy | #555 | — |
| B11-02 | Closure chain as a register schema | 1 | B11 | Implemented | 10-evidence-not-verdicts.md#the-closure-chain; appendix-a-requirements-mapping.md | #555 | — |
| B11-03 | Control-weighting guidance; no pass percentage as the sole maturity score | 1 | B11 | Implemented | 10-evidence-not-verdicts.md#weigh-the-finding-not-the-pass-rate | #555 | — |
| B12-01 | Identity detections | 1 | B12 | Implemented | appendix-b-identity-and-application-detections.md#identity-detections | #559 | New draft Appendix B (FMP-DET-30 to 39). |
| B12-02 | Application detections | 1 | B12 | Implemented | appendix-b-identity-and-application-detections.md#application-detections | #559 | FMP-DET-14 and 40 to 45. |
| B12-03 | Data and endpoint telemetry in the evidence contract | 2 | B12 | Implemented | 02-the-evidence-contract.md#data-and-endpoint-telemetry | #559 | — |
| B13-01 | Application governance fields for every application and service principal | 1 | B13 | Implemented | 14-application-secret-and-configuration-governance.md#application-governance-record | #566 | New draft Chapter 14. |
| B13-02 | Secrets governance: default prohibition on long-lived client secrets | 1 | B13 | Implemented | 14-application-secret-and-configuration-governance.md#secrets-governance | #566 | — |
| B13-03 | Configuration drift: continuous exports and drift rules | 2 | B13 | Implemented | 14-application-secret-and-configuration-governance.md#configuration-drift-exports | #566 | — |
| B14-01 | Sample evidence mappings from Zero Trust implementation to SP 800-53 families, with assessor caveats | 2 | B14 | Implemented | 04-closure-with-proof.md#zero-trust-evidence-mapping | #559 | No one-to-one compliance claims. |
| B15-01 | Help-desk identity-proofing and escalation runbooks | 1 | B15 | Implemented | appendix-b-recovery-and-escalation-runbooks.md | #563 | New draft Appendix B; Verified ID recovery held until available in GCC. |
| B15-02 | Operational cadence: daily to annual tasks per control family | 1 | B15 | Implemented | 12-the-day-two-runbook.md#the-cadence-by-control-family | #563 | — |
| B16-01 | User-facing training: Authenticator context, passwordless, labels, encrypted mail, DLP tips, blocked access | 2 | B16 | Implemented | 07-end-user-training.md#labeled-and-protected-information | #564 | — |
| B17-01 | Reuse workload-identity controls for AI agents | 1 | B17 | Implemented | 06-credentials-and-least-privilege.md#agent-credential-controls | #561 | Wave not stated in the instructions’ priority table; assigned by the item’s subject. |
| B18-01 | Portfolio intake fields for attack-path ranking | 1 | B18 | Implemented | 02-triaging-the-portfolio.md#identity-and-access-intake-fields | #566 | — |
| B18-02 | Remediation factory work packages | 1 | B18 | Implemented | 10-running-the-portfolio-in-waves.md#identity-remediation-factory; appendix-a-identity-remediation-work-packages.md | #566 | New draft Appendix A. |
B20: Information Protection & Microsoft Purview (planned book)
The planned twentieth book. The instructions number it nineteenth; it is numbered 20 because the workbook’s Book 19 already exists.
| ID | Item | Wave | Book | Status | Where | PR | Note |
|---|---|---|---|---|---|---|---|
| B20-01 | Data inventory and classification | 2 | B20 | Implemented | 01-data-inventory-and-classification.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-02 | Sensitivity label architecture | 2 | B20 | Implemented | 02-sensitivity-label-architecture.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-03 | Label publication and defaults | 2 | B20 | Implemented | 03-label-publication-and-defaults.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-04 | Teams, Groups and SharePoint containers | 2 | B20 | Implemented | 04-teams-groups-and-sharepoint-containers.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-05 | Rights Management and recovery | 2 | B20 | Implemented | 05-rights-management-and-recovery.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-06 | Exchange Message Encryption | 2 | B20 | Implemented | 06-exchange-message-encryption.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-07 | SharePoint and OneDrive | 2 | B20 | Implemented | 07-sharepoint-and-onedrive.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-08 | DLP and endpoint controls | 2 | B20 | Implemented | 08-dlp-and-endpoint-controls.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-09 | Auto-labeling and sensitive information types | 2 | B20 | Implemented | 09-auto-labeling-and-sensitive-information-types.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-10 | Audit, Insider Risk and Communication Compliance | 2 | B20 | Implemented | 10-audit-insider-risk-and-communication-compliance.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-11 | AI data security | 2 | B20 | Implemented | 11-ai-data-security.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
| B20-12 | Operations and evidence | 2 | B20 | Implemented | 12-operations-and-evidence.md | #568 | Draft chapter; registered in navigation, Books table and Word bundle by #569. |
Implementation guides
Global Secure Access, Defender XDR and Azure security engineering are implementation guides, not books, by the workbook owner’s decision of November 11, 2026, so they don’t duplicate Books 09, 10 and 12. The Zero Trust Assessment tool guide is planned too.
| ID | Item | Wave | Book | Status | Where | PR | Note |
|---|---|---|---|---|---|---|---|
| GSA-01 | Global Secure Access & Zero Trust Network Engineering: Decision and licensing | 3 | guide | Implemented | global-secure-access-implementation.md#step-1-decision-and-licensing | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-02 | Global Secure Access & Zero Trust Network Engineering: Reference architecture | 3 | guide | Implemented | global-secure-access-implementation.md#step-2-reference-architecture | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-03 | Global Secure Access & Zero Trust Network Engineering: Client deployment | 3 | guide | Implemented | global-secure-access-implementation.md#step-3-client-deployment | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-04 | Global Secure Access & Zero Trust Network Engineering: Microsoft traffic | 3 | guide | Implemented | global-secure-access-implementation.md#step-4-microsoft-traffic | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-05 | Global Secure Access & Zero Trust Network Engineering: Internet traffic | 3 | guide | Implemented | global-secure-access-implementation.md#step-5-internet-traffic | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-06 | Global Secure Access & Zero Trust Network Engineering: Private applications | 3 | guide | Implemented | global-secure-access-implementation.md#step-6-private-applications | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-07 | Global Secure Access & Zero Trust Network Engineering: Compliant network | 3 | guide | Implemented | global-secure-access-implementation.md#step-7-compliant-network | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-08 | Global Secure Access & Zero Trust Network Engineering: Tenant restrictions | 3 | guide | Implemented | global-secure-access-implementation.md#step-8-tenant-restrictions | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-09 | Global Secure Access & Zero Trust Network Engineering: TLS inspection | 3 | guide | Implemented | global-secure-access-implementation.md#step-9-tls-inspection | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-10 | Global Secure Access & Zero Trust Network Engineering: Privileged protocols | 3 | guide | Implemented | global-secure-access-implementation.md#step-10-privileged-protocols | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-11 | Global Secure Access & Zero Trust Network Engineering: Coexistence and migration | 3 | guide | Implemented | global-secure-access-implementation.md#step-11-coexistence-and-migration | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| GSA-12 | Global Secure Access & Zero Trust Network Engineering: Telemetry and evidence | 3 | guide | Implemented | global-secure-access-implementation.md#step-12-telemetry-and-evidence | #567 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-01 | Defender XDR Engineering & Operations: Service architecture | 4 | guide | Implemented | defender-xdr-implementation.md#step-1-service-architecture-and-access | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-02 | Defender XDR Engineering & Operations: Endpoint onboarding | 4 | guide | Implemented | defender-xdr-implementation.md#step-2-endpoint-onboarding | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-03 | Defender XDR Engineering & Operations: Endpoint prevention | 4 | guide | Implemented | defender-xdr-implementation.md#step-3-endpoint-prevention | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-04 | Defender XDR Engineering & Operations: Attack Surface Reduction | 4 | guide | Implemented | defender-xdr-implementation.md#step-4-attack-surface-reduction | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-05 | Defender XDR Engineering & Operations: Exposure management | 4 | guide | Implemented | defender-xdr-implementation.md#step-5-exposure-management | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-06 | Defender XDR Engineering & Operations: XDR incidents | 4 | guide | Implemented | defender-xdr-implementation.md#step-6-xdr-incidents | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-07 | Defender XDR Engineering & Operations: Advanced hunting | 4 | guide | Implemented | defender-xdr-implementation.md#step-7-advanced-hunting-and-detections-as-code | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-08 | Defender XDR Engineering & Operations: Identity and cloud-app signals | 4 | guide | Implemented | defender-xdr-implementation.md#step-8-identity-and-cloud-app-signals | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-09 | Defender XDR Engineering & Operations: Automation | 4 | guide | Implemented | defender-xdr-implementation.md#step-9-automation-with-approval-boundaries | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| XDR-10 | Defender XDR Engineering & Operations: Operations and evidence | 4 | guide | Implemented | defender-xdr-implementation.md#step-10-operations-and-evidence | #562 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-01 | Azure Security Engineering: Landing-zone security baseline | 4 | guide | Implemented | azure-security-implementation.md#step-1-landing-zone-security-baseline | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-02 | Azure Security Engineering: Public exposure inventory | 4 | guide | Implemented | azure-security-implementation.md#step-2-public-exposure-inventory | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-03 | Azure Security Engineering: DDoS protection | 4 | guide | Implemented | azure-security-implementation.md#step-3-ddos-protection | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-04 | Azure Security Engineering: Web application firewall | 4 | guide | Implemented | azure-security-implementation.md#step-4-web-application-firewall | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-05 | Azure Security Engineering: Front Door and Application Gateway | 4 | guide | Implemented | azure-security-implementation.md#step-5-front-door-and-application-gateway | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-06 | Azure Security Engineering: Firewall and segmentation | 4 | guide | Implemented | azure-security-implementation.md#step-6-firewall-and-segmentation | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-07 | Azure Security Engineering: Private Link and DNS | 4 | guide | Implemented | azure-security-implementation.md#step-7-private-link-and-dns | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-08 | Azure Security Engineering: Managed identities and Key Vault | 4 | guide | Implemented | azure-security-implementation.md#step-8-managed-identities-and-key-vault | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-09 | Azure Security Engineering: Policy and drift | 4 | guide | Implemented | azure-security-implementation.md#step-9-policy-and-drift | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| AZS-10 | Azure Security Engineering: Operations and evidence | 4 | guide | Implemented | azure-security-implementation.md#step-10-operations-and-evidence | #565 | Implementation guide section (a guide, not a book, by Mike’s decision of Nov 11, 2026). |
| ZTA-GUIDE | Zero Trust Assessment tool: implementation guide, narrated deck and training module, with a section reconciling its findings with AWS Security Hub CSPM for agencies that run both | — | guide | Planned | — | — | Phase 5 (Mike, Nov 11, 2026). |
Closure map
Each finding family from the instructions’ closure map, and the books and guides that carry it.