{
  "_comment": "Where each finding family is remediated: Book 11, Chapter 08's finding-family table (docs/books/b11-zero-trust/08-close-before-you-assess.md#finding-families), with the identity risk triage row the Zero Trust Assessment guide adds. Each family names the workbook page that remediates it, the evidence that shows a finding is ready for closure, the owner (Book 11, Chapter 07's pillar owners), the attack the gap enables, what the fix depends on, and the NIST SP 800-53 Rev. 5 controls the remediation supports. 'tests' routes a Zero Trust Assessment 3.1.0 test ID to a family; 'categories' routes the tool's TestCategory when the ID isn't listed, and the register marks that match as by category so someone confirms it. A finding that matches neither is 'unrouted': it goes to the program lead to assign. The routing is design guidance; it says where the work lives, not that a page closes anything.",
  "version": 1,
  "families": {
    "emergency-access": {
      "title": "Emergency access",
      "page": "docs/books/b04-access/04-privileged-roles-and-tiers.md#emergency-access-reference-architecture",
      "alsoSee": ["docs/books/b12-security-operations/appendix-b-identity-and-application-detections.md#closure-map", "docs/books/b15-day2-operations/appendix-b-recovery-and-escalation-runbooks.md#runbook-emergency-access-incident"],
      "owner": "Identity engineering",
      "attackPath": "A tenant lockout during an outage, or an emergency account used by an attacker with nobody alerted",
      "dependsOn": [],
      "ready": "Two cloud-only emergency accounts with phishing-resistant credentials, excluded from blocking Conditional Access; the sign-in alert fired on a test sign-in; the quarterly validation record",
      "controls": ["AC-2", "AC-6", "IA-2", "CP-2"]
    },
    "standing-privilege": {
      "title": "Standing privilege and PIM",
      "page": "docs/books/b04-access/08-pim-self-request-with-approval.md#role-setting-export-and-exception-register",
      "alsoSee": ["docs/books/b13-governance/14-application-secret-and-configuration-governance.md#standing-privilege-exceptions"],
      "owner": "Identity engineering",
      "attackPath": "A stolen administrator session or token reaches standing privileged roles without an activation, approval or alert",
      "dependsOn": ["emergency-access"],
      "ready": "The PIM role-setting export; no active permanent assignment outside the exception register; an activation test with its approval and audit record",
      "controls": ["AC-2", "AC-6", "AC-2(4)"]
    },
    "phishing-resistant-admin": {
      "title": "Phishing-resistant admin authentication",
      "page": "docs/books/b04-access/appendix-d-phishing-resistant-authentication-runbooks.md",
      "alsoSee": ["docs/books/b07-pki/09-federal-workforce-credentials.md#administrators-piv-in-the-privileged-strength", "docs/books/b05-devices/08-gpo-to-intune-policy-migration.md#windows-hardening-rollout"],
      "owner": "Identity engineering",
      "attackPath": "An administrator's password and phishable second factor relayed through an adversary-in-the-middle page",
      "dependsOn": ["emergency-access"],
      "ready": "The authentication strength policy export; registration report for every privileged user; a test sign-in refused without a phishing-resistant method",
      "controls": ["IA-2", "IA-2(1)", "IA-5"]
    },
    "conditional-access": {
      "title": "Conditional Access gaps",
      "page": "docs/books/b04-access/07-the-conditional-access-policy-library.md#policy-design-matrix",
      "alsoSee": [],
      "owner": "Identity engineering",
      "attackPath": "Sign-ins that skip the policy a risky user, legacy client or stolen token should have met",
      "dependsOn": ["emergency-access"],
      "ready": "The policy export from the library; report-only results reviewed; the policy enforced with its exclusions registered; a test sign-in blocked as designed",
      "controls": ["AC-3", "AC-17", "IA-2"]
    },
    "app-secrets": {
      "title": "Application secrets",
      "page": "docs/books/b13-governance/14-application-secret-and-configuration-governance.md#secrets-governance",
      "alsoSee": ["docs/books/b18-application-modernization/appendix-a-identity-remediation-work-packages.md#wp3-secret-to-managed-identity"],
      "owner": "Application owners, with the platform teams",
      "attackPath": "A client secret copied from code, a pipeline or a laptop, used to sign in as the application",
      "dependsOn": ["ownerless-apps"],
      "ready": "The credential inventory with no secret outside the exception register; the app management policy export; each moved workload signing in with a managed identity or certificate",
      "controls": ["IA-5", "SC-12"]
    },
    "ownerless-apps": {
      "title": "Ownerless privileged applications",
      "page": "docs/books/b13-governance/14-application-secret-and-configuration-governance.md#application-governance-record",
      "alsoSee": ["docs/books/b18-application-modernization/appendix-a-identity-remediation-work-packages.md#wp1-owner-assignment"],
      "owner": "Application owners, with the platform teams",
      "attackPath": "A highly privileged application nobody watches, abused for persistence or data access",
      "dependsOn": [],
      "ready": "The application governance record with an owner for every privileged application; the owner report showing none missing",
      "controls": ["AC-2", "CM-8"]
    },
    "redirect-uri": {
      "title": "Redirect URI risk",
      "page": "docs/books/b08-ddi/06-dns-identity-and-dnssec.md#redirect-uris-and-dns-ownership",
      "alsoSee": ["docs/books/b18-application-modernization/appendix-a-identity-remediation-work-packages.md#wp4-redirect-uri-cleanup"],
      "owner": "Application owners, with the DNS/DDI team",
      "attackPath": "A token sent to a redirect URI whose domain or host an attacker can claim",
      "dependsOn": ["ownerless-apps"],
      "ready": "The redirect URI inventory reconciled to owned DNS zones; no dangling or insecure URI outside the exception register",
      "controls": ["CM-8", "SC-20"]
    },
    "device-compliance": {
      "title": "Device compliance gaps",
      "page": "docs/books/b05-devices/10-operating-and-evidencing-the-fleet.md#compliance-architecture",
      "alsoSee": [],
      "owner": "Endpoint engineering",
      "attackPath": "Corporate data reached from an unmanaged or noncompliant device",
      "dependsOn": ["conditional-access"],
      "ready": "Compliance policy exports; the device-based Conditional Access policy enforced; a noncompliant test device refused",
      "controls": ["AC-19", "CM-6"]
    },
    "endpoint-hardening": {
      "title": "Endpoint hardening gaps",
      "page": "docs/books/b05-devices/08-gpo-to-intune-policy-migration.md#windows-hardening-rollout",
      "alsoSee": ["docs/books/guides/defender-xdr-implementation.md"],
      "owner": "Endpoint engineering, with security operations",
      "attackPath": "Malware or an exploit that runs on an endpoint no rule, sensor or block mode stops",
      "dependsOn": ["device-compliance"],
      "ready": "Onboarding coverage report; ASR rules and prevention settings in block mode with their exclusions registered; a test detection that raised its alert",
      "controls": ["CM-6", "CM-7", "SI-3", "SI-4"]
    },
    "network-access": {
      "title": "Network access gaps",
      "page": "docs/books/guides/global-secure-access-implementation.md",
      "alsoSee": ["docs/books/b09-network/05-sd-wan-sase-and-governed-transport.md"],
      "owner": "Network engineering, with security architecture",
      "attackPath": "Traffic that reaches private or internet resources without passing an identity-aware policy point",
      "dependsOn": ["conditional-access", "device-compliance"],
      "ready": "Forwarding profile and policy exports; traffic logs showing the in-scope population routed; a blocked test destination",
      "controls": ["AC-4", "AC-17", "SC-7"]
    },
    "ddos-waf-exposure": {
      "title": "DDoS, WAF and public exposure",
      "page": "docs/books/guides/azure-security-implementation.md",
      "alsoSee": ["docs/books/b10-cloud-boundary/05-the-landing-zone.md"],
      "owner": "Platform team, with network engineering",
      "attackPath": "An internet-facing service exhausted or exploited because nothing absorbs or inspects the traffic",
      "dependsOn": [],
      "ready": "The public exposure register; DDoS protection and WAF in prevention mode on every in-scope endpoint; a blocked test request in the WAF log",
      "controls": ["SC-5", "SC-7", "SI-10"]
    },
    "labels": {
      "title": "No labels, defaults or containers",
      "page": "docs/books/b20-information-protection/index.md",
      "alsoSee": [],
      "owner": "Data owners and the data office",
      "attackPath": "Sensitive files and mail that carry no label, so no policy follows them",
      "dependsOn": [],
      "ready": "The label and label policy exports; default and container labels published; label activity in the audit log",
      "controls": ["AC-16", "MP-3"]
    },
    "rights-management": {
      "title": "Rights Management and mail encryption",
      "page": "docs/books/b20-information-protection/index.md",
      "alsoSee": [],
      "owner": "Data owners and the data office",
      "attackPath": "A labeled file or message read by whoever ends up holding it",
      "dependsOn": ["labels"],
      "ready": "The Rights Management service activation state; encrypting labels published; a protected test message opened only by its recipient",
      "controls": ["SC-8", "SC-28", "AC-16"]
    },
    "audit-visibility": {
      "title": "Audit and visibility gaps",
      "page": "docs/books/b12-security-operations/02-the-evidence-contract.md#data-and-endpoint-telemetry",
      "alsoSee": ["docs/books/b20-information-protection/10-audit-insider-risk-and-communication-compliance.md", "docs/books/guides/defender-xdr-implementation.md"],
      "owner": "Security operations",
      "attackPath": "Activity nobody can reconstruct because its log was never sent or kept",
      "dependsOn": [],
      "ready": "Diagnostic settings exports; the workspace receiving every expected table; the telemetry-completeness check passing",
      "controls": ["AU-2", "AU-6", "AU-12", "SI-4"]
    },
    "identity-risk-triage": {
      "title": "Identity risk triage",
      "page": "docs/books/b12-security-operations/appendix-b-identity-and-application-detections.md",
      "alsoSee": ["docs/books/b15-day2-operations/12-the-day-two-runbook.md#the-cadence-by-control-family"],
      "owner": "Security operations, with identity engineering",
      "attackPath": "A compromised account that ID Protection flagged and nobody triaged",
      "dependsOn": ["audit-visibility"],
      "ready": "The risky-user and risky-sign-in detections deployed; the daily triage record; no high-risk user older than the triage window",
      "controls": ["SI-4", "IR-4", "AC-2"]
    }
  },
  "tests": {
    "21835": "emergency-access",
    "21816": "standing-privilege",
    "21815": "standing-privilege",
    "21817": "standing-privilege",
    "21813": "standing-privilege",
    "21812": "standing-privilege",
    "21876": "standing-privilege",
    "21781": "phishing-resistant-admin",
    "21782": "phishing-resistant-admin",
    "21783": "phishing-resistant-admin",
    "21796": "conditional-access",
    "21797": "conditional-access",
    "21799": "conditional-access",
    "21941": "conditional-access",
    "21883": "conditional-access",
    "21884": "conditional-access",
    "61009": "conditional-access",
    "21772": "app-secrets",
    "21775": "app-secrets",
    "21867": "ownerless-apps",
    "24518": "ownerless-apps",
    "21885": "redirect-uri",
    "21888": "redirect-uri",
    "23183": "redirect-uri",
    "21837": "device-compliance",
    "24824": "device-compliance",
    "24546": "device-compliance",
    "24548": "device-compliance",
    "24827": "device-compliance",
    "24574": "endpoint-hardening",
    "41045": "endpoint-hardening",
    "41050": "endpoint-hardening",
    "25381": "network-access",
    "25416": "network-access",
    "25533": "ddos-waf-exposure",
    "27018": "ddos-waf-exposure",
    "35003": "labels",
    "35005": "labels",
    "35016": "labels",
    "35017": "labels",
    "35024": "rights-management",
    "35013": "rights-management",
    "21860": "audit-visibility",
    "21861": "identity-risk-triage",
    "21863": "identity-risk-triage"
  },
  "categories": {
    "Privileged access": "standing-privilege",
    "Global Secure Access": "network-access",
    "Azure Network Security": "ddos-waf-exposure",
    "Endpoint threat protection": "endpoint-hardening",
    "Sensitivity Labels": "labels",
    "sensitivity-labels": "labels",
    "Rights Management Service": "rights-management"
  }
}
