CSAEC — The assessment examines twelve defined areas. Each result is a point-in-time indicator with a practical next step and an explicit limitation.
Reviews whether host firewall protection is active at a high level.
A disabled or unsuitable firewall can increase exposure to unsolicited connections and make unnecessary services easier to reach.
Enable and review Windows firewall protection under approved policy. Validate every exception before changing it.
The check does not prove that every firewall rule is appropriate.
Checks available indicators of data-at-rest protection.
Unencrypted storage can expose business data when a device is lost, stolen or accessed without authorisation.
Use organisation-approved disk encryption and protect recovery information securely.
The check does not evaluate every key-management, recovery or escrow practice.
Reviews operating-system integrity and security configuration signals.
Weakened integrity controls can make unauthorised system changes more difficult to prevent, identify or investigate.
Apply supported security settings and investigate unexpected system changes with qualified personnel.
Coverage depends on Windows edition, permissions and information exposed to the application.
Identifies listening ports and potentially exposed services.
Unnecessary listening ports and reachable services increase the attack surface and can expose outdated or misconfigured components.
Confirm the business need for each service, restrict reachability and remove or reconfigure unnecessary exposure after impact review.
Filtered or closed services and current network conditions can reduce visibility.
Discovers visible devices to support asset awareness.
Unknown devices may indicate unmanaged assets, guest access, shadow IT or an incomplete inventory that requires review.
Compare discovered devices with an authorised inventory and investigate unexplained systems through the responsible network owner.
Discovery is not a complete inventory; segmentation, filtering and sleeping devices can hide assets.
Checks whether unattended access is limited by automatic locking.
An unattended unlocked workstation can permit access to email, files, applications and authenticated business sessions.
Set a suitable inactivity timeout and require authentication on return according to business policy.
The check cannot measure user behaviour or every possible policy source.
Reviews whether security update mechanisms are enabled.
Delayed or failed security updates can leave known weaknesses unaddressed even when an update policy appears enabled.
Maintain a controlled update process, test business-critical changes and resolve persistent installation failures.
Configuration does not prove that every security update installed successfully.
Checks available indicators of active endpoint protection.
Missing, disabled or outdated endpoint protection can reduce the organisation’s ability to prevent, detect and respond to malicious activity.
Enable a supported protection platform, verify current updates and review alerts according to the incident process.
CSAEC is not antivirus or EDR and cannot replace continuous endpoint monitoring.
Looks for indicators that a backup configuration exists.
Without complete, protected and restorable backups, recovery from ransomware, failure or accidental deletion may be slow or impossible.
Maintain isolated or otherwise protected backups and perform regular restoration tests with documented results.
Configuration evidence does not prove completeness, integrity, isolation or restorability.
Reviews radio-interface exposure and discoverability.
Unused wireless interfaces or discoverable Bluetooth services can create unnecessary nearby opportunities for access or data exposure.
Disable unused radios and limit discoverability according to operational needs, travel policy and device ownership.
Radio state and discoverability can change immediately after the assessment.
Uses vulnerability-oriented checks, including Nmap where available.
Potentially vulnerable services may allow compromise, but version detection and vulnerability signatures always require validation.
Validate the affected product and version, assess exposure and impact, then use vendor-supported mitigation or updates.
False positives and false negatives are possible, and a result is not proof of exploitability.
Uses Wapiti where available against reachable local web services.
Weak locally reachable web services may expose data or application functions, but automated coverage is not equivalent to a full penetration test.
Validate the result within the authorised scope, then update, reconfigure, isolate or remove the affected service.
Only reachable services are assessed; specialist manual testing may find additional weaknesses.
A workstation may have current antivirus protection but still expose an unnecessary network service. It may use disk encryption but lack tested backups. It may have a strong firewall while an employee session remains available on an unlocked screen. Security emerges from layers that support each other.
This is why CSAEC retains all twelve findings instead of presenting only a total. Improvement should focus on the weaknesses that create the greatest plausible harm for the particular system, users and business processes.