How do I install the Infrastructure Compliance Auditor skill?

Run npx skillmds@latest add aibot88/infrastructure-compliance-auditor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Infrastructure Compliance Auditor skill do?

Cross-cutting infrastructure security audit skill that checks cloud infrastructure, DNS, TLS, endpoints, access control, network security, containers, CI/CD pipelines, secrets management, logging, and physical security against ALL major compliance frameworks. Use for infrastructure audit, cloud security audit, infrastructure compliance, DNS security audit, TLS audit, endpoint security, access control audit, network security assessment, infrastructure security, cloud compliance, Vanta alternative, compliance automation, security posture assessment, hardware security keys, YubiKey compliance. It is listed under DevOps & Infra on SkillMD.

Is Infrastructure Compliance Auditor safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Infrastructure Compliance Auditor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Infrastructure Compliance Auditor free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT + Commons Clause.

Who published Infrastructure Compliance Auditor?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Infrastructure Compliance Auditor by aibot88

Name: Infrastructure Compliance Auditor
Rating: 4.5 (4 reviews)
Author: aibot88

Infrastructure Compliance Auditor

Cross-cutting infrastructure security audit across ALL compliance frameworks. Replaces manual Vanta-style checks with deterministic, repeatable, evidence-generating infrastructure audits covering cloud, DNS, TLS, endpoints, access control, network, containers, CI/CD, secrets, logging, and physical security.

Trigger Phrases
Quick Start
Tools
Audit Domains
Workflows
Reference Guides
Validation Checkpoints
Scoring Methodology

Trigger Phrases

Use this skill when you hear:

"infrastructure audit"
"cloud security audit"
"infrastructure compliance"
"DNS security audit"
"TLS audit"
"endpoint security"
"access control audit"
"network security assessment"
"infrastructure security"
"cloud compliance"
"Vanta alternative"
"compliance automation"
"security posture assessment"
"hardware security keys"
"YubiKey compliance"

Quick Start

Run Full Infrastructure Audit

python scripts/infra_audit_runner.py --config infrastructure.json --output audit_report.json

Audit DNS Security for a Domain

python scripts/dns_security_checker.py --domain example.com --output dns_report.json

Audit Access Controls

python scripts/access_control_auditor.py --config access_controls.json --output access_report.json

Generate Compliance-Mapped Report

python scripts/infra_audit_runner.py --config infrastructure.json --frameworks soc2,iso27001,hipaa --format markdown --output compliance_report.md

Tools

Tool	Purpose	Input
`infra_audit_runner.py`	Full infrastructure audit across all 11 domains	JSON config describing infrastructure
`dns_security_checker.py`	DNS-specific security audit (SPF, DKIM, DMARC, DNSSEC, CAA, MTA-STS)	Domain name
`access_control_auditor.py`	Access control, MFA, SSO, PAM, RBAC audit	JSON config describing access controls

Audit Domains

1. Cloud Infrastructure Security

AWS Security Audit Checklist

IAM Policies and Roles

Check ID	Control	Severity	Frameworks
AWS-IAM-001	Root account has MFA enabled (hardware MFA preferred)	Critical	SOC 2 CC6.1, ISO 27001 A.9.2.1, PCI-DSS 8.3, NIST CSF PR.AC-1, HIPAA 164.312(d), FedRAMP AC-2
AWS-IAM-002	Root account has no access keys	Critical	SOC 2 CC6.1, ISO 27001 A.9.2.3, PCI-DSS 2.1, NIST CSF PR.AC-4
AWS-IAM-003	No IAM policies with `"Effect": "Allow", "Action": "", "Resource": ""`	Critical	SOC 2 CC6.3, ISO 27001 A.9.4.1, PCI-DSS 7.1, NIST CSF PR.AC-4
AWS-IAM-004	All IAM users have MFA enabled	High	SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.3, HIPAA 164.312(d)
AWS-IAM-005	IAM password policy enforces minimum 14 characters	Medium	SOC 2 CC6.1, ISO 27001 A.9.4.3, PCI-DSS 8.2.3, NIST CSF PR.AC-1
AWS-IAM-006	IAM roles use external ID for cross-account access	Medium	SOC 2 CC6.3, ISO 27001 A.9.2.1
AWS-IAM-007	Unused IAM credentials (>90 days) are disabled	Medium	SOC 2 CC6.2, ISO 27001 A.9.2.6, PCI-DSS 8.1.4
AWS-IAM-008	IAM Access Analyzer is enabled in all regions	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.5
AWS-IAM-009	No inline IAM policies (use managed policies)	Low	ISO 27001 A.9.2.2
AWS-IAM-010	IAM policy conditions restrict by source IP or VPC where possible	Low	SOC 2 CC6.6, NIST CSF PR.AC-3

S3 Bucket Security

Check ID	Control	Severity	Frameworks
AWS-S3-001	S3 Block Public Access enabled at account level	Critical	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1), GDPR Art.32
AWS-S3-002	No S3 buckets with public ACLs or policies	Critical	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, HIPAA 164.312(e)(1)
AWS-S3-003	Server-side encryption enabled (SSE-S3 minimum, SSE-KMS preferred)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv), GDPR Art.32
AWS-S3-004	Versioning enabled on critical data buckets	Medium	SOC 2 CC6.7, ISO 27001 A.12.3.1
AWS-S3-005	Access logging enabled for all buckets	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2
AWS-S3-006	Lifecycle policies configured for log retention	Low	SOC 2 CC7.2, ISO 27001 A.12.4.1
AWS-S3-007	MFA Delete enabled for critical buckets	Medium	SOC 2 CC6.7, ISO 27001 A.12.3.1
AWS-S3-008	S3 Object Lock enabled for compliance data (WORM)	Medium	SEC Rule 17a-4, HIPAA 164.312(c)(1)

VPC Configuration

Check ID	Control	Severity	Frameworks
AWS-VPC-001	VPC Flow Logs enabled for all VPCs	High	SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2, NIST CSF DE.CM-1
AWS-VPC-002	Default security group restricts all inbound/outbound	High	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.2
AWS-VPC-003	No security groups allow 0.0.0.0/0 on SSH (22) or RDP (3389)	Critical	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3, NIST CSF PR.AC-5
AWS-VPC-004	Private subnets used for databases and application tiers	High	SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.3
AWS-VPC-005	NACLs configured as additional defense layer	Medium	SOC 2 CC6.6, PCI-DSS 1.2
AWS-VPC-006	VPC endpoints used for AWS service access (avoid public internet)	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.1
AWS-VPC-007	Transit Gateway or VPC Peering uses non-overlapping CIDRs	Low	ISO 27001 A.13.1.1

RDS Security

Check ID	Control	Severity	Frameworks
AWS-RDS-001	Encryption at rest enabled (KMS)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv)
AWS-RDS-002	SSL/TLS connections enforced (`rds.force_ssl = 1`)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1
AWS-RDS-003	Automated backups enabled with minimum 7-day retention	Medium	SOC 2 CC6.7, ISO 27001 A.12.3.1, HIPAA 164.308(a)(7)(ii)(A)
AWS-RDS-004	Multi-AZ deployment for production databases	Medium	SOC 2 A1.2, ISO 27001 A.17.1.1
AWS-RDS-005	Database instances not publicly accessible	Critical	SOC 2 CC6.6, PCI-DSS 1.3
AWS-RDS-006	Enhanced monitoring enabled	Low	SOC 2 CC7.2, ISO 27001 A.12.4.1
AWS-RDS-007	Deletion protection enabled for production instances	Medium	SOC 2 CC6.7

CloudTrail and Monitoring

Check ID	Control	Severity	Frameworks
AWS-CT-001	CloudTrail enabled in all regions	Critical	SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.1, HIPAA 164.312(b), NIST CSF DE.CM-1, FedRAMP AU-2
AWS-CT-002	CloudTrail log file validation enabled	High	SOC 2 CC7.2, ISO 27001 A.12.4.3, PCI-DSS 10.5
AWS-CT-003	CloudTrail logs delivered to S3 with encryption	High	SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.5
AWS-CT-004	CloudTrail integrated with CloudWatch Logs	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1
AWS-CT-005	GuardDuty enabled in all regions	High	SOC 2 CC7.2, NIST CSF DE.CM-1
AWS-CT-006	Security Hub enabled with CIS AWS Foundations Benchmark	Medium	SOC 2 CC7.2, NIST CSF DE.CM-1
AWS-CT-007	AWS Config enabled with required rules	High	SOC 2 CC7.2, ISO 27001 A.12.4.1, NIST CSF DE.CM-1, FedRAMP CM-8

KMS and Encryption

Check ID	Control	Severity	Frameworks
AWS-KMS-001	Customer-managed KMS keys used for sensitive data	High	SOC 2 CC6.7, ISO 27001 A.10.1.2, PCI-DSS 3.5
AWS-KMS-002	KMS key rotation enabled (annual automatic rotation)	Medium	SOC 2 CC6.7, ISO 27001 A.10.1.2, PCI-DSS 3.6.4
AWS-KMS-003	KMS key policies follow least privilege	Medium	SOC 2 CC6.3, ISO 27001 A.10.1.2
AWS-KMS-004	KMS keys have alias and description for identification	Low	ISO 27001 A.10.1.2

Lambda and Serverless Security

Check ID	Control	Severity	Frameworks
AWS-LAM-001	Lambda functions use IAM roles with least privilege	High	SOC 2 CC6.3, ISO 27001 A.9.4.1
AWS-LAM-002	Lambda functions do not store secrets in environment variables (use Secrets Manager)	High	SOC 2 CC6.7, PCI-DSS 3.4
AWS-LAM-003	Lambda functions deployed in VPC when accessing private resources	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.1
AWS-LAM-004	Lambda function code is signed	Medium	SOC 2 CC7.1
AWS-LAM-005	Dead letter queues configured for async invocations	Low	SOC 2 A1.2

EKS/ECS Container Security

Check ID	Control	Severity	Frameworks
AWS-EKS-001	EKS cluster endpoint not publicly accessible (or restricted by CIDR)	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
AWS-EKS-002	EKS control plane logging enabled (api, audit, authenticator)	High	SOC 2 CC7.2, ISO 27001 A.12.4.1
AWS-EKS-003	EKS managed node groups use latest AMI	Medium	SOC 2 CC7.1
AWS-EKS-004	ECS tasks use awsvpc networking mode	Medium	SOC 2 CC6.6
AWS-EKS-005	ECR image scanning enabled on push	High	SOC 2 CC7.1, NIST CSF PR.IP-12

Azure Security Audit Checklist

Azure AD / Entra ID

Check ID	Control	Severity	Frameworks
AZ-AD-001	Global Administrator accounts have MFA enforced	Critical	SOC 2 CC6.1, ISO 27001 A.9.2.1, PCI-DSS 8.3
AZ-AD-002	Maximum 5 Global Administrator accounts	High	SOC 2 CC6.1, ISO 27001 A.9.2.3
AZ-AD-003	Conditional Access Policies configured	High	SOC 2 CC6.1, ISO 27001 A.9.4.2
AZ-AD-004	Security Defaults enabled (if no Conditional Access)	High	SOC 2 CC6.1
AZ-AD-005	Privileged Identity Management (PIM) enabled for admin roles	High	SOC 2 CC6.1, ISO 27001 A.9.2.3
AZ-AD-006	Guest user access restricted	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.2
AZ-AD-007	Sign-in risk policy configured (requires P2)	Medium	SOC 2 CC6.1

Azure Network Security

Check ID	Control	Severity	Frameworks
AZ-NET-001	NSG rules follow least privilege (no allow-all inbound)	High	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.2
AZ-NET-002	Azure Firewall or third-party NVA deployed	Medium	SOC 2 CC6.6, PCI-DSS 1.1
AZ-NET-003	DDoS Protection Standard enabled for public IPs	Medium	SOC 2 A1.2, ISO 27001 A.13.1.1
AZ-NET-004	Private endpoints used for PaaS services	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.1
AZ-NET-005	Network Watcher enabled in all regions	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1

Azure Key Vault

Check ID	Control	Severity	Frameworks
AZ-KV-001	Key Vault uses RBAC (not legacy access policies)	High	SOC 2 CC6.3, ISO 27001 A.10.1.2
AZ-KV-002	Soft delete and purge protection enabled	High	SOC 2 CC6.7, ISO 27001 A.10.1.2
AZ-KV-003	Key Vault diagnostic logging enabled	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1
AZ-KV-004	Key rotation policy configured	Medium	SOC 2 CC6.7, PCI-DSS 3.6.4
AZ-KV-005	Key Vault firewall enabled (restrict to VNet/IP)	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.1

Azure Monitoring

Check ID	Control	Severity	Frameworks
AZ-MON-001	Azure Monitor activity log alerts configured	High	SOC 2 CC7.2, ISO 27001 A.12.4.1
AZ-MON-002	Microsoft Sentinel (SIEM) deployed	Medium	SOC 2 CC7.2, NIST CSF DE.AE-2
AZ-MON-003	Diagnostic settings enabled for all resources	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1
AZ-MON-004	Azure Policy assignments enforcing compliance	High	SOC 2 CC7.1, ISO 27001 A.18.2.2
AZ-MON-005	Microsoft Defender for Cloud enabled (all plans)	High	SOC 2 CC7.2, NIST CSF DE.CM-1

Azure Storage Security

Check ID	Control	Severity	Frameworks
AZ-ST-001	Storage accounts require HTTPS transfer	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1
AZ-ST-002	Storage account public access disabled	Critical	SOC 2 CC6.6, ISO 27001 A.13.1.1
AZ-ST-003	Storage accounts use customer-managed keys	Medium	SOC 2 CC6.7, PCI-DSS 3.5
AZ-ST-004	Shared Access Signatures (SAS) use short expiry	Medium	SOC 2 CC6.1, ISO 27001 A.9.4.2

AKS Security

Check ID	Control	Severity	Frameworks
AZ-AKS-001	AKS uses managed identity (not service principal)	High	SOC 2 CC6.1, ISO 27001 A.9.4.1
AZ-AKS-002	Azure Policy for AKS enabled	Medium	SOC 2 CC7.1
AZ-AKS-003	AKS API server authorized IP ranges configured	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
AZ-AKS-004	AKS uses Azure CNI (not kubenet) for network policies	Medium	SOC 2 CC6.6

GCP Security Audit Checklist

GCP IAM and Service Accounts

Check ID	Control	Severity	Frameworks
GCP-IAM-001	Organization-level IAM policies use groups, not individual users	High	SOC 2 CC6.1, ISO 27001 A.9.2.2
GCP-IAM-002	Service accounts do not have Owner/Editor roles	Critical	SOC 2 CC6.3, ISO 27001 A.9.4.1
GCP-IAM-003	User-managed service account keys rotate every 90 days	High	SOC 2 CC6.1, PCI-DSS 3.6.4
GCP-IAM-004	Domain-restricted sharing enabled via Organization Policy	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.2
GCP-IAM-005	Workload Identity used for GKE (no service account keys)	High	SOC 2 CC6.1, ISO 27001 A.9.4.1

GCP VPC and Network

Check ID	Control	Severity	Frameworks
GCP-VPC-001	VPC Service Controls configured for sensitive projects	High	SOC 2 CC6.6, ISO 27001 A.13.1.3
GCP-VPC-002	Cloud Armor WAF rules protect public-facing services	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
GCP-VPC-003	VPC Flow Logs enabled for all subnets	High	SOC 2 CC7.2, ISO 27001 A.12.4.1
GCP-VPC-004	Private Google Access enabled for private subnets	Medium	SOC 2 CC6.6
GCP-VPC-005	Firewall rules do not allow 0.0.0.0/0 on SSH/RDP	Critical	SOC 2 CC6.6, PCI-DSS 1.3

GCP Security Services

Check ID	Control	Severity	Frameworks
GCP-SEC-001	Security Command Center (SCC) enabled (Premium)	High	SOC 2 CC7.2, NIST CSF DE.CM-1
GCP-SEC-002	Cloud KMS keys have rotation scheduled	Medium	SOC 2 CC6.7, PCI-DSS 3.6.4
GCP-SEC-003	Cloud Audit Logs enabled for all services	High	SOC 2 CC7.2, ISO 27001 A.12.4.1
GCP-SEC-004	Binary Authorization enabled for GKE	Medium	SOC 2 CC7.1
GCP-SEC-005	Organization Policy Service enforces constraints	High	SOC 2 CC7.1, ISO 27001 A.18.2.2

GKE Security

Check ID	Control	Severity	Frameworks
GCP-GKE-001	GKE uses private cluster (no public endpoint) or authorized networks	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
GCP-GKE-002	GKE Shielded Nodes enabled	Medium	SOC 2 CC6.7
GCP-GKE-003	GKE node auto-upgrade enabled	Medium	SOC 2 CC7.1, NIST CSF PR.IP-12
GCP-GKE-004	GKE workload identity enabled (no node service account keys)	High	SOC 2 CC6.1
GCP-GKE-005	Container-Optimized OS used for nodes	Medium	SOC 2 CC7.1

2. DNS Security

Email Authentication Chain

SPF, DKIM, and DMARC form a layered email authentication system. ALL three must be configured correctly for effective protection against spoofing and phishing.

SPF (Sender Policy Framework)

Check ID	Control	Severity	Frameworks
DNS-SPF-001	SPF record exists for primary domain	High	SOC 2 CC6.6, ISO 27001 A.13.2.1, NIST CSF PR.AC-3
DNS-SPF-002	SPF record uses `-all` (hard fail) not `~all` (soft fail)	High	SOC 2 CC6.6, ISO 27001 A.13.2.1
DNS-SPF-003	SPF record has fewer than 10 DNS lookups (RFC 7208 limit)	Medium	SOC 2 CC6.6
DNS-SPF-004	SPF record does not use `+all` (permits all senders)	Critical	SOC 2 CC6.6, ISO 27001 A.13.2.1
DNS-SPF-005	Non-sending domains have `v=spf1 -all` to prevent spoofing	Medium	ISO 27001 A.13.2.1
DNS-SPF-006	SPF record avoids deprecated PTR mechanism	Low	RFC 7208
DNS-SPF-007	SPF flattening used if approaching lookup limit	Low	Best practice

SPF syntax reference:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.0/24 -all

Key rules:

Maximum 10 DNS lookups (include, a, mx, ptr, exists, redirect each count as 1)
ip4 and ip6 mechanisms do NOT count toward the 10-lookup limit
Nested includes count toward the limit
Record must be a single TXT record (no multiple SPF records)
Maximum 255 characters per DNS string (use string concatenation for longer records)

DKIM (DomainKeys Identified Mail)

Check ID	Control	Severity	Frameworks
DNS-DKIM-001	DKIM record exists for all sending domains	High	SOC 2 CC6.6, ISO 27001 A.13.2.1
DNS-DKIM-002	DKIM key is minimum 2048-bit RSA	High	SOC 2 CC6.7, ISO 27001 A.10.1.1
DNS-DKIM-003	DKIM keys rotate every 6-12 months	Medium	SOC 2 CC6.7, ISO 27001 A.10.1.2
DNS-DKIM-004	Multiple DKIM selectors for different sending services	Low	Best practice
DNS-DKIM-005	DKIM testing mode (`t=y`) removed for production domains	Medium	SOC 2 CC6.6

DKIM record format:

selector._domainkey.example.com IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

Check ID	Control	Severity	Frameworks
DNS-DMARC-001	DMARC record exists at `_dmarc.example.com`	High	SOC 2 CC6.6, ISO 27001 A.13.2.1, NIST CSF PR.AC-3
DNS-DMARC-002	DMARC policy is `p=reject` (maximum enforcement)	High	SOC 2 CC6.6, ISO 27001 A.13.2.1
DNS-DMARC-003	DMARC `rua` (aggregate reporting) tag configured	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1
DNS-DMARC-004	DMARC `ruf` (forensic reporting) tag configured	Low	SOC 2 CC7.2
DNS-DMARC-005	DMARC subdomain policy `sp=reject` configured	Medium	ISO 27001 A.13.2.1
DNS-DMARC-006	DMARC alignment modes — `adkim=s` and `aspf=s` (strict) preferred	Medium	SOC 2 CC6.6
DNS-DMARC-007	DMARC `pct=100` (applies to all messages)	Medium	SOC 2 CC6.6

DMARC record format:

_dmarc.example.com IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-forensic@example.com; pct=100"

DMARC rollout strategy (avoid disrupting legitimate email):

p=none; rua=mailto:... — Monitor for 2-4 weeks
p=quarantine; pct=10 — Quarantine 10% of failing messages
p=quarantine; pct=50 — Increase gradually
p=quarantine; pct=100 — Full quarantine
p=reject; pct=100 — Full enforcement

DNSSEC

Check ID	Control	Severity	Frameworks
DNS-SEC-001	DNSSEC signing enabled for domain	High	SOC 2 CC6.6, ISO 27001 A.13.1.1, NIST CSF PR.DS-2
DNS-SEC-002	DS record published in parent zone	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
DNS-SEC-003	DNSSEC algorithm is ECDSAP256SHA256 (13) or newer	Medium	SOC 2 CC6.7
DNS-SEC-004	DNSSEC key rotation schedule documented	Medium	SOC 2 CC6.7, ISO 27001 A.10.1.2

CAA (Certificate Authority Authorization)

Check ID	Control	Severity	Frameworks
DNS-CAA-001	CAA record exists restricting certificate issuance	High	SOC 2 CC6.7, ISO 27001 A.10.1.2
DNS-CAA-002	CAA `iodef` tag configured for certificate issuance notifications	Medium	SOC 2 CC7.2
DNS-CAA-003	Only authorized CAs listed in CAA record	High	SOC 2 CC6.7

CAA record format:

example.com IN CAA 0 issue "letsencrypt.org"
example.com IN CAA 0 issue "digicert.com"
example.com IN CAA 0 issuewild "letsencrypt.org"
example.com IN CAA 0 iodef "mailto:security@example.com"

MTA-STS and TLS-RPT

Check ID	Control	Severity	Frameworks
DNS-MTA-001	MTA-STS policy published at `/.well-known/mta-sts.txt`	Medium	ISO 27001 A.13.2.1
DNS-MTA-002	MTA-STS DNS record `_mta-sts.example.com` exists	Medium	ISO 27001 A.13.2.1
DNS-MTA-003	MTA-STS mode is `enforce` (not `testing` or `none`)	Medium	ISO 27001 A.13.2.1
DNS-MTA-004	TLS-RPT record `_smtp._tls.example.com` configured	Low	ISO 27001 A.12.4.1

MTA-STS policy (at https://mta-sts.example.com/.well-known/mta-sts.txt):

version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example.com
max_age: 604800

Domain Security

Check ID	Control	Severity	Frameworks
DNS-DOM-001	Registrar lock enabled (clientTransferProhibited)	High	SOC 2 CC6.7, ISO 27001 A.13.1.1
DNS-DOM-002	WHOIS privacy enabled	Low	GDPR Art.5
DNS-DOM-003	2FA enabled on domain registrar account	Critical	SOC 2 CC6.1, ISO 27001 A.9.4.2
DNS-DOM-004	Domain expiration monitored (>60 days before expiry)	Medium	SOC 2 A1.2
DNS-DOM-005	Subdomain inventory maintained (prevent subdomain takeover)	High	SOC 2 CC6.6, ISO 27001 A.13.1.1
DNS-DOM-006	Dangling DNS records (CNAME to deprovisioned services) monitored	High	SOC 2 CC6.6
DNS-DOM-007	DNS monitoring alerts configured for unauthorized changes	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1

3. TLS/SSL Security

Certificate Management

Check ID	Control	Severity	Frameworks
TLS-CERT-001	Certificates issued by trusted CA (not self-signed for public services)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1
TLS-CERT-002	Automated certificate renewal via ACME (Let's Encrypt, ZeroSSL)	Medium	SOC 2 CC6.7
TLS-CERT-003	Certificate expiration monitored (alert at 30, 14, 7 days)	High	SOC 2 A1.2, ISO 27001 A.10.1.2
TLS-CERT-004	Certificate Transparency (CT) log monitoring enabled	Medium	SOC 2 CC7.2
TLS-CERT-005	No wildcard certificates for high-security domains	Medium	SOC 2 CC6.7, PCI-DSS 4.1
TLS-CERT-006	Certificate validity period 90 days maximum (Let's Encrypt standard)	Low	Best practice
TLS-CERT-007	OCSP stapling enabled	Medium	SOC 2 CC6.7
TLS-CERT-008	Certificate pinning only for mobile apps (not web — risk of bricking)	Info	Best practice

Protocol and Cipher Configuration

Check ID	Control	Severity	Frameworks
TLS-PROTO-001	TLS 1.2 minimum (TLS 1.0 and 1.1 disabled)	Critical	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1, NIST CSF PR.DS-2, HIPAA 164.312(e)(1)
TLS-PROTO-002	TLS 1.3 preferred where supported	Medium	SOC 2 CC6.7, NIST CSF PR.DS-2
TLS-PROTO-003	SSL 2.0 and 3.0 disabled	Critical	PCI-DSS 4.1, NIST CSF PR.DS-2
TLS-CIPHER-001	Forward secrecy enabled (ECDHE or DHE key exchange)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1
TLS-CIPHER-002	AEAD cipher suites only (GCM, ChaCha20-Poly1305)	High	SOC 2 CC6.7, PCI-DSS 4.1
TLS-CIPHER-003	No RC4, 3DES, DES, NULL, or EXPORT ciphers	Critical	PCI-DSS 4.1, NIST CSF PR.DS-2
TLS-CIPHER-004	No CBC mode ciphers (BEAST/POODLE vulnerability)	High	PCI-DSS 4.1
TLS-CIPHER-005	RSA key exchange disabled (no forward secrecy)	Medium	SOC 2 CC6.7

Recommended TLS 1.2 cipher suites (in order):

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

TLS 1.3 cipher suites (always use all three):

TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256

HTTP Security Headers

Check ID	Control	Severity	Frameworks
TLS-HSTS-001	HSTS enabled with `max-age` >= 31536000 (1 year)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 4.1, NIST CSF PR.DS-2
TLS-HSTS-002	HSTS `includeSubDomains` directive set	High	SOC 2 CC6.7
TLS-HSTS-003	HSTS preload submitted to hstspreload.org	Medium	SOC 2 CC6.7
TLS-HSTS-004	HTTP to HTTPS redirect configured (301 permanent)	High	SOC 2 CC6.7, PCI-DSS 4.1

Internal TLS

Check ID	Control	Severity	Frameworks
TLS-INT-001	mTLS configured for service-to-service communication	High	SOC 2 CC6.7, ISO 27001 A.13.1.1, PCI-DSS 4.1 (if CDE)
TLS-INT-002	Internal PKI with short-lived certificates (24h-7d)	Medium	SOC 2 CC6.7, ISO 27001 A.10.1.2
TLS-INT-003	Service mesh (Istio/Linkerd) manages mTLS transparently	Medium	SOC 2 CC6.7
TLS-INT-004	Database connections use TLS	High	SOC 2 CC6.7, PCI-DSS 4.1, HIPAA 164.312(e)(1)

4. Endpoint Security

Mobile Device Management (MDM)

Check ID	Control	Severity	Frameworks
EP-MDM-001	MDM solution deployed (Jamf, Intune, Kandji)	High	SOC 2 CC6.7, ISO 27001 A.6.2.1, HIPAA 164.310(d)(1), NIST CSF PR.AC-3
EP-MDM-002	All corporate devices enrolled in MDM	High	SOC 2 CC6.7, ISO 27001 A.6.2.1
EP-MDM-003	MDM compliance policies enforced (auto-remediate non-compliant devices)	Medium	SOC 2 CC6.7
EP-MDM-004	MDM reports integrated into security dashboard	Low	SOC 2 CC7.2

Disk Encryption

Check ID	Control	Severity	Frameworks
EP-ENC-001	Full disk encryption enabled on all endpoints (FileVault/BitLocker/LUKS)	Critical	SOC 2 CC6.7, ISO 27001 A.10.1.1, PCI-DSS 3.4, HIPAA 164.312(a)(2)(iv), GDPR Art.32, NIST CSF PR.DS-1
EP-ENC-002	Encryption recovery keys escrowed in MDM or central key management	High	SOC 2 CC6.7, ISO 27001 A.10.1.2
EP-ENC-003	Encryption status verified on every endpoint via MDM	Medium	SOC 2 CC6.7
EP-ENC-004	Mobile devices have device encryption enabled	High	SOC 2 CC6.7, HIPAA 164.312(a)(2)(iv)

Antivirus and EDR

Check ID	Control	Severity	Frameworks
EP-AV-001	EDR solution deployed on all endpoints (CrowdStrike, SentinelOne, Defender for Endpoint)	High	SOC 2 CC6.8, ISO 27001 A.12.2.1, PCI-DSS 5.1, HIPAA 164.308(a)(5)(ii)(B), NIST CSF DE.CM-4
EP-AV-002	Real-time protection enabled and cannot be disabled by users	High	SOC 2 CC6.8, PCI-DSS 5.1
EP-AV-003	Definitions updated automatically (maximum 24h staleness)	Medium	SOC 2 CC6.8, PCI-DSS 5.2
EP-AV-004	EDR telemetry centralized for threat hunting	Medium	SOC 2 CC7.2, NIST CSF DE.AE-2
EP-AV-005	Automatic quarantine/isolation for critical threats	Medium	SOC 2 CC6.8, NIST CSF RS.MI-1

OS Patch Management

Check ID	Control	Severity	Frameworks
EP-PATCH-001	Critical patches applied within 24 hours	Critical	SOC 2 CC7.1, ISO 27001 A.12.6.1, PCI-DSS 6.2, NIST CSF PR.IP-12
EP-PATCH-002	High patches applied within 72 hours	High	SOC 2 CC7.1, ISO 27001 A.12.6.1, PCI-DSS 6.2
EP-PATCH-003	Medium patches applied within 7 days	Medium	SOC 2 CC7.1, ISO 27001 A.12.6.1
EP-PATCH-004	Low patches applied within 30 days	Low	SOC 2 CC7.1, ISO 27001 A.12.6.1
EP-PATCH-005	Patch compliance reported weekly	Medium	SOC 2 CC7.1, ISO 27001 A.12.6.1
EP-PATCH-006	Emergency patch process documented and tested	Medium	SOC 2 CC7.1, NIST CSF RS.MI-3

Additional Endpoint Controls

Check ID	Control	Severity	Frameworks
EP-LOCK-001	Screen lock after 5 minutes of inactivity	Medium	SOC 2 CC6.1, ISO 27001 A.11.2.8, PCI-DSS 8.1.8, HIPAA 164.310(b)
EP-USB-001	USB storage devices blocked or controlled via MDM	Medium	SOC 2 CC6.7, ISO 27001 A.8.3.1, PCI-DSS 9.7
EP-BRW-001	Browser extension allow-listing enforced	Medium	SOC 2 CC6.8, ISO 27001 A.12.2.1
EP-BRW-002	Safe browsing / web filtering enabled	Low	SOC 2 CC6.8, ISO 27001 A.13.1.1
EP-WIPE-001	Remote wipe capability verified for all corporate devices	High	SOC 2 CC6.7, ISO 27001 A.6.2.1, HIPAA 164.310(d)(2)(iii)
EP-BYOD-001	BYOD policy documented and enforced via MDM container	Medium	SOC 2 CC6.7, ISO 27001 A.6.2.1, GDPR Art.32
EP-FW-001	Host-based firewall enabled on all endpoints	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.4

5. Access Control and Authentication

Identity Provider (IdP) Configuration

Check ID	Control	Severity	Frameworks
AC-IDP-001	Centralized IdP deployed (Okta, Azure AD/Entra ID, Google Workspace)	High	SOC 2 CC6.1, ISO 27001 A.9.2.1, PCI-DSS 8.1, HIPAA 164.312(d), NIST CSF PR.AC-1, FedRAMP AC-2
AC-IDP-002	All applications integrated with IdP via SSO	High	SOC 2 CC6.1, ISO 27001 A.9.4.2
AC-IDP-003	IdP has admin MFA enforced (hardware key required for admin)	Critical	SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.3
AC-IDP-004	IdP audit logs exported to SIEM	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1

Single Sign-On (SSO)

Check ID	Control	Severity	Frameworks
AC-SSO-001	SSO implemented via SAML 2.0 or OIDC (no password-based SSO)	High	SOC 2 CC6.1, ISO 27001 A.9.4.2, NIST CSF PR.AC-1
AC-SSO-002	SSO session timeout configured (maximum 8 hours)	Medium	SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.1.8
AC-SSO-003	SSO enforced (local authentication disabled where possible)	High	SOC 2 CC6.1, ISO 27001 A.9.4.2
AC-SSO-004	SCIM provisioning enabled for automated user lifecycle	High	SOC 2 CC6.2, ISO 27001 A.9.2.1, NIST CSF PR.AC-1
AC-SSO-005	Deprovisioning triggers immediate SSO session revocation	High	SOC 2 CC6.2, ISO 27001 A.9.2.6

Multi-Factor Authentication (MFA)

Check ID	Control	Severity	Frameworks
AC-MFA-001	MFA enforced for ALL user accounts (no exceptions)	Critical	SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 8.3, HIPAA 164.312(d), NIST CSF PR.AC-7, GDPR Art.32, NIS2 Art.21, DORA Art.9, FedRAMP IA-2
AC-MFA-002	Phishing-resistant MFA (FIDO2/WebAuthn) required for privileged accounts	Critical	SOC 2 CC6.1, ISO 27001 A.9.4.2, NIST CSF PR.AC-7, FedRAMP IA-2(6)
AC-MFA-003	SMS-based MFA prohibited (SIM swap vulnerability)	High	SOC 2 CC6.1, NIST CSF PR.AC-7
AC-MFA-004	TOTP (time-based one-time password) accepted as minimum MFA	Medium	SOC 2 CC6.1
AC-MFA-005	Hardware security keys (YubiKey 5 Series, Bio Series) deployed for all admins	High	SOC 2 CC6.1, ISO 27001 A.9.4.2, NIST CSF PR.AC-7
AC-MFA-006	MFA recovery process documented (not bypass, requires identity verification)	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.4
AC-MFA-007	MFA enrollment status reported (100% coverage target)	Medium	SOC 2 CC6.1

Hardware Security Key (YubiKey) Implementation:

Enrollment process:

User registers primary YubiKey to IdP (Okta, Azure AD, Google Workspace)
User registers backup YubiKey (stored in secure location)
IdP policy updated to require FIDO2/WebAuthn for user
TOTP/push fallback disabled for privileged accounts

YubiKey policy requirements:

Each user has minimum 2 registered keys (primary + backup)
Backup key stored in secure, documented location
PIN configured on YubiKey (FIDO2 user verification)
Touch required for every authentication
Bio Series (fingerprint) preferred for shared workstations
Inventory of all issued keys maintained
Lost key process: immediate revocation, identity reverification, new key issuance

IdP-specific configuration:

Okta: Enroll YubiKey via FIDO2 (WebAuthn) factor, set Authentication Policy to require phishing-resistant MFA
Azure AD/Entra ID: Configure FIDO2 security key in Authentication Methods, create Conditional Access policy requiring authentication strength "Phishing-resistant MFA"
Google Workspace: Enroll security key in 2-Step Verification, enable Advanced Protection Program for admins

Privileged Access Management (PAM)

Check ID	Control	Severity	Frameworks
AC-PAM-001	Just-in-time (JIT) access implemented for privileged roles	High	SOC 2 CC6.1, ISO 27001 A.9.2.3, PCI-DSS 7.1, NIST CSF PR.AC-4
AC-PAM-002	Privileged access requests require approval workflow	High	SOC 2 CC6.1, ISO 27001 A.9.2.3
AC-PAM-003	Privileged session time-limited (maximum 4 hours, re-approval needed)	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.3
AC-PAM-004	Privileged sessions recorded (screen recording or command logging)	High	SOC 2 CC7.2, ISO 27001 A.12.4.1, PCI-DSS 10.2
AC-PAM-005	Break-glass procedure documented and tested quarterly	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.3, NIST CSF PR.AC-4
AC-PAM-006	Privileged account inventory maintained and reviewed quarterly	High	SOC 2 CC6.2, ISO 27001 A.9.2.5, PCI-DSS 7.1
AC-PAM-007	Standing privileged access eliminated (no permanent admin accounts)	High	SOC 2 CC6.1, ISO 27001 A.9.2.3, NIST CSF PR.AC-4

Role-Based Access Control (RBAC)

Check ID	Control	Severity	Frameworks
AC-RBAC-001	RBAC model documented with role definitions and permissions	High	SOC 2 CC6.3, ISO 27001 A.9.2.2, PCI-DSS 7.1, HIPAA 164.312(a)(1), NIST CSF PR.AC-4
AC-RBAC-002	Role assignments reviewed quarterly (access recertification)	High	SOC 2 CC6.2, ISO 27001 A.9.2.5, PCI-DSS 7.1.1
AC-RBAC-003	Separation of duties enforced (no single user has conflicting roles)	High	SOC 2 CC6.3, ISO 27001 A.6.1.2, PCI-DSS 6.4.2
AC-RBAC-004	Default deny — users get minimum necessary permissions	High	SOC 2 CC6.3, ISO 27001 A.9.4.1
AC-RBAC-005	Role changes logged and auditable	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1

Service Account and API Key Governance

Check ID	Control	Severity	Frameworks
AC-SVC-001	No shared credentials for service accounts	Critical	SOC 2 CC6.1, ISO 27001 A.9.2.4, PCI-DSS 8.5
AC-SVC-002	Service account permissions follow least privilege	High	SOC 2 CC6.3, ISO 27001 A.9.4.1
AC-SVC-003	Service account credentials rotate every 90 days maximum	High	SOC 2 CC6.1, ISO 27001 A.9.2.4, PCI-DSS 8.2.4
AC-SVC-004	Service account inventory maintained with owner assignment	High	SOC 2 CC6.2, ISO 27001 A.9.2.5
AC-SVC-005	API keys scoped to minimum required permissions	High	SOC 2 CC6.3, ISO 27001 A.9.4.1
AC-SVC-006	API keys have expiration dates (maximum 1 year)	Medium	SOC 2 CC6.1, ISO 27001 A.9.2.4
AC-SVC-007	API key usage monitored and anomalous access alerted	Medium	SOC 2 CC7.2, ISO 27001 A.12.4.1

SSH Key Management

Check ID	Control	Severity	Frameworks
AC-SSH-001	ED25519 keys required (or RSA >= 4096 bit)	High	SOC 2 CC6.7, ISO 27001 A.10.1.1
AC-SSH-002	SSH certificate-based authentication for infrastructure	Medium	SOC 2 CC6.7, ISO 27001 A.9.4.2
AC-SSH-003	SSH key passphrase required	Medium	SOC 2 CC6.1, ISO 27001 A.9.4.2
AC-SSH-004	SSH key inventory maintained with owner assignment	Medium	SOC 2 CC6.2, ISO 27001 A.9.2.5
AC-SSH-005	SSH keys rotate annually at minimum	Medium	SOC 2 CC6.1, PCI-DSS 3.6.4
AC-SSH-006	Root SSH login disabled	High	SOC 2 CC6.1, ISO 27001 A.9.4.2, PCI-DSS 2.1
AC-SSH-007	SSH password authentication disabled (key-only)	High	SOC 2 CC6.1, ISO 27001 A.9.4.2

Zero Trust Architecture

Check ID	Control	Severity	Frameworks
AC-ZT-001	Identity-based access (verify user, device, and context)	High	SOC 2 CC6.1, ISO 27001 A.9.4.2, NIST CSF PR.AC-4
AC-ZT-002	Device posture checked before granting access	High	SOC 2 CC6.1, ISO 27001 A.6.2.1
AC-ZT-003	Network location is not trusted (no implicit trust for internal network)	High	SOC 2 CC6.6, ISO 27001 A.13.1.1, NIST CSF PR.AC-5
AC-ZT-004	Continuous verification (re-authenticate for sensitive operations)	Medium	SOC 2 CC6.1, NIST CSF PR.AC-7
AC-ZT-005	Microsegmentation between services	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.2

6. Network Security

Firewall Configuration

Check ID	Control	Severity	Frameworks
NET-FW-001	Default deny policy (deny all, allow by exception)	Critical	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.2, NIST CSF PR.AC-5
NET-FW-002	Egress filtering enabled (restrict outbound traffic)	High	SOC 2 CC6.6, ISO 27001 A.13.1.1, PCI-DSS 1.3
NET-FW-003	Firewall rules reviewed quarterly	Medium	SOC 2 CC6.6, PCI-DSS 1.1.7
NET-FW-004	Firewall rule documentation (business justification for each rule)	Medium	SOC 2 CC6.6, PCI-DSS 1.1.6
NET-FW-005	No "any/any" rules in firewall ruleset	Critical	SOC 2 CC6.6, PCI-DSS 1.2
NET-FW-006	Firewall change management process documented	Medium	SOC 2 CC6.6, PCI-DSS 1.1.1

Network Segmentation

Check ID	Control	Severity	Frameworks
NET-SEG-001	Network segmentation isolates sensitive environments (production, staging, dev)	High	SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.2, HIPAA 164.312(e)(1)
NET-SEG-002	Cardholder Data Environment (CDE) segmented from general network	Critical	PCI-DSS 1.3
NET-SEG-003	Database tier isolated from public-facing tier	High	SOC 2 CC6.6, ISO 27001 A.13.1.3, PCI-DSS 1.3
NET-SEG-004	Microsegmentation for East-West traffic	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.3, NIST CSF PR.AC-5
NET-SEG-005	Management network separated from production	High	SOC 2 CC6.6, PCI-DSS 1.2
NET-SEG-006	Guest WiFi isolated from corporate network	Medium	SOC 2 CC6.6, ISO 27001 A.13.1.3

Web Application Firewall (WAF)

Check ID	Control	Severity	Frameworks
NET-WAF-001	WAF d

…(truncated)

Infrastructure Compliance Auditor

File contents

Infrastructure Compliance Auditor

Table of Contents

Trigger Phrases

Quick Start

Run Full Infrastructure Audit

Audit DNS Security for a Domain

Audit Access Controls

Generate Compliance-Mapped Report

Tools

Audit Domains

1. Cloud Infrastructure Security

AWS Security Audit Checklist

Azure Security Audit Checklist

GCP Security Audit Checklist

2. DNS Security

Email Authentication Chain

3. TLS/SSL Security

Certificate Management

Protocol and Cipher Configuration

HTTP Security Headers

Internal TLS

4. Endpoint Security

Mobile Device Management (MDM)

Disk Encryption

Antivirus and EDR

OS Patch Management

Additional Endpoint Controls

5. Access Control and Authentication

Identity Provider (IdP) Configuration

Single Sign-On (SSO)

Multi-Factor Authentication (MFA)

Privileged Access Management (PAM)

Role-Based Access Control (RBAC)

Service Account and API Key Governance

SSH Key Management

Zero Trust Architecture

6. Network Security

Firewall Configuration

Network Segmentation

Web Application Firewall (WAF)

Related skills

Frequently asked questions

How do I install the Infrastructure Compliance Auditor skill?

What does the Infrastructure Compliance Auditor skill do?

Is Infrastructure Compliance Auditor safe to use?

Which AI agents work with Infrastructure Compliance Auditor?

Is Infrastructure Compliance Auditor free to use?

Who published Infrastructure Compliance Auditor?