Ingext

Confidential · Executive

ClientNIST Analysis · SIEM-Supported Assessments · NIST SP 800-53 Rev. 5

Acme Inc

Executive security assessment covering all 21 assessments a SIEM can support, each mapped to NIST SP 800-53 Rev. 5 controls. Evidence window: 29 Aug 2026 - 28 Sep 2026.

21 assessments

NIST SP 800-53 Rev. 5

Report date 28 September 2026

Connector: Apex MSSP Connector

Mixed evidence lineage

Readiness Score

10/21

Assessments Supported

High / Critical Findings

Evidence Gaps

47%

NIST Controls Supported

Executive Summary

Across the 21 assessments a SIEM can support, Acme's evidence fully supports 10 and partially supports 7. Detection, SOC performance and log-based compliance evidence are strong: critical feeds ran continuously for the whole window and median time to detect was 11 minutes.

Three issues matter most. Fourteen licensed users have no MFA registration, which affects identity, insurance and regulatory readiness at once. There is no vulnerability scanner integration, so vulnerability and due-diligence views are incomplete. And 6 third-party applications hold high-privilege Microsoft 365 consents that nobody has reviewed. Policy and procedure controls need client documentation; the SIEM cannot evidence them.

Assessment Readiness

Supported — evidence substantially covers the assessment Partial — evidence with gaps SIEM-limited — mainly needs documentation Not observed — not collected this run (not a failure)

Top Risks

high MFA gaps and excess privileged accounts Corroborated

14 licensed users lack MFA and Global Administrators exceed baseline by 5.

Fix: Enforce MFA via Conditional Access; reduce Global Admins to 4.

Raised by: C5 Identity & access review; B4 Cyber-insurance readiness; A1 Regulatory audit readiness

NIST: IA-2(1)AC-6

high No vulnerability scanner evidence Corroborated

Vulnerability posture relies on EDR OS data only; 31 endpoints run end-of-life OS.

Fix: Integrate the scanner feed and replace EOL systems.

Raised by: C1 Vulnerability assessment; B5 M&A / investor due diligence readiness

NIST: RA-5SI-2

high Unreviewed high-privilege third-party apps Corroborated

6 apps hold tenant-wide Microsoft 365 consents.

Fix: Review and revoke unneeded consents.

Raised by: B3 Third-party & vendor risk; C6 Cloud & SaaS security posture

NIST: SA-9AC-20

Assessment Scorecard

Evidence status shows how well SIEM evidence supports each assessment. Finding severity shows the most serious issue that evidence revealed. The two are independent: a fully supported assessment can still surface a high-severity finding.

Assessment	Evidence	Finding	NIST 800-53	Headline
A · Compliance & Regulatory
A1 Regulatory audit readiness	Supported	medium	AU-2AU-6AU-11 +2	9 of 11 AU-family controls supported by live evidence
A2 Control framework assessment	Partial	medium	ACAUIA +3	41 of 88 assessed controls supported, 27 partial, 20 not observed
A3 Attestation audit readiness	Supported	low	CA-7AU-6AU-11 +1	All critical feeds continuous for 30 of 30 days
A4 Data retention & privacy impact	Partial	low	AU-11SI-12PT-2	Routing destinations documented for 6 of 7 data flows
B · Risk & Posture
B1 Enterprise / cyber risk assessment	Supported	medium	RA-3PM-9	47 cases in the window, 5 high severity
B2 Security maturity & posture	Supported	medium	PM-6CA-7SI-4	24/7 monitoring evidenced; hygiene findings open in identity and email
B3 Third-party & vendor risk	Partial	high	SR-6SA-9AC-20	6 third-party apps hold high-privilege Microsoft 365 consents
B4 Cyber-insurance readiness	Partial	high	IA-2(1)SI-3SI-4 +1	MFA registered for 93% of licensed users (14 without)
B5 M&A / investor due diligence readiness	SIEM-limited	medium	RA-3CA-2CM-8	No confirmed breach in the window; vulnerability view incomplete
C · Technical & Operational
C1 Vulnerability assessment	Partial	high	RA-5SI-2	No vulnerability scanner integrated
C2 Pen test / red-team detection readiness	SIEM-limited	medium	CA-8SI-4	Detection rules cover 4 of 5 common pen-test tactics; exfiltration has 1 rule
C3 Detection coverage (MITRE ATT&CK)	Supported	medium	SI-4AU-6CA-7	Rules map to 11 of 14 ATT&CK tactics
C4 Log source & collection coverage	Supported	low	AU-2AU-12SI-4	7 of 7 source categories present; 0 broken feeds at report time
C5 Identity & access review	Supported	high	AC-2AC-6IA-2(1)	14 licensed users without MFA
C6 Cloud & SaaS security posture	Partial	medium	CM-6AC-3SA-9	Assessment covers Microsoft 365 only; no AWS or Azure subscription logs
C7 Insider threat assessment	Supported	low	PM-12AU-6	3 repeat actors, all administrators performing expected work
D · Incident Response & SOC
D1 Incident response readiness	Partial	medium	IR-4IR-6IR-8	Alert-to-case flow evidenced; IR plan and tabletop records not supplied
D2 SOC performance & KPIs	Supported	info	IR-4SI-4	Median MTTD 11 minutes, MTTR 3.2 hours, backlog 2
D3 Forensic & post-incident readiness	Supported	low	AU-9AU-11	Continuous history for all critical sources except one 4-hour firewall gap
D4 Threat assessment & hunting	Not observed	info	RA-10SI-5	Fingerprint cache not built for this tenant; hunting view not collected
E · Business Resilience
E1 BIA & business continuity / DR	SIEM-limited	info	CP-2RA-9CM-8	412 assets inventoried; BIA and RTO/RPO records not supplied

Assessment

Evidence

Finding

NIST 800-53

Headline

A · Compliance & Regulatory

A1 Regulatory audit readiness

Supported

medium

AU-2AU-6AU-11 +2

9 of 11 AU-family controls supported by live evidence

A2 Control framework assessment

Partial

medium

ACAUIA +3

41 of 88 assessed controls supported, 27 partial, 20 not observed

A3 Attestation audit readiness

Supported

low

CA-7AU-6AU-11 +1

All critical feeds continuous for 30 of 30 days

A4 Data retention & privacy impact

Partial

low

AU-11SI-12PT-2

Routing destinations documented for 6 of 7 data flows

B · Risk & Posture

B1 Enterprise / cyber risk assessment

Supported

medium

RA-3PM-9

47 cases in the window, 5 high severity

B2 Security maturity & posture

Supported

medium

PM-6CA-7SI-4

24/7 monitoring evidenced; hygiene findings open in identity and email

B3 Third-party & vendor risk

Partial

high

SR-6SA-9AC-20

6 third-party apps hold high-privilege Microsoft 365 consents

B4 Cyber-insurance readiness

Partial

high

IA-2(1)SI-3SI-4 +1

MFA registered for 93% of licensed users (14 without)

B5 M&A / investor due diligence readiness

SIEM-limited

medium

RA-3CA-2CM-8

No confirmed breach in the window; vulnerability view incomplete

C · Technical & Operational

C1 Vulnerability assessment

Partial

high

RA-5SI-2

No vulnerability scanner integrated

C2 Pen test / red-team detection readiness

SIEM-limited

medium

CA-8SI-4

Detection rules cover 4 of 5 common pen-test tactics; exfiltration has 1 rule

C3 Detection coverage (MITRE ATT&CK)

Supported

medium

SI-4AU-6CA-7

Rules map to 11 of 14 ATT&CK tactics

C4 Log source & collection coverage

Supported

low

AU-2AU-12SI-4

7 of 7 source categories present; 0 broken feeds at report time

C5 Identity & access review

Supported

high

AC-2AC-6IA-2(1)

14 licensed users without MFA

C6 Cloud & SaaS security posture

Partial

medium

CM-6AC-3SA-9

Assessment covers Microsoft 365 only; no AWS or Azure subscription logs

C7 Insider threat assessment

Supported

low

PM-12AU-6

3 repeat actors, all administrators performing expected work

D · Incident Response & SOC

D1 Incident response readiness

Partial

medium

IR-4IR-6IR-8

Alert-to-case flow evidenced; IR plan and tabletop records not supplied

D2 SOC performance & KPIs

Supported

info

IR-4SI-4

Median MTTD 11 minutes, MTTR 3.2 hours, backlog 2

D3 Forensic & post-incident readiness

Supported

low

AU-9AU-11

Continuous history for all critical sources except one 4-hour firewall gap

D4 Threat assessment & hunting

Not observed

info

RA-10SI-5

Fingerprint cache not built for this tenant; hunting view not collected

E · Business Resilience

E1 BIA & business continuity / DR

SIEM-limited

info

CP-2RA-9CM-8

412 assets inventoried; BIA and RTO/RPO records not supplied

NIST SP 800-53 Rev. 5 Control Family Posture

Per-family status from the live NIST SP 800-53 Rev. 5 assessment of this tenant.

AUAudit & Accountability

9 / 2 / 1

SISystem & Information Integrity

8 / 4 / 1

IRIncident Response

6 / 3 / 3

ACAccess Control

7 / 8 / 6

IAIdentification & Authentication

4 / 5 / 3

CAAssessment & Monitoring

4 / 2 / 2

CMConfiguration Management

3 / 3 / 4

SupportedPartialNot observedCounts shown as supported / partial / not observed

Evidenced Strengths

All 7 critical source categories reported continuously for the full window.
Median time to detect of 11 minutes with a case backlog of 2.

Prioritised Remediation Roadmap

0-30 days · 2

Enforce MFA for the 14 unregistered users and cut Global Admins to 4. (C5, B4)
Review and revoke the 6 high-privilege third-party app consents. (B3)

30-90 days · 2

Integrate the vulnerability scanner feed. (C1, B5)
Move DMARC from p=none to quarantine. (B4)

90+ days · 1

Onboard Azure activity logs and supply policy documents for not-observed controls. (C6, A2)

Assessment Detail

A · Compliance & Regulatory

A1Regulatory audit readiness

Supported medium

Log collection, retention and monitoring evidence for PCI DSS Req. 10 and GDPR Art. 32.

9/11

AU controls supported

365 days

Retention

9 of 11 AU-family controls supported by live evidence
Retention of 365 days meets the PCI DSS 12-month requirement

Recommendation: Supply the logging policy document to close AU-1.

NIST 800-53: AU-2AU-6AU-11AU-12CA-7 · Evidence: assess_compliance_posture · Lineage: live

A2Control framework assessment

Partial medium

Directly satisfies logging, monitoring and detection controls in NIST 800-53 and mapped frameworks.

47%

Supported

31%

Partial

22%

Not observed

41 of 88 assessed controls supported, 27 partial, 20 not observed
Policy-only controls (AC-1, IA-1, IR-1) need documentation

Recommendation: Provide policy documents for the 20 not-observed controls.

NIST 800-53: ACAUIAIRSICA · Evidence: assess_compliance_posture, get_compliance_control_evidence · Lineage: live

A3Attestation audit readiness

Supported low

Proof that controls operated continuously across the window.

99.4%

Feed continuity

All critical feeds continuous for 30 of 30 days
One firewall feed had a 4-hour gap on 12 Sep

Recommendation: Alert on any critical feed silent for more than 1 hour.

NIST 800-53: CA-7AU-6AU-11SI-4 · Evidence: evaluate_data_sources, data_flow_breakdown · Lineage: live

A4Data retention & privacy impact

Partial low

Retention settings and personal-data routing for privacy assessments.

6/7

Flows documented

Routing destinations documented for 6 of 7 data flows
Personal data in email logs has no documented minimisation rule

Recommendation: Document a minimisation rule for email-content fields.

NIST 800-53: AU-11SI-12PT-2 · Evidence: data_flow_breakdown, get_platform_ingress · Lineage: live

B · Risk & Posture

B1Enterprise / cyber risk assessment

Supported medium

Real incident history grounds risk likelihood and impact.

Cases

High

47 cases in the window, 5 high severity
Credential phishing is the most frequent pattern (19 cases)

Recommendation: Feed the case history into the next annual risk assessment.

NIST 800-53: RA-3PM-9 · Evidence: summarize_cases, summarize_case_fingerprints · Lineage: live

B2Security maturity & posture

Supported medium

Detection and monitoring capability drive maturity scoring.

Hygiene findings

24/7 monitoring evidenced; hygiene findings open in identity and email

Recommendation: Close identity hygiene items to lift the maturity profile.

NIST 800-53: PM-6CA-7SI-4 · Evidence: summarize_hygiene_posture, summarize_monitoring_operations · Lineage: live

B3Third-party & vendor risk

Partial high

Visibility of third-party app access and external risk ratings.

High-priv apps

6 third-party apps hold high-privilege Microsoft 365 consents
No external risk-rating feed configured

Recommendation: Review and revoke unneeded high-privilege app consents.

NIST 800-53: SR-6SA-9AC-20 · Evidence: review_office365_applications · Lineage: live

B4Cyber-insurance readiness

Partial high

Evidence for standard underwriting questions.

93%

MFA

88%

EDR

p=none

DMARC

Yes

24/7 SOC

MFA registered for 93% of licensed users (14 without)
EDR on 88% of known endpoints
DMARC policy is p=none

Recommendation: Enforce MFA for all users and move DMARC to quarantine.

NIST 800-53: IA-2(1)SI-3SI-4SI-8 · Evidence: audit_office365_users, review_falcon_footprint, review_email_configuration · Lineage: live

B5M&A / investor due diligence readiness

SIEM-limited medium

Breach history, coverage breadth and integration effort for a buyer.

No confirmed breach in the window; vulnerability view incomplete

Recommendation: Add scanner data before any transaction review.

NIST 800-53: RA-3CA-2CM-8 · Evidence: synthesis of B1, C1, C4, D2 · Lineage: live

C · Technical & Operational

C1Vulnerability assessment

Partial high

Correlates scanner output with live activity; OS currency from EDR.

EOL endpoints

None

Scanner

No vulnerability scanner integrated
31 endpoints run an end-of-life operating system

Recommendation: Integrate the vulnerability scanner feed.

NIST 800-53: RA-5SI-2 · Evidence: summarize_vulnerability_posture, review_falcon_footprint · Lineage: live

C2Pen test / red-team detection readiness

SIEM-limited medium

Shows whether attacker techniques would be detected; the test itself is out of SIEM scope.

4/5

Tactics covered

Detection rules cover 4 of 5 common pen-test tactics; exfiltration has 1 rule

Recommendation: Add exfiltration detections before the next pen test.

NIST 800-53: CA-8SI-4 · Evidence: summarize_signature_attack_coverage · Lineage: live

C3Detection coverage (MITRE ATT&CK)

Supported medium

Maps active rules to MITRE ATT&CK techniques.

11/14

Tactics

Noisy rules

Rules map to 11 of 14 ATT&CK tactics
9 signatures noisy, 4 stale

Recommendation: Tune the 9 noisy rules.

NIST 800-53: SI-4AU-6CA-7 · Evidence: summarize_signature_attack_coverage, signature_quality_scorecard · Lineage: live

C4Log source & collection coverage

Supported low

Whether every critical system reports and feeds are healthy.

Sources

Broken

7 of 7 source categories present; 0 broken feeds at report time

Recommendation: Keep feed-health alerting on.

NIST 800-53: AU-2AU-12SI-4 · Evidence: summarize_collection_coverage, evaluate_data_sources · Lineage: live

C5Identity & access review

Supported high

MFA status, privileged roles and dormant accounts.

No MFA

Global Admins

Dormant

14 licensed users without MFA
9 Global Administrators against a baseline of 4
22 accounts inactive for 90+ days

Recommendation: Reduce Global Admins to 4 and disable dormant accounts.

NIST 800-53: AC-2AC-6IA-2(1) · Evidence: audit_office365_users, count_licensed_users · Lineage: live

C6Cloud & SaaS security posture

Partial medium

Cloud audit logs and application registrations.

M365 only

Cloud sources

Assessment covers Microsoft 365 only; no AWS or Azure subscription logs

Recommendation: Onboard Azure activity logs.

NIST 800-53: CM-6AC-3SA-9 · Evidence: review_office365_applications, discover_tenant_resources · Lineage: live

C7Insider threat assessment

Supported low

UEBA baselines and repeat actors.

Repeat actors

3 repeat actors, all administrators performing expected work

Recommendation: Keep admin accounts on the watch list.

NIST 800-53: PM-12AU-6 · Evidence: categorize_repeat_actors, summarize_behavior_timeline · Lineage: live

D · Incident Response & SOC

D1Incident response readiness

Partial medium

What responders can see and how fast alerts reach them.

Alert-to-case flow evidenced; IR plan and tabletop records not supplied

Recommendation: Supply the IR plan and schedule a tabletop.

NIST 800-53: IR-4IR-6IR-8 · Evidence: summarize_monitoring_operations · Lineage: live

D2SOC performance & KPIs

Supported info

MTTD, MTTR, backlog and false-positive rate.

11 min

MTTD

3.2 h

MTTR

Backlog

Median MTTD 11 minutes, MTTR 3.2 hours, backlog 2

Recommendation: Hold current KPIs as the SLA baseline.

NIST 800-53: IR-4SI-4 · Evidence: summarize_case_metrics · Lineage: live

D3Forensic & post-incident readiness

Supported low

Retention depth and ability to rebuild a timeline.

Continuous history for all critical sources except one 4-hour firewall gap

Recommendation: See A3 feed-alerting recommendation.

NIST 800-53: AU-9AU-11 · Evidence: data_flow_breakdown, evaluate_data_sources · Lineage: live

D4Threat assessment & hunting

Not observed info

Threat intel and behaviour correlation.

Fingerprint cache not built for this tenant; hunting view not collected

Recommendation: Run refresh_case_fingerprints, then re-run.

NIST 800-53: RA-10SI-5 · Evidence: none collected · Lineage: local_cache

E · Business Resilience

E1BIA & business continuity / DR

SIEM-limited info

Critical-asset exposure; BIA and DR need documentation.

412

Assets

412 assets inventoried; BIA and RTO/RPO records not supplied

Recommendation: Share the BIA so critical assets can be tagged.

NIST 800-53: CP-2RA-9CM-8 · Evidence: summarize_asset_inventory · Lineage: live

Recommended Actions

Every action from the roadmap, ranked by priority and leverage. An action that improves several assessments at once ranks above a narrower one in the same time horizon.

#	Action & expected outcome	Horizon	Owner	Assessments improved	NIST 800-53
1	Enforce MFA for the 14 unregistered users and cut Global Admins to 4. Closes the top corroborated risk; lifts identity, insurance and regulatory readiness.	0-30 days	Client IT - Identity team	C5 Identity & access review; B4 Cyber-insurance readiness	IA-2(1)AC-6AC-2(3)
2	Review and revoke the 6 high-privilege third-party app consents. Removes tenant-wide access held by unreviewed vendors.	0-30 days	Client IT - M365 admin	B3 Third-party & vendor risk	SA-9AC-20
3	Integrate the vulnerability scanner feed. Moves vulnerability assessment from partial to supported.	30-90 days	Ingext onboarding + client security	C1 Vulnerability assessment; B5 M&A / investor due diligence readiness	RA-5SI-2
4	Move DMARC from p=none to quarantine. Blocks spoofed mail and improves the insurance email-security answer.	30-90 days	Client IT - Messaging	B4 Cyber-insurance readiness	SI-8
5	Onboard Azure activity logs and supply policy documents for not-observed controls. Extends cloud coverage beyond M365 and resolves policy-only gaps.	90+ days	Ingext onboarding + client GRC	C6 Cloud & SaaS security posture; A2 Control framework assessment	CM-6AU-2AC-1

Action & expected outcome

Horizon

Owner

Assessments improved

NIST 800-53

Enforce MFA for the 14 unregistered users and cut Global Admins to 4.

Closes the top corroborated risk; lifts identity, insurance and regulatory readiness.

0-30 days

Client IT - Identity team

C5 Identity & access review; B4 Cyber-insurance readiness

IA-2(1)AC-6AC-2(3)

Review and revoke the 6 high-privilege third-party app consents.

Removes tenant-wide access held by unreviewed vendors.

0-30 days

Client IT - M365 admin

B3 Third-party & vendor risk

SA-9AC-20

Integrate the vulnerability scanner feed.

Moves vulnerability assessment from partial to supported.

30-90 days

Ingext onboarding + client security

C1 Vulnerability assessment; B5 M&A / investor due diligence readiness

RA-5SI-2

Move DMARC from p=none to quarantine.

Blocks spoofed mail and improves the insurance email-security answer.

30-90 days

Client IT - Messaging

B4 Cyber-insurance readiness

SI-8

Onboard Azure activity logs and supply policy documents for not-observed controls.

Extends cloud coverage beyond M365 and resolves policy-only gaps.

90+ days

Ingext onboarding + client GRC

C6 Cloud & SaaS security posture; A2 Control framework assessment

CM-6AU-2AC-1

Methodology & Accuracy Notes

Scope. One tenant (Acme Inc), evidence window 29 Aug 2026 - 28 Sep 2026, compliance period 2026-08. All 21 SIEM-supported assessments were evaluated; none were omitted.

Rating. Evidence status (Supported, Partial, SIEM-limited, Not observed) measures how well SIEM evidence supports each assessment. Finding severity measures the most serious issue that evidence revealed. The readiness score weights Supported as 1, Partial and SIEM-limited as 0.5, and Not observed as 0, averaged over all 21 assessments. Not observed means evidence was not collected in this run; it is not a failed control.

Privacy. Individual users, mailboxes, hosts and case identifiers were reduced to counts before reporting.

Tools used. assess_compliance_posture, evaluate_data_sources, audit_office365_users, summarize_case_metrics

Collection notes.

summarize_case_fingerprints returned no cache for this tenant.

Limitations.

Policy and procedure controls require client documentation.
Sanitized sample — company and identity details are fictional.

Non-live evidence. D4 (local_cache)

Ingext

FLUENCY · POWERED BY INGEXT · ClientNIST Analysis

Prepared for Acme Inc by Ingext - Managed SOC on 28 September 2026. Confidential — intended for the client's executive and security leadership.
This report states what SIEM evidence collected by the Ingext platform supports. It is not a certification, attestation or audit opinion, and NIST mappings are evidence mappings rather than determinations of conformance. Controls marked Not Observed were not evidenced during this run and should not be read as failed.