Control 3.7: PPAC Security Posture Assessment — Verification & Testing

Verification procedures and test cases for Control 3.7. Audience: M365 administrators producing audit evidence for FINRA / SEC / SOX / GLBA / OCC examinations.

Verification Strategy

Verification for Control 3.7 has three layers. Auditors typically expect evidence at all three:

Layer	What it proves	Frequency
Layer 1 — Tooling enabled	The Security area and Actions page are accessible and populated; tenant-level analytics is on	Once per quarter
Layer 2 — Recommendations addressed	High-severity recommendations are remediated, snoozed with reason, or dismissed with documented justification	Per zone cadence
Layer 3 — Configuration hardening	Settings invisible to PPAC recommendations (Privacy + Security per-environment, agent settings) are reviewed and not drifted	Per zone cadence

Layer 1 — Tooling Verification

V1-01 — Tenant-level analytics enabled

Sign in to PPAC as Power Platform Admin.
Navigate to Security > Overview.
Pass: Security score displays a percentage and qualitative label.
Fail (deferrable): Page shows "Calculating security score" — confirm tenant-level analytics is enabled and re-test in 24 hours.
Fail (action required): Page shows an error or empty state after 24 hours — see Troubleshooting.
Evidence: Screenshot showing score, label, and timestamp.

In PPAC, expand Security.
Verify all four pages are visible and load: Overview, Data protection and privacy, Identity and access management, Compliance.
Pass: All four pages load without permission errors.
Evidence: Screenshot of the expanded navigation.

V1-03 — Actions page accessible

Navigate to Actions (formerly Power Platform Advisor).
Verify Recommendations, Snoozed recommendations, Dismissed recommendations, and Action history tabs are present.
Pass: All tabs render; Recommendations tab shows at least one item or a documented "no recommendations" state.
Evidence: Screenshot of the Actions page.

Layer 2 — Recommendation Remediation Verification

V2-01 — High-severity recommendations within SLA

Open Actions > Recommendations, filter Severity = High.
For each item record: title, severity, refresh frequency, first-seen date, current status.
Compare first-seen dates against zone-aligned SLA:
- Zone 3: ≤ 7 days to remediation, snooze, or documented dismissal
- Zone 2: ≤ 14 days
- Zone 1: ≤ 30 days
Pass: All High-severity items either Completed, currently being remediated within SLA, snoozed with reason, or dismissed with justification.
Evidence: Export of recommendations list (CSV or screenshot) plus the dismissed/snoozed log.

V2-02 — Dismissed recommendations have documented justification

Open Actions > Dismissed recommendations.
For each dismissed item confirm an entry in the Dismissed recommendations log containing:
- Recommendation title and severity
- Business justification (compensating control or non-applicability rationale)
- Approver (named individual; FINRA 3110 expects supervisory sign-off)
- Review-by date (recommend ≤ 12 months)
Pass: 100% of dismissed items have a complete log entry.
Fail: Any dismissed item missing justification or approver — re-activate the recommendation or complete the log entry.
Evidence: Dismissed recommendations log (Excel/CSV or governance system export).

V2-03 — Snoozed recommendations are within snooze window

Open Actions > Snoozed recommendations.
For each snoozed item verify the snooze expiry date is in the future and ≤ 60 days from snooze creation (Microsoft caps snooze at two months).
Confirm an entry in the Snoozed recommendations log with reason and unsnooze plan.
Pass: All snoozed items within window with logged reason.
Evidence: Snoozed log plus screenshot.

V2-04 — Action history aligns with remediation tickets

Open Actions > Action history.
For a sample of 5 completed items in the last 30 days, confirm a corresponding change ticket (CAB) or governance system entry exists.
Pass: 100% of sampled items traceable to a ticket.
Evidence: Sample mapping (action history entry → ticket ID).

Layer 3 — Configuration Hardening Verification

V3-01 — Hardening baseline review cadence

Locate the most recent hardening baseline review record (see Configuration Hardening Baseline).
Verify the review was completed within the required cadence:
- Zone 1: monthly
- Zone 2: bi-weekly
- Zone 3: weekly
Pass: Most recent review date falls within the cadence window for each in-scope zone.
Evidence: Review log showing reviewer name, date, zone coverage, and SHA-256 hash of evidence package.

V3-02 — Configuration drift remediation

Review the most recent hardening baseline assessment output.
Identify items flagged as drifted from expected values.
Confirm each drift item is either remediated or has a documented accepted-risk exception with approver and review-by date.
Pass: No unresolved drift items.
Evidence: Drift report showing all items in compliant or accepted-risk state.

V3-03 — Evidence archival integrity

Locate the evidence archive for the most recent review cycle.
Verify each archived file has a SHA-256 hash recorded in manifest.json (emitted by PowerShell setup Write-FsiEvidence).
Confirm storage is WORM-protected (Purview retention lock or Azure Storage immutability policy) per SEC 17a-4(f) and FINRA 4511.
Pass: Manifest present, all hashes verifiable, storage immutability enabled.
Evidence: manifest.json plus storage configuration screenshot.

V3-04 — Blocked attachment extensions

Navigate to PPAC > Environments > [Environment] > Settings > Privacy + Security.
Locate Blocked Attachments.
Verify the extension list includes at minimum: ade;adp;app;asa;asp;bat;cdx;cmd;com;cpl;crt;csh;dll;exe;hta;inf;ins;jar;js;jse;lnk;mda;mdb;mde;msc;msi;msp;mst;pcd;pif;reg;scr;sct;shb;shs;tmp;url;vb;vbe;vbs;ws;wsc;wsf;wsh.
Pass criterion: List present and includes the critical file types listed above.
Evidence: Screenshot of the blocked attachments configuration. Repeat per environment.

V3-05 — Blocked MIME types

Same path as V3-04, locate Blocked MIME Types.
Verify list includes at minimum: application/javascript, application/x-javascript, text/javascript, application/hta, application/msaccess, text/scriplet, application/xml, application/prg.
Pass criterion: List present and includes the high-risk types above.
Evidence: Screenshot per environment.

V3-06 — Inactivity timeout

Same path, locate Inactivity Timeout.
Verify enabled with duration ≤ 120 minutes (Zone 3: ≤ 60 minutes).
Pass criterion: Enabled and within zone limit.
Evidence: Screenshot per environment.

V3-07 — Session expiration

Same path, locate Session Expiration.
Verify "Set custom session timeout" enabled with maximum session length ≤ 1440 minutes (Zone 3: ≤ 720 minutes).
Pass criterion: Enabled and within zone limit.
Evidence: Screenshot per environment.

V3-08 — Content Security Policy enforcement

Same path, locate Content security policy under Model Driven.
Verify "Enforce content security policy" is enabled.
Pass criterion: Enabled.
Evidence: Screenshot per environment.

Compliance Checklist (Quick Reference)

Item	Required for	Status
Tenant-level analytics enabled	All zones
Security score visible (not "Calculating")	All zones
Per-zone hardening review cadence met	All zones
All High-severity recommendations within SLA	All zones
Dismissed recommendations have documented justification	FINRA 3110, SOX 404
Snoozed recommendations within window with reason	Governance hygiene
Action history traceable to change tickets	SOX 404, OCC 2023-17
Managed Environments enabled (in-scope)	Zone 2/3
DLP policies applied to in-scope environments	GLBA 501(b), FINRA 4511
Privacy + Security per-environment hardening verified	All zones
Evidence package SHA-256 hashed and WORM-stored	SEC 17a-4(f), FINRA 4511

Test Cases (End-to-End)

TC-3.7-01 — Score recalculates after remediation

Objective: Confirm score reflects configuration changes.

Steps:

Note current score and an open Medium/High recommendation.
Implement the recommendation in a test environment via the inline action or settings page.
Wait up to 24 hours.
Reopen Security > Overview.

Expected result: Score increases or label improves and the recommendation moves to Completed in Action history.

Evidence: Before/after screenshots, action history entry.

TC-3.7-02 — Sovereign cloud collector returns environments

Objective: Confirm the PowerShell collector is using the correct sovereign endpoint.

Steps (GCC / GCC High / DoD only):

Run the orchestrator with -Endpoint prod deliberately wrong.
Confirm it returns zero environments (false-clean baseline).
Re-run with the correct sovereign -Endpoint value.
Confirm it returns the expected environment count.

Expected result: Endpoint mismatch produces empty results; correct endpoint returns full inventory.

Evidence: Both transcripts, both environment-posture JSON files.

TC-3.7-03 — Dismissed recommendation re-surfaces if condition recurs

Objective: Confirm dismiss is not a permanent suppression.