Maturity Report

Assessment 2026 v0.9 - 05/02/2026

Export PDF

2.76

Overall Score (0-5)

25

Assessed Controls

20

Identified Gaps

1

Critical Gaps

Maturity by Domain
Compliance by Framework
Compliance = Level ≥ 3
Maturity Distribution
Maturity Gaps (Current Level < 4)
Control Domain Current Target Gap Priority
AUTH-003
Configure Smart Lockout: block the threat actor (I... 		Authentication 1 4 3 levels Critical
AUTH-002
Enforce MFA for all users with Number Matching to ... 		Authentication 2 4 2 levels High
AUTH-004
Real-time checking of banned passwords against glo... 		Authentication 2 4 2 levels High
AUTH-006
Enforce re-authentication for critical actions (e.... 		Authentication 2 4 2 levels High
JML-002
Review trigger on transfers: a change of role in H... 		Identity Lifecycle (JML) 2 4 2 levels High
JML-004
Quarterly Access Certification campaigns with auto... 		Identity Lifecycle (JML) 2 4 2 levels High
JML-005
Detection of orphan accounts (Reconciliation): Com... 		Identity Lifecycle (JML) 2 4 2 levels High
PAM-002
Separate accounts: adm-user (no email/web) for man... 		Privileged Access (PAM) 2 4 2 levels High
MON-001
Centralize Audit/Sign-in Logs in a SIEM. Retention... 		Monitoring (MON) 2 4 2 levels High
MON-002
Automatic blocking based on Risk (User/Sign-in Ris... 		Monitoring (MON) 2 4 2 levels High
MON-003
Alert on unverified illicit or high-privilege OAut... 		Monitoring (MON) 2 4 2 levels High
MON-005
Monitor anomalies in Service Principals (read volu... 		Monitoring (MON) 2 4 2 levels High
AUTH-007
Disable legacy protocols (Basic Auth: POP3, IMAP, ... 		Authentication 3 4 1 levels Medium
JML-001
Automate 'Birthright' provisioning via HR, creatin... 		Identity Lifecycle (JML) 3 4 1 levels Medium
JML-003
Automate exit 'Kill Switch': Blocking and revocati... 		Identity Lifecycle (JML) 3 4 1 levels Medium
PAM-004
Implement a Tiered Model (Tiering/Red Forest): Tie... 		Privileged Access (PAM) 3 4 1 levels Medium
PAM-005
2 monitored Emergency (Break Glass) accounts, clou... 		Privileged Access (PAM) 3 4 1 levels Medium
MON-004
P1 alerts for changes to Tier 0 groups (Global/Dom... 		Monitoring (MON) 3 4 1 levels Medium
MON-006
User feedback ('Not me') in MFA generates an immed... 		Monitoring (MON) 3 4 1 levels Medium
PAM-006
Require dedicated Privileged Access Workstations (... 		Privileged Access (PAM) 3 4 1 levels Medium
Recommendations Roadmap
AUTH-003 Critical

Configure Smart Lockout: block the threat actor (IP), not the user account (AD),...

1 2

Action: Política de bloqueio definida, desbloqueio manual.

AUTH-002 High

Enforce MFA for all users with Number Matching to mitigate MFA fatigue....

2 3

Action: 100% cobertura (App/Push).

AUTH-004 High

Real-time checking of banned passwords against global (pwned) lists and company ...

2 3

Action: Lista de senhas banidas personalizada.

AUTH-006 High

Enforce re-authentication for critical actions (e.g., viewing sensitive data) re...

2 3

Action: Re-autenticação para algumas ações críticas.

JML-002 High

Review trigger on transfers: a change of role in HR initiates access recertifica...

2 3

Action: Revisão manual obrigatória via Ticket.

JML-004 High

Quarterly Access Certification campaigns with automatic revocation if there is n...

2 3

Action: Anual (Todos) via Planilha Excel.

JML-005 High

Detection of orphan accounts (Reconciliation): Compare AD vs HR weekly to find o...

2 3

Action: Comparação manual mensal (Vlookup).

PAM-002 High

Separate accounts: adm-user (no email/web) for management and user for daily use...

2 3

Action: Contas separadas, acessadas do mesmo PC.

MON-001 High

Centralize Audit/Sign-in Logs in a SIEM. Retention: 90 days (hot) / 365 days (co...

2 3

Action: Backup manual esporádico para Storage.

MON-002 High

Automatic blocking based on Risk (User/Sign-in Risk) for high-risk events....

2 3

Action: Alerta por e-mail (Investigação humana).

MON-003 High

Alert on unverified illicit or high-privilege OAuth app consents....

2 3

Action: Aprovação manual pelo Admin (Workflow).

MON-005 High

Monitor anomalies in Service Principals (read volume, new IPs, atypical hours)....

2 3

Action: Baseline manual de comportamento.