IT-04:NET-08

§5 Remote access to production requires MFA; no shared or hardcoded credentials

Status

No evidence

Policy cadence

Quarterly

Last evidence

—

Next due

—

Owner

Operations Manager & CTO

TSC

CC6.1

Evidence folder

02_Access_Reviews

Automatable

No — human judgement

Policy

IT-04

Policy version

v2.0 (2026-03-26) — control IDs assigned by ComplianceHub; no control report exists

Not automatable. DeftTrust schedules this control, prepares the pack and files the record it produces — it does not perform the judgement. The calendar still tracks it, so it cannot silently lapse.

Collectors

Collector	Relationship	Samples	What it observes
probes.ssh_posture	supports	monthly	Proves remote production access is SSH-2 only, with no unencrypted alternative

Supporting evidence only. The collectors above produce material relevant to this control without discharging it, so the control stays overdue. Related evidence must never make a control read as current — the gap would then be invisible.

Evidence satisfying this control

Collected	Collector	Result	Source	Digest
No artifact satisfies this control.

Evidenced by a person. CTO owes this. The scheduler opens a request 14 days before it comes due; none is open right now.

Definition history

Changed	Field	From	To	Source
2026-09-10 03:32	__created__	—	quarterly	sync_controls

A cadence change re-judges this control's existing evidence against the new interval, so its status can move the moment the change lands. That is why the change is recorded rather than just applied.