Control Reference
Complete catalog of all 55 DSC (Desired State Configuration) controls available in TrueConfig. Controls are organized by baseline level and category, with mappings to industry compliance frameworks.
Compliance Framework Alignment
TrueConfig controls are mapped to industry-standard security frameworks to help you meet compliance requirements:
CISCIS Benchmarks
CIS Microsoft 365 Foundations Benchmark and CIS Microsoft Entra ID Benchmark controls.
View benchmarkNISTNIST 800-53
NIST Special Publication 800-53 security and privacy controls for federal information systems.
View publicationISOISO 27001
ISO/IEC 27001 information security management controls (Annex A) for select high-impact controls.
View standard26
Level 1 Controls
Recommended Secure
19
Level 2 Controls
Enhanced Security
10
Level 3 Controls
Maximum Security
Control Categories
Controls are organized into the following categories based on their security domain:
Identity & Authentication
User authentication and identity protection controls
Privileged Access
Administrative role and privilege management
Conditional Access
Access policies and conditional requirements
Workload Identity & Applications
Application registrations and service principals
Guest & External Access
Guest users and external collaboration
Governance & Hygiene
Account lifecycle and hygiene practices
Logging & Visibility
Audit logs and monitoring capabilities
Data Protection
Data loss prevention and information protection
License Management
License utilization and cost optimization
Level 1: Recommended Secure (26 controls)
Foundational security controls that every organization should implement. These controls establish basic security hygiene and prevent common attack vectors.
Identity & Authentication
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| ID-01 | User MFA Registration | critical | CIS 6.1.1CIS 6.1.2IA-2IA-2(1) | None |
| ID-02 | Block Legacy Authentication | high | CIS 6.1.3IA-2(6)AC-17(2) | None |
| ID-03 | Enable Self-Service Password Reset | medium | CIS 5.1.2IA-5(1)IA-6 | None |
| ID-05 | Configure Smart Lockout Protection | high | CIS 5.2.1CIS 5.2.2AC-7IA-5(1) | None |
Privileged Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| PA-01 | Limit Global Administrators to 2-4 | critical | CIS 5.1.1CIS 5.1.2AC-6(5)AC-2(7) | None |
| PA-02 | Use Dedicated Admin Accounts | high | CIS 5.1.3AC-6(2)AC-5 | None |
| PA-03 | Configure Emergency Access Accounts | critical | CIS 5.1.4AC-2(2)CP-2 | None |
Conditional Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| CA-01 | Require MFA via Conditional Access Policy | critical | CIS 6.1.1IA-2(1)IA-2(2) | P1 |
| CA-02 | Require MFA for All Administrators | critical | CIS 6.1.2AC-6(5)IA-2(1) | P1 |
| CA-08 | Block Access from High-Risk Countries | medium | CIS 6.1.6AC-4SC-7 | P1 |
| CA-11 | Enforce Session Lifetime Limits for Guests and Admins | medium | CIS 6.2.4AC-12SC-10 | P1 |
Workload Identity & Applications
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| APP-01 | Application Ownership for Apps with Credentials | low | CIS 7.1.1CM-8PM-5 | None |
| APP-02 | Enforce Application Credential Expiration | critical | CIS 7.1.2IA-5(1)SC-12 | None |
| APP-05 | Service Principal Credential Hygiene | critical | CIS 7.1.3IA-5(1)SC-12 | None |
| APP-08 | Restrict User Application Consent | high | CIS 7.2.4AC-6(10)CM-5 | None |
| APP-09 | Enforce Certificate Credentials for Applications | medium | - | None |
Guest & External Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| EXT-01 | Restrict Guest Invitation Permissions | high | CIS 8.1.1AC-4AC-17 | None |
| EXT-02 | Require MFA for Guest Users | medium | CIS 8.1.2IA-2(1)AC-17 | None |
| EXT-06 | External Sharing Visibility | medium | CIS 8.2.2AU-12AC-4 | None |
| EXT-07 | Detect External Mail Forwarding | critical | CIS 8.2.3AU-12SI-4 | None |
Governance & Hygiene
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| GOV-01 | Review Stale User Accounts | medium | CIS 5.3.1AC-2(3)PS-4 | None |
| GOV-05 | Maintain Group Naming Conventions | low | CIS 5.3.5CM-2CM-8 | None |
| GOV-07 | Audit Privileged Role Assignments | high | CIS 5.3.6AC-2AU-6 | None |
Logging & Visibility
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| LOG-01 | Enable Unified Audit Logging | high | CIS 9.1.1AU-2AU-3 | None |
| LOG-04 | Configure Privileged Operation Alerts | critical | CIS 9.1.3AU-5IR-5 | None |
License Management
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| LIC-01 | License Utilization Visibility | low | CIS 5.4.1CM-8CM-10 | None |
Baseline Evaluation
When you select Level 1 baseline, only these 26 controls are evaluated. Higher baseline levels include these controls plus additional controls.
Level 2: Enhanced Security (+19 controls)
Advanced security controls for organizations with higher security requirements. Includes all Level 1 controls plus:
Privileged Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| PA-01-L2 | Eliminate Permanent Global Administrators | critical | CIS 5.1.1CIS 5.1.2AC-6(5)AC-2(7) | P2 |
| PA-04 | Require PIM for All Privileged Roles | critical | CIS 5.2.2.1CIS 5.2.2.2AC-2(5)AC-6(7) | P2 |
| PA-05 | Require Phishing-Resistant MFA for Admins | critical | CIS 6.1.4IA-2(6)IA-2(8) | P1 |
Conditional Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| DV-01 | Require Compliant Devices for Admin Access | high | CIS 6.3.1CM-8AC-19 | P1 |
| CA-03 | Block or Require MFA for Risky Sign-Ins | high | CIS 6.2.1IA-5(13)SI-4 | P2 |
| CA-04 | Remediate High-Risk Users Automatically | high | CIS 6.2.2IA-5(13)IR-6 | P2 |
| CA-10 | Enable Token Protection | high | CIS 6.2.3SC-23SC-23(1) | P1 |
| DV-02 | Require Compliant Devices for Global Admins | critical | CIS 6.3.2CM-8AC-19 | P1 |
Workload Identity & Applications
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| APP-03 | Internal App Registration Permissions | high | CIS 7.2.1AC-6CM-7 | None |
| APP-04 | Enable Admin Consent Workflow | medium | CIS 7.2.2AC-6(10)CM-5 | None |
| APP-06 | Third-Party Enterprise App Permissions | high | CIS 7.2.3SA-9SA-12 | None |
| APP-07 | Identify Unused Service Principals | medium | CIS 7.1.4CM-8SI-4 | P2 |
Governance & Hygiene
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| GOV-02 | Automatically Disable Stale Accounts | medium | CIS 5.3.2AC-2(3)AC-2(4) | P2 |
| GOV-03 | Conduct Quarterly Privileged Access Reviews | high | CIS 5.3.3AC-2(4)AC-6(7) | P2 |
Logging & Visibility
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| LOG-02 | Export Logs to Long-Term Storage | medium | CIS 9.1.2AU-4AU-11 | P1 |
| LOG-05 | Admin Activity Anomaly Detection | high | CIS 9.2.2AU-6SI-4(5) | P2 |
Guest & External Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| EXT-04 | Configure Guest Access Expiration | medium | CIS 8.1.3AC-2(3)AC-17 | P2 |
| EXT-08 | Audit Mailbox Delegation | medium | CIS 8.2.4AU-12AC-3 | None |
Data Protection
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| DLP-01 | Enable Sensitive Data Classification | high | CIS 10.1.1SC-8SC-13 | E5_COMPLIANCE |
Level 3: Maximum Security (+10 controls)
Zero-trust security controls for highly regulated industries. Includes all Level 1 and Level 2 controls plus:
Identity & Authentication
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| ID-04 | Require Phishing-Resistant MFA for All Users | critical | CIS 6.1.4IA-2(6)IA-2(8) | P1 |
Privileged Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| PA-06 | Require FIDO2 Security Keys for Administrators | critical | CIS 6.1.5IA-2(12)IA-5(2) | P2 |
| PA-07 | Enable Continuous Access Evaluation | critical | CIS 5.2.2.3AC-2(12)SC-10 | P1 |
Conditional Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| CA-05 | Require App Protection for Mobile Access | high | CIS 6.3.1AC-19CM-7 | P1 |
| CA-09 | Zero Trust Network Access | critical | CIS 6.3.2AC-4SC-7 | P2 |
| CA-06 | Restrict Admin Access to Privileged Access Workstations | high | CIS 5.1.6SC-7SC-7(4) | P2 |
Guest & External Access
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| EXT-03 | Restrict Guest Access to Allowlisted Domains | high | CIS 8.2.1AC-4AC-17(1) | P1 |
Governance & Hygiene
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| GOV-04 | Automate Threat Response with SOAR | high | CIS 5.3.4IR-4IR-6 | P2 |
Logging & Visibility
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| LOG-03 | Stream All Security Events to SIEM in Real-Time | high | CIS 9.2.1AU-6SI-4 | P2 |
Data Protection
| ID | Title | Severity | Frameworks | License |
|---|---|---|---|---|
| DLP-02 | Block Bulk Data Exfiltration | critical | CIS 10.1.2SC-7SI-4 | E5_COMPLIANCE |
License Requirements
Level 2 and Level 3 controls may require specific Microsoft licenses (Entra ID P1/P2, Microsoft Intune). Verify your organization has the required licenses before enabling these controls.
Control Evaluation
Controls are evaluated during each tenant sync. The DSC evaluation engine:
- Fetches current configuration from Microsoft Graph API
- Compares against desired state defined in control
- Records deviations with detailed context
- Triggers remediation workflows if auto-remediation is enabled
Best Practice
Start with Level 1 baseline for new implementations. Monitor for 2-4 weeks, review deviations, then progressively adopt Level 2 and Level 3 controls as your security maturity increases.