Define your standard
Use the standard library or create your own controls from integration data.
Evaluate the evidence
Check observed facts against each control.
Explain the outcome
Keep findings and coverage gaps distinct.
Our library to get started.
Your standards to make it yours.
Start with the standard library
Use the controls shipped with Alignr as a starting point for consistent technical alignment across your clients.
Build from your integration data
Create your own controls using the facts supplied by connected tools. Define the conditions and thresholds that matter to your service.
Shape your own standards
Bring controls together around your operating standards, with client-specific requirements and exceptions reflected in the review.
Know what’s being checked.
Explore the baseline checks across your environment. Each result depends on the connected integrations and evidence available.
18 of 18 controls
MFA required for active accounts
Every enabled directory account must have multi-factor authentication registered. An active account with no MFA is the single highest-leverage gap in an identity estate
Explore this controlPrivileged roles require MFA
Accounts holding Global Administrator must have MFA registered
Explore this controlDormant accounts are disabled
An account with no sign-in for longer than the configured window should be disabled, not left enabled and unattended
Explore this controlConditional access is enforced tenant-wide
A conditional access policy scoped to all users must actually be enabled, not left in report-only or disabled state
Explore this controlNo MFA bypass in effect
No account should carry an active MFA bypass. A bypass is sometimes granted for a genuine device-loss emergency, but one left switched on is a standing hole in the MFA policy it was meant to be a temporary exception to.
Explore this controlRMM-managed endpoints run EDR
Every endpoint visible to RMM
Explore this controlManaged endpoints check in regularly
An RMM-managed endpoint that has stopped checking in is either offline, broken, or has fallen out of management
Explore this controlManaged endpoints are patch-compliant
An RMM-managed endpoint should report a compliant patch status, not a backlog of pending updates
Explore this controlMDM-enrolled devices are encrypted
A device enrolled in mobile device management should have disk encryption enabled
Explore this controlMDM-enrolled devices are compliant
A device enrolled in mobile device management should report a compliant verdict, not noncompliant or conflict
Explore this controlServers are protected by a backup product
Every server should be covered by a named backup product
Explore this controlBackup jobs complete without error
A backup job should report ok, not warning, error or attention_required
Explore this controlBackups complete within the retention window
A protected workload's most recent successful backup should be no older than the configured window
Explore this controlNo open critical vulnerabilities
A scanned host's worst open finding should never be critical
Explore this controlOpen vulnerability count stays within limits
A scanned host's open-vulnerability count should stay under the agreed threshold
Explore this controlManaged endpoints have no missing patches
An RMM-managed endpoint should carry no outstanding missing-patch findings from the vulnerability scanner
Explore this controlEnabled accounts hold a licence
An account left enabled should hold at least one paid licence
Explore this controlLicence renewal dates are on file
A purchased licence SKU should have a known renewal date
Explore this controlNo evidence.
No assumed pass.
A missing connection or an empty result should never look like a healthy environment. Alignr records the difference.
Pass
The observed evidence meets the control.
Fail
The observed evidence does not meet the control.
No data
A supporting integration is connected and mapped, but the required facts have not arrived.
Not covered
The required evidence is not supplied by this client’s connected, mapped integrations.
Not applicable
The control is disabled or excluded for this organisation, with a recorded reason.
Bring technical alignment
into the everyday.
See how controls connect to findings, technician actions and client conversations.