Posture, spend & inventory
Executive posture summary
As of 2026-08-16
Prepared by Achieve
Industry avg 74 · Logistics / fuel · +2 vs sector
Trading platform is reliable, but public storage exposure and legacy on-prem hosts are dragging the security grade down — prioritize those.
Why this grade: 3 critical and 2 high findings are the main drag — clearing the criticals lifts the grade fastest.
Compliance readiness
Fix first — highest-exposure findings
AZURE · aegsettlementdocs · Internet-exposed · Sensitive data · Open 65d
AWS · i-0aegsettlementec201 · Active threat
AZURE · aeg-trade-vmss · Open 99d
AWS · aeg-settlement-ec2-01 · Unencrypted · Open 78d
AWS · settlement-processor · Open 74d
Trading platform is reliable, but public storage exposure and legacy on-prem hosts are dragging the security grade down — prioritize those.
| Domain | Grade | Score | Status | Trend | Summary |
|---|---|---|---|---|---|
| Security | C | 68 | warn | up | 3 critical findings incl. public blob & GCS exposure. |
| Resilience | C+ | 74 | warn | flat | Trading VMSS pinned to 1 instance; some VMs unbacked. |
| Identity | B- | 80 | good | up | 88% MFA; 24 privileged and 31 stale accounts to review. |
| Compliance | B- | 79 | good | up | SOC 2 certified; PCI DSS 64% for fuel-card payments. |
| Endpoints | B- | 78 | warn | flat | Intune + CrowdStrike; a stale Win10 host and EDR gaps. |
| Cloud cost | B- | 77 | good | down | Azure is the largest spend; trending under last month. |
Work mirrored from the customer's Jira board, plus open finding load.
| Key | Type | Summary | Priority | Status | Assignee | Due |
|---|---|---|---|---|---|---|
| REM-88 | Bug | Security group `sg-web` allows 0.0.0.0/0 on 22 | Critical | To Do | Unassigned | ⚠ Jul 29, 2026 |
| REM-84 | Task | 3 macOS endpoints behind on OS (Jamf) — push update | Medium | In Progress | Dana White | ⚠ Aug 1, 2026 |
| REM-79 | Task | Rotate long-lived AWS access key for `ci-deploy` | High | Done | Dana White | — |
All declared capabilities connected.
| Framework | Status | Readiness | Controls | Next milestone |
|---|---|---|---|---|
| SOC 2 Type II | certified | 100% | 91/91 | Annual renewal Mar 2027 |
| PCI DSS | in-progress | 64% | 162/254 | Target QSA assessment Q1 2027 |
| ISO 27001 | gap | 41% | 47/114 | Risk treatment plan in review |
| NIST CSF | in-progress | 72% | 79/110 | — |
No managed vendors.