FULL ASSET INVENTORY
Audit Target: 58 Physical Assets
| ID |
Name |
OS / Platform |
Role |
Data Sensitivity |
| SRV-001 | Epicor Server | Win Server 2019 | Production ERP | CUI / FCI |
| SRV-002 | TBS-FS01 | Win Server 2022 | Central File Storage | CUI / PII / PII |
| SRV-003 | TBS-DC01 | Win Server 2019 | Identity (AD/DNS) | System Critical |
| SRV-004 | TBS-NAS-01 | Synology DSM 7.2 | Backup Repository | CUI Snapshot |
| NET-001 | Sophos XG 310 | Sophos SFOS | Firewall / VPN | Security Control |
| WRK-001–040 | Staff Laptops/PCs | Win 10/11 Pro | Office Operations | Mixed |
| MOB-001–008 | Android Tablets | Android 12 | Floor Scanning | FCI Only |
| PRN-001–003 | Ricoh MFPs | Ricoh Embedded | Scan/Print Hub | Processing CUI |
Authentication Summary
Internal Network
Windows Active Directory username/password. No MFA enforced for local logins, RDP, or Server Admin sessions.
Cloud (M365)
Azure AD Conditional Access. MFA Enforced for all remote logins via Microsoft Authenticator.
CUI Inventory (Controlled Unclassified Information)
| CUI Type |
Description |
Storage Location |
Owner |
| Technical Specs | Uniform design, camouflage patterns | FS-01 (/CUI/Specs) | Robert Chen |
| Contract Info (CTI) | Deployment schedules, unit designations | Epicor / FS-01 | Sandra Ybarra |
| Personnel Privacy | Employee security clearance data | FS-01 (/HR/Private) | Lisa Nguyen |
| Export Control | Proprietary material blend data (EAR) | FS-01 / Email | Margaret Holloway |
FCI Inventory (Federal Contract Information)
| FCI Type |
Description |
Storage Location |
| Pricing/Bids | GSA and DLA bid documents | SharePoint / Email |
| PO History | Office supply order records | Epicor / Email |
| Schedules | General logistics and shipping dates | ERP / FS-01 |
Internal Maintenance Log (Extract)
| Date |
Engineer |
System |
Work Description |
| Mar 15, 2026 | Kyle (TechServ) | SRV-001 | Applied Epicor security patches. Used personal USB for offline patch file transfer. |
| Apr 02, 2026 | Dennis Park | SRV-003 | AD Schema cleanup. |
INC-001: Compromised Account (Historical)
Timeline: ~10 Months Ago
Context: Accounting staff entered credentials into a fake DLA portal. Account was used by attacker to log into M365 SharePoint from a foreign IP.
Result: Dennis Park reset the password and disabled the account for 24 hours. No data export review was conducted. No DoD reporting was initiated.
Assessor GAP Observation Matrix
| ID |
Control Family |
Observation Detail |
| G-01 | IA | Failure to implement MFA for local network sessions and VPN access. |
| G-02 | AC | Privileged accounts used for non-privileged tasks (Domain Admin as primary). |
| G-03 | MA | No escort policy for third-party maintenance; personal USBs used on production servers. |
| G-04 | IR | Historical incident not reported to DIBNet despite potential CUI exposure. |
Internal Vuln Scan Result (Doc 9 Extract)
| Severity |
CVE / Title |
System |
Discovery Date |
| CRITICAL | CVE-2021-34527 (PrintNightmare) | WRK-001-040 | 14 Months Ago |
| CRITICAL | Exposed SMBv1 Protocol | SRV-001 | 14 Months Ago |
| HIGH | End-of-Support OS (Win 7/8 remnants) | Sales WRK | 14 Months Ago |