Catalog 0.4 (70 computer checks: unique login, prohibited software, tamper protection on Mac/Linux), app 0.5.1

README.md

@@ -29,7 +29,7 @@ can be built before real customer data exists. The generated training data is in
 
 | Section | Checks | Examples |
 |---|---|---|
-| `COMPLIANCE RESULTS` | Security baseline (33 on Windows, 26 on Linux/macOS) | Password and lockout policy, antivirus, firewall, screen lock, USB storage, administrators, disk encryption |
+| `COMPLIANCE RESULTS` | Security baseline | Password and lockout policy, unique user login, antivirus and tamper protection, firewall, screen lock, USB storage, administrators, disk encryption, updates, vulnerabilities, prohibited software |
 | `GDPR TECHNICAL CONTROLS` | 12 | Automatic updates, supported OS, security logging, time sync, backup, removable media encryption, guest account, remote access, diagnostic data, personal data discovery (opt-in, later stage) |
 | `EU AI ACT CONTROLS` | 5 | AI software inventory, unapproved AI tools (shadow AI), risk classification (by the model), Windows Recall / Apple Intelligence, AI log retention |
 | `ORGANISATIONAL CONTROLS` | 8 | RoPA, DPIA, breach procedure, processor agreements, AI register, AI literacy, human oversight, AI transparency |
@@ -210,7 +210,7 @@ Devseis builds the bundle with `python3 vulndb/build_bundle.py` (needs internet;
 
 | Part | Version | Notes |
 |---|---|---|
-| Catalog, library, synthetic data, training data | **0.3** | 74 checks: Windows 64, Linux 56, macOS 56, iPhone 29, Android 30. 0.3 adds phones, real CVEs in training data and wording identical to the collectors and the phone page; 39,500 grounded examples |
+| Catalog, library, synthetic data | **0.4** | 76 checks, 70 on computers (Windows 66, Linux 59, macOS 59). 0.4 adds unique user login, prohibited software (`PROHIBITED_SOFTWARE`), tamper protection on macOS (SIP) and Linux (SELinux/AppArmor) and names the encryption product. The fine-tuned models handle the new checks without retraining (v0.3 full precision and v0.6 4-bit: 24/24 findings). Training data is still 0.3 |
 | Collectors (Windows, Linux, macOS) | **0.2** (catalog 0.3) | macOS tested on a real Mac; Linux tested on Ubuntu 24.04 and Fedora 42 containers; Windows parse-checked only (needs a real Windows test). Known vulnerabilities: inventory only, matching comes with the offline vulnerability bundle |
 | Vulnerability matcher and bundle | 0.1 | Tested: this Mac (Chrome 154 → 58 critical/high, fixed in 155), Ubuntu 24.04 (OpenSSL), Rocky 9 (25 of 25 packages agree with dnf's own security list), Fedora reported as not covered |
 | Website | **2026-10-14** | Computers only: download, check list, report viewer; no AI in the browser |

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devseis-endpoint-auditor",
   "productName": "Arx",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act, with a local AI auditor.",
   "author": {
     "name": "Devseis",

baseline.conf

@@ -40,11 +40,19 @@ APPROVED_ADMINS=itadmin
 # Windows: a disabled built-in Administrator (RID 500) is not counted as unauthorized.
 ALLOW_DISABLED_BUILTIN_ADMIN=1
 
+# --- Unique user login ------------------------------------------------------
+# Account names that suggest a shared or generic login (exact match, any case). Each person should have their own account.
+SHARED_ACCOUNT_NAMES=admin,administrator,user,users,shared,office,staff,reception,frontdesk,test,temp,demo,student,kiosk,public,helpdesk,owner
+
 # --- Vulnerabilities -------------------------------------------------------
 MAX_PENDING_SECURITY_UPDATES=0
 MAX_OUTDATED_APPS=0
 # Critical or high vulnerabilities allowed in installed software (offline OSV/NVD data)
 MAX_CRITICAL_HIGH_VULNERABILITIES=0
+# Software that must not be installed: part of an installed app or package name, any case. Default: torrent clients
+# (any name containing "torrent": µTorrent, BitTorrent, qBittorrent…) and
+# Windows/Office activation cracks. Add your own (e.g. games, unlicensed tools). Licences cannot be checked from the device.
+PROHIBITED_SOFTWARE=Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit
 
 # --- GDPR technical controls ----------------------------------------------
 UPDATES_MAX_AGE_DAYS=30

catalog/checks.json

@@ -1,5 +1,5 @@
 {
-  "catalog_version": "0.3.0",
+  "catalog_version": "0.4.0",
   "statuses": [
     "Compliant",
     "Non-Compliant",
@@ -59,7 +59,8 @@
       "A.8.17": "Clock synchronization",
       "A.8.19": "Installation of software on operational systems",
       "A.8.20": "Networks security",
-      "A.8.24": "Use of cryptography"
+      "A.8.24": "Use of cryptography",
+      "A.5.32": "Intellectual property rights"
     },
     "gdpr": {
       "Art. 5(1)(c)": "Data minimisation",
@@ -375,10 +376,12 @@
       "section": "baseline",
       "name": "Tamper protection",
       "os": [
-        "windows"
+        "windows",
+        "linux",
+        "macos"
       ],
       "baseline_keys": [],
-      "rule": "Defender tamper protection is on.",
+      "rule": "Protection cannot be switched off by malware: Defender tamper protection (Windows), System Integrity Protection (macOS), an enforcing SELinux or AppArmor (Linux).",
       "controls": {
         "iso27001": [
           "A.8.7"
@@ -1047,7 +1050,7 @@
         "android"
       ],
       "baseline_keys": [],
-      "rule": "The system disk is fully encrypted (BitLocker / LUKS / FileVault). Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default.",
+      "rule": "The system disk is fully encrypted (BitLocker / LUKS / FileVault); the finding names the encryption product. Phones: iOS data protection is on when a passcode is set; Android 10+ encrypts by default.",
       "controls": {
         "iso27001": [
           "A.8.24",
@@ -1137,6 +1140,30 @@
         "ai_act": []
       }
     },
+    {
+      "id": "account.unique_login",
+      "section": "baseline",
+      "name": "Unique user login",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "SHARED_ACCOUNT_NAMES"
+      ],
+      "rule": "No automatic login, and no enabled account with a shared or generic name from SHARED_ACCOUNT_NAMES: each person signs in with their own account.",
+      "controls": {
+        "iso27001": [
+          "A.5.16",
+          "A.8.5"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
     {
       "id": "vuln.pending_updates",
       "section": "baseline",
@@ -1198,6 +1225,30 @@
         "android": "App updates"
       }
     },
+    {
+      "id": "software.prohibited",
+      "section": "baseline",
+      "name": "Prohibited software",
+      "os": [
+        "windows",
+        "linux",
+        "macos"
+      ],
+      "baseline_keys": [
+        "PROHIBITED_SOFTWARE"
+      ],
+      "rule": "No installed application or package whose name contains an entry of PROHIBITED_SOFTWARE (torrent clients, activation cracks by default). Licences themselves cannot be checked from the device.",
+      "controls": {
+        "iso27001": [
+          "A.8.19",
+          "A.5.32"
+        ],
+        "gdpr": [
+          "Art. 32(1)(b)"
+        ],
+        "ai_act": []
+      }
+    },
     {
       "id": "vuln.known_vulnerabilities",
       "section": "baseline",

collectors/linux/audit.sh

@@ -11,7 +11,7 @@
 set -u
 
 COLLECTOR_VERSION="0.2.0"
-CATALOG_VERSION="0.3.0"
+CATALOG_VERSION="0.4.0"
 
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)
@@ -49,7 +49,7 @@ conf_get() {
     if [ -n "$value" ]; then printf '%s' "$value"; else printf '%s' "$3"; fi
 }
 
-BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS USB_DEVICE_ACCESS MAX_PENDING_SECURITY_UPDATES MAX_OUTDATED_APPS MAX_CRITICAL_HIGH_VULNERABILITIES"
+BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS USB_DEVICE_ACCESS MAX_PENDING_SECURITY_UPDATES MAX_OUTDATED_APPS MAX_CRITICAL_HIGH_VULNERABILITIES SHARED_ACCOUNT_NAMES PROHIBITED_SOFTWARE"
 declare -A B
 B[PASSWORD_MIN_LENGTH]=14; B[PASSWORD_HISTORY]=24; B[PASSWORD_MAX_AGE_DAYS]=365; B[PASSWORD_MIN_AGE_DAYS]=1
 B[PASSWORD_COMPLEXITY]=1; B[LOCKOUT_THRESHOLD_MAX]=5; B[LOCKOUT_DURATION_MIN_MINUTES]=15; B[LOCKOUT_OBSERVATION_MIN_MINUTES]=15
@@ -59,6 +59,8 @@ B[UPDATES_MAX_AGE_DAYS]=30; B[BACKUP_MAX_AGE_DAYS]=7; B[APPROVED_REMOTE_SERVICES
 B[MACOS_MIN_MAJOR]=14; B[UBUNTU_MIN_VERSION]=22.04; B[DEBIAN_MIN_VERSION]=12; B[RHEL_MIN_VERSION]=9
 B[PERSONAL_DATA_SCAN]=0; B[APPROVED_AI_TOOLS]=""
 B[USB_DEVICE_ACCESS]=allow; B[MAX_PENDING_SECURITY_UPDATES]=0; B[MAX_OUTDATED_APPS]=0; B[MAX_CRITICAL_HIGH_VULNERABILITIES]=0
+B[SHARED_ACCOUNT_NAMES]="admin,administrator,user,users,shared,office,staff,reception,frontdesk,test,temp,demo,student,kiosk,public,helpdesk,owner"
+B[PROHIBITED_SOFTWARE]="Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit"
 for key in $BASELINE_KEYS; do B[$key]=$(conf_get "$BASELINE_FILE" "$key" "${B[$key]}"); done
 
 is_root() { [ "$(id -u)" -eq 0 ]; }
@@ -284,6 +286,22 @@ else
     [ "$clamonacc" -eq 1 ]; pass_fail $? malware.on_access $S "On-access malware protection" "$( [ "$clamonacc" -eq 1 ] && echo "clamonacc running" || echo "not running")" "on-access scanning"
 fi
 
+# Tamper protection: an enforcing Linux security module (SELinux or AppArmor) confines services, so malware running as
+# them cannot switch off protection; Secure Boot is reported for information.
+lsm=""
+if have getenforce && [ "$(getenforce 2>/dev/null)" = "Enforcing" ]; then lsm="SELinux enforcing"
+elif [ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" = "Y" ]; then
+    profiles=$(cat /sys/kernel/security/apparmor/profiles 2>/dev/null | grep -c "(enforce)")
+    if [ "${profiles:-0}" -gt 0 ]; then lsm="AppArmor enforcing ($profiles profiles)"
+    elif ! is_root; then lsm="AppArmor enabled"; fi
+fi
+sb=""; have mokutil && sb=$(mokutil --sb-state 2>/dev/null | head -1)
+if [ -n "$lsm" ]; then
+    add malware.tamper $S "Tamper protection" Compliant "$lsm" "SELinux or AppArmor enforcing" "${sb:+Secure Boot: $sb}"
+else
+    add malware.tamper $S "Tamper protection" Non-Compliant "no security module enforcing" "SELinux or AppArmor enforcing" "${sb:+Secure Boot: $sb}"
+fi
+
 # Firewall: ufw, firewalld, nftables or iptables.
 fw_name=""; fw_in=""; fw_out=""; fw_detail=""
 if have ufw && is_root; then
@@ -424,6 +442,24 @@ else
     fi
 fi
 
+# Unique user login: no automatic login in the display manager, and no shared or generic account names.
+auto_login=""
+for f in /etc/gdm3/custom.conf /etc/gdm/custom.conf; do
+    [ -r "$f" ] && grep -qiE '^[[:space:]]*AutomaticLoginEnable[[:space:]]*=[[:space:]]*true' "$f" && auto_login=$(awk -F= 'tolower($1) ~ /^[[:space:]]*automaticlogin[[:space:]]*$/ { gsub(/[[:space:]]/, "", $2); print $2 }' "$f" | head -1)
+    [ -n "$auto_login" ] && break
+done
+[ -z "$auto_login" ] && auto_login=$(cat /etc/lightdm/lightdm.conf /etc/lightdm/lightdm.conf.d/*.conf 2>/dev/null | awk -F= '/^[[:space:]]*autologin-user[[:space:]]*=/ { gsub(/[[:space:]]/, "", $2); if ($2 != "") print $2 }' | head -1)
+[ -z "$auto_login" ] && auto_login=$(cat /etc/sddm.conf /etc/sddm.conf.d/*.conf 2>/dev/null | awk -F= '/^\[Autologin\]/ { a = 1; next } /^\[/ { a = 0 } a && $1 ~ /^[[:space:]]*User[[:space:]]*$/ { gsub(/[[:space:]]/, "", $2); if ($2 != "") print $2 }' | head -1)
+generic=""
+for entry in $HUMAN_USERS; do
+    name=${entry%%:*}
+    in_list "$name" "${B[SHARED_ACCOUNT_NAMES]}" && generic="${generic:+$generic, }$name"
+done
+issues=""
+[ -n "$auto_login" ] && issues="automatic login as $auto_login"
+[ -n "$generic" ] && issues="${issues:+$issues; }shared or generic accounts: $generic"
+[ -z "$issues" ]; pass_fail $? account.unique_login $S "Unique user login" "${issues:-personal accounts, no automatic login}" "personal accounts, no automatic login"
+
 # Disk encryption (LUKS under the root filesystem)
 root_src=$(findmnt -no SOURCE / 2>/dev/null)
 # Btrfs subvolumes appear as /dev/mapper/x[/@]: keep the device part only.
@@ -503,6 +539,31 @@ else
     pass_fail $? vuln.outdated_apps $S "Outdated third-party applications" "$outdated outdated" "$OUTDATED_EXP" "$outdated_detail"
 fi
 
+# Prohibited software (PROHIBITED_SOFTWARE: parts of package names, any case). Licences cannot be checked from the device.
+pkg_names=""
+if have dpkg-query; then pkg_names=$(dpkg-query -W -f '${db:Status-Abbrev}\t${Package}\n' 2>/dev/null | awk -F'\t' '$1 ~ /^ii/ { print $2 }')
+elif have rpm; then pkg_names=$(rpm -qa --qf '%{NAME}\n' 2>/dev/null); fi
+have flatpak && pkg_names="$pkg_names
+$(flatpak list --app --columns=application 2>/dev/null)"
+have snap && pkg_names="$pkg_names
+$(snap list 2>/dev/null | awk 'NR > 1 { print $1 }')"
+prohibited=""
+if [ -n "${B[PROHIBITED_SOFTWARE]}" ]; then
+    old_ifs="$IFS"; IFS=,
+    for item in ${B[PROHIBITED_SOFTWARE]}; do
+        item=$(lower "$(printf '%s' "$item" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')")
+        [ -n "$item" ] || continue
+        found=$(printf '%s\n' "$pkg_names" | grep -iF -- "$item" | grep -v '^lib' | head -3 | paste -sd, - | sed 's/,/, /g')
+        [ -n "$found" ] && prohibited="${prohibited:+$prohibited, }$found"
+    done
+    IFS="$old_ifs"
+fi
+if [ -z "${B[PROHIBITED_SOFTWARE]}" ]; then
+    add software.prohibited $S "Prohibited software" Compliant "no list configured" "none of: (empty list)" "PROHIBITED_SOFTWARE in baseline.conf is empty."
+else
+    [ -z "$prohibited" ]; pass_fail $? software.prohibited $S "Prohibited software" "${prohibited:-none found}" "none of: ${B[PROHIBITED_SOFTWARE]}"
+fi
+
 # Known vulnerabilities: inventory now; matching against offline OSV data comes in a later version.
 add vuln.known_vulnerabilities $S "Known vulnerabilities in installed software" Pending "$pkg_count packages inventoried" "<= ${B[MAX_CRITICAL_HIGH_VULNERABILITIES]} critical/high" "Inventory saved for the Devseis app, which matches it against its offline OSV/NVD vulnerability data; the collector on its own does not match."
 

collectors/macos/audit.sh

@@ -13,7 +13,7 @@
 set -u
 
 COLLECTOR_VERSION="0.2.0"
-CATALOG_VERSION="0.3.0"
+CATALOG_VERSION="0.4.0"
 
 SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR=$(cd "$SCRIPT_DIR/../.." && pwd)
@@ -51,7 +51,7 @@ conf_get() {
     if [ -n "$value" ]; then printf '%s' "$value"; else printf '%s' "$3"; fi
 }
 
-BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS USB_DEVICE_ACCESS MAX_PENDING_SECURITY_UPDATES MAX_OUTDATED_APPS MAX_CRITICAL_HIGH_VULNERABILITIES"
+BASELINE_KEYS="PASSWORD_MIN_LENGTH PASSWORD_HISTORY PASSWORD_MAX_AGE_DAYS PASSWORD_MIN_AGE_DAYS PASSWORD_COMPLEXITY LOCKOUT_THRESHOLD_MAX LOCKOUT_DURATION_MIN_MINUTES LOCKOUT_OBSERVATION_MIN_MINUTES SIGNATURE_MAX_AGE_DAYS MACOS_XPROTECT_MAX_AGE_DAYS FIREWALL_OUTBOUND SCREEN_LOCK_MAX_SECONDS USB_READ USB_WRITE APPROVED_ADMINS ALLOW_DISABLED_BUILTIN_ADMIN UPDATES_MAX_AGE_DAYS BACKUP_MAX_AGE_DAYS APPROVED_REMOTE_SERVICES WINDOWS_MIN_BUILD MACOS_MIN_MAJOR UBUNTU_MIN_VERSION DEBIAN_MIN_VERSION RHEL_MIN_VERSION PERSONAL_DATA_SCAN APPROVED_AI_TOOLS USB_DEVICE_ACCESS MAX_PENDING_SECURITY_UPDATES MAX_OUTDATED_APPS MAX_CRITICAL_HIGH_VULNERABILITIES SHARED_ACCOUNT_NAMES PROHIBITED_SOFTWARE"
 
 B_PASSWORD_MIN_LENGTH=$(conf_get "$BASELINE_FILE" PASSWORD_MIN_LENGTH 14)
 B_PASSWORD_HISTORY=$(conf_get "$BASELINE_FILE" PASSWORD_HISTORY 24)
@@ -80,6 +80,8 @@ B_RHEL_MIN_VERSION=$(conf_get "$BASELINE_FILE" RHEL_MIN_VERSION 9)
 B_PERSONAL_DATA_SCAN=$(conf_get "$BASELINE_FILE" PERSONAL_DATA_SCAN 0)
 B_APPROVED_AI_TOOLS=$(conf_get "$BASELINE_FILE" APPROVED_AI_TOOLS "")
 B_USB_DEVICE_ACCESS=$(conf_get "$BASELINE_FILE" USB_DEVICE_ACCESS allow)
+B_SHARED_ACCOUNT_NAMES=$(conf_get "$BASELINE_FILE" SHARED_ACCOUNT_NAMES "admin,administrator,user,users,shared,office,staff,reception,frontdesk,test,temp,demo,student,kiosk,public,helpdesk,owner")
+B_PROHIBITED_SOFTWARE=$(conf_get "$BASELINE_FILE" PROHIBITED_SOFTWARE "Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit")
 B_MAX_PENDING_SECURITY_UPDATES=$(conf_get "$BASELINE_FILE" MAX_PENDING_SECURITY_UPDATES 0)
 B_MAX_OUTDATED_APPS=$(conf_get "$BASELINE_FILE" MAX_OUTDATED_APPS 0)
 B_MAX_CRITICAL_HIGH_VULNERABILITIES=$(conf_get "$BASELINE_FILE" MAX_CRITICAL_HIGH_VULNERABILITIES 0)
@@ -289,6 +291,17 @@ else
     add malware.on_access $S "On-access malware protection" NotApplicable "XProtect only" "on-access scanning" "XProtect scans at launch and download; macOS has no built-in on-access scanning."
 fi
 
+# Tamper protection: System Integrity Protection stops anything, even root, changing protected system files and Apple's
+# security tools (XProtect, Gatekeeper); it can only be switched off from Recovery mode.
+sip=$(csrutil status 2>/dev/null)
+if printf '%s' "$sip" | grep -q "status: enabled"; then
+    add malware.tamper $S "Tamper protection" Compliant "System Integrity Protection on" "on"
+elif [ -n "$sip" ]; then
+    add malware.tamper $S "Tamper protection" Non-Compliant "System Integrity Protection $(printf '%s' "$sip" | sed -n 's/.*status: \([a-z]*\).*/\1/p' | head -1)" "on" "$(printf '%s' "$sip" | head -1)"
+else
+    add malware.tamper $S "Tamper protection" Error "not read" "on" "csrutil status gave no answer."
+fi
+
 # Firewall (application firewall)
 FW=/usr/libexec/ApplicationFirewall/socketfilterfw
 fw_state=$("$FW" --getglobalstate 2>/dev/null)
@@ -416,6 +429,25 @@ else
     add user.account_type $S "Signed-in user account type" Compliant "Standard ($CONSOLE_USER)" "Standard"
 fi
 
+# Unique user login: no automatic login, and no shared or generic account names (each person signs in as themselves).
+auto_login=$(defaults read /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null)
+generic=""
+while read -r name uid; do
+    is_int "$uid" && [ "$uid" -ge 500 ] || continue
+    case "$name" in _*|daemon|nobody|root) continue ;; esac
+    in_list "$name" "$B_SHARED_ACCOUNT_NAMES" && generic="${generic:+$generic, }$name"
+done <<EOF_USERS
+$(dscl . -list /Users UniqueID 2>/dev/null)
+EOF_USERS
+issues=""
+[ -n "$auto_login" ] && issues="automatic login as $auto_login"
+[ -n "$generic" ] && issues="${issues:+$issues; }shared or generic accounts: $generic"
+if [ -z "$issues" ]; then
+    add account.unique_login $S "Unique user login" Compliant "personal accounts, no automatic login" "personal accounts, no automatic login"
+else
+    add account.unique_login $S "Unique user login" Non-Compliant "$issues" "personal accounts, no automatic login"
+fi
+
 # FileVault
 fv=$(fdesetup status 2>/dev/null)
 if printf '%s' "$fv" | grep -q "FileVault is On"; then
@@ -481,6 +513,25 @@ for app in /Applications/*.app /Applications/*/*.app ${CONSOLE_HOME:+"$CONSOLE_H
     [ -f "$app/Contents/Info.plist" ] && APP_BUNDLES+=("$app")
 done
 app_count=${#APP_BUNDLES[@]}
+
+# Prohibited software (PROHIBITED_SOFTWARE: parts of app names, any case). Licences cannot be checked from the device.
+prohibited=""
+for app in ${APP_BUNDLES[@]+"${APP_BUNDLES[@]}"}; do
+    name=$(basename "$app" .app); lname=$(lower "$name")
+    old_ifs="$IFS"; IFS=,
+    for item in $B_PROHIBITED_SOFTWARE; do
+        item=$(lower "$(printf '%s' "$item" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')")
+        [ -n "$item" ] && case "$lname" in *"$item"*) prohibited="${prohibited:+$prohibited, }$name"; break ;; esac
+    done
+    IFS="$old_ifs"
+done
+if [ -z "$B_PROHIBITED_SOFTWARE" ]; then
+    add software.prohibited $S "Prohibited software" Compliant "no list configured" "none of: (empty list)" "PROHIBITED_SOFTWARE in baseline.conf is empty."
+elif [ -z "$prohibited" ]; then
+    add software.prohibited $S "Prohibited software" Compliant "none found in $app_count applications" "none of: $B_PROHIBITED_SOFTWARE"
+else
+    add software.prohibited $S "Prohibited software" Non-Compliant "$prohibited" "none of: $B_PROHIBITED_SOFTWARE"
+fi
 add vuln.known_vulnerabilities $S "Known vulnerabilities in installed software" Pending "$app_count applications inventoried" "<= $B_MAX_CRITICAL_HIGH_VULNERABILITIES critical/high" "Inventory saved for the Devseis app, which matches it against its offline OSV/NVD vulnerability data; the collector on its own does not match."
 
 # ---------------------------------------------------------------------------

collectors/windows/audit.ps1

@@ -26,7 +26,7 @@ param(
 Set-StrictMode -Version 2.0
 $ErrorActionPreference = 'Stop'
 $CollectorVersion = '0.2.0'
-$CatalogVersion = '0.3.0'
+$CatalogVersion = '0.4.0'
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -54,6 +54,8 @@ $Defaults = [ordered]@{
     MACOS_MIN_MAJOR = '14'; UBUNTU_MIN_VERSION = '22.04'; DEBIAN_MIN_VERSION = '12'; RHEL_MIN_VERSION = '9'
     PERSONAL_DATA_SCAN = '0'; APPROVED_AI_TOOLS = ''
     USB_DEVICE_ACCESS = 'allow'; MAX_PENDING_SECURITY_UPDATES = '0'; MAX_OUTDATED_APPS = '0'; MAX_CRITICAL_HIGH_VULNERABILITIES = '0'
+    SHARED_ACCOUNT_NAMES = 'admin,administrator,user,users,shared,office,staff,reception,frontdesk,test,temp,demo,student,kiosk,public,helpdesk,owner'
+    PROHIBITED_SOFTWARE = 'Torrent,Transmission,Deluge,Vuze,FrostWire,KMSpico,KMSAuto,AutoKMS,Microsoft Toolkit'
 }
 $conf = Read-Conf $Baseline
 $B = [ordered]@{}
@@ -329,6 +331,17 @@ Check 'user.account_type' $S 'Signed-in user account type' 'Standard' {
     Pass $false "Administrator ($console)" 'The signed-in user is a member of the local Administrators group.'
 }
 
+# Unique user login: no automatic sign-in (Winlogon AutoAdminLogon) and no enabled shared or generic local accounts.
+Check 'account.unique_login' $S 'Unique user login' 'personal accounts, no automatic login' {
+    $winlogon = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+    $issues = @()
+    if ("$(Get-RegValue $winlogon 'AutoAdminLogon')" -eq '1') { $issues += "automatic login as $(Get-RegValue $winlogon 'DefaultUserName')" }
+    $shared = @(Split-List $B.SHARED_ACCOUNT_NAMES)
+    $generic = @(Get-LocalUser -ErrorAction Stop | Where-Object { $_.Enabled -and ($shared -contains $_.Name) } | ForEach-Object { $_.Name })
+    if ($generic.Count) { $issues += "shared or generic accounts: $($generic -join ', ')" }
+    if ($issues.Count) { Pass $false ($issues -join '; ') } else { Pass $true 'personal accounts, no automatic login' }
+}
+
 # BitLocker on the system drive
 $Bl = $null; $BlError = $null
 try { Assert-Admin; $Bl = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction Stop } catch { $BlError = $_.Exception.Message }
@@ -336,7 +349,7 @@ function BitLockerCheck($Id, $Name, $Expected, [scriptblock]$Test) {
     if ($null -eq $Bl) { Add-Result $Id $S $Name 'Error' 'not read' $Expected $BlError } else { Check $Id $S $Name $Expected $Test }
 }
 BitLockerCheck 'encryption.feature' 'BitLocker' 'on' { Pass ("$($Bl.VolumeStatus)" -ne 'FullyDecrypted') $(if ("$($Bl.VolumeStatus)" -ne 'FullyDecrypted') { 'on' } else { 'off' }) }
-BitLockerCheck 'encryption.enabled' 'Encryption' 'fully encrypted' { Pass ("$($Bl.VolumeStatus)" -eq 'FullyEncrypted') ("{0} ({1}%)" -f $Bl.VolumeStatus, $Bl.EncryptionPercentage) }
+BitLockerCheck 'encryption.enabled' 'Encryption' 'fully encrypted' { Pass ("$($Bl.VolumeStatus)" -eq 'FullyEncrypted') ("BitLocker: {0} ({1}%)" -f $Bl.VolumeStatus, $Bl.EncryptionPercentage) }
 BitLockerCheck 'encryption.protection' 'BitLocker protection' 'protection on, AES' {
     $method = "$($Bl.EncryptionMethod)"
     Pass ("$($Bl.ProtectionStatus)" -eq 'On' -and $method -match 'Aes') ("protection {0}, {1}" -f $Bl.ProtectionStatus, $method)
@@ -401,6 +414,12 @@ $Inventory = @(Get-ItemProperty -Path $UninstallKeys -ErrorAction SilentlyContin
     Where-Object { $_.DisplayName -and -not $_.SystemComponent -and -not $_.ParentKeyName } |
     ForEach-Object { [ordered]@{ name = "$($_.DisplayName)".Trim(); version = "$($_.DisplayVersion)".Trim(); publisher = "$($_.Publisher)".Trim() } } |
     Sort-Object { $_.name + '|' + $_.version } -Unique)
+# Prohibited software (PROHIBITED_SOFTWARE: parts of installed program names, any case). Licences cannot be checked here.
+Check 'software.prohibited' $S 'Prohibited software' $(if ($B.PROHIBITED_SOFTWARE) { "none of: $($B.PROHIBITED_SOFTWARE)" } else { 'none of: (empty list)' }) {
+    if (-not $B.PROHIBITED_SOFTWARE) { return State 'Compliant' 'no list configured' 'PROHIBITED_SOFTWARE in baseline.conf is empty.' }
+    $found = @($Inventory | Where-Object { $n = $_.name; @(Split-List $B.PROHIBITED_SOFTWARE | Where-Object { $n -like "*$_*" }).Count } | ForEach-Object { $_.name } | Select-Object -Unique)
+    if ($found.Count) { Pass $false ($found -join ', ') } else { Pass $true "none found in $($Inventory.Count) programs" }
+}
 Check 'vuln.known_vulnerabilities' $S 'Known vulnerabilities in installed software' "<= $($B.MAX_CRITICAL_HIGH_VULNERABILITIES) critical/high" {
     # Inventory now; matching against offline OSV/NVD data comes in a later version.
     State 'Pending' "$($Inventory.Count) applications inventoried" 'Inventory saved for the Devseis app, which matches it against its offline OSV/NVD vulnerability data; the collector on its own does not match.'

index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-  <meta name="description" content="Arx: a free security audit for your Mac, Windows or Linux computer. 68 checks in about a minute, offline, mapped to ISO 27001, GDPR and the EU AI Act, with one-click fixes on Mac. Nothing is uploaded.">
+  <meta name="description" content="Arx: a free security audit for your Mac, Windows or Linux computer. 70 checks in about a minute, offline, mapped to ISO 27001, GDPR and the EU AI Act, with one-click fixes on Mac. Nothing is uploaded.">
   <meta name="theme-color" content="#ed2939">
   <title>Arx · Security audit for your computer</title>
   <link rel="icon" href="app/build/icon.png">
@@ -33,7 +33,7 @@
     <section class="wrap hero">
       <p class="eyebrow"><img src="app/build/icon.png" alt="">Arx security audit</p>
       <h1>Is your computer secure?<br><span class="grad">Find out in a minute.</span></h1>
-      <p class="lead">A free audit of your Mac, Windows or Linux computer: <b>68 checks</b> mapped to <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. A small AI on your computer writes the report, and on a Mac Arx can <b>fix problems for you</b>. It runs offline. <u>Nothing is uploaded.</u></p>
+      <p class="lead">A free audit of your Mac, Windows or Linux computer: <b><span data-count>70</span> checks</b> mapped to <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. A small AI on your computer writes the report, and on a Mac Arx can <b>fix problems for you</b>. It runs offline. <u>Nothing is uploaded.</u></p>
 
       <div class="device-card" id="deviceCard">
         <span class="device-icon" id="deviceIcon">💻</span>
@@ -56,12 +56,12 @@
         <label class="btn btn-lg" for="reportFile" title="Open the …-evidence.json file Arx saves next to each report">Open a report</label>
         <input type="file" id="reportFile" accept=".json,application/json" hidden>
       </div>
-      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.0</p>
+      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.1</p>
     </section>
 
     <section class="wrap">
       <div class="stats">
-        <div class="stat c-red"><span class="tiny muted">Checks</span><b>68</b><span class="tiny muted">settings &amp; controls</span></div>
+        <div class="stat c-red"><span class="tiny muted">Checks</span><b data-count>70</b><span class="tiny muted">settings &amp; controls</span></div>
         <div class="stat c-blue"><span class="tiny muted">Time</span><b>~1 min</b><span class="tiny muted">for the whole audit</span></div>
         <div class="stat c-green"><span class="tiny muted">Uploaded</span><b>0 bytes</b><span class="tiny muted">runs offline</span></div>
         <div class="stat c-violet"><span class="tiny muted">Frameworks</span><b>3</b><span class="tiny muted">ISO · GDPR · AI Act</span></div>
@@ -69,7 +69,7 @@
     </section>
 
     <section class="wrap section" id="checks">
-      <div class="section-head"><h2>High-risk checks</h2><a class="tiny muted link" href="#all-checks">See all 68 →</a></div>
+      <div class="section-head"><h2>High-risk checks</h2><a class="tiny muted link" href="#all-checks">See all <span data-count>70</span> →</a></div>
       <div class="rail" id="riskRail"></div>
     </section>
 
@@ -95,7 +95,7 @@
     </section>
 
     <section class="wrap section" id="download">
-      <div class="section-head"><h2>Download Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.0</span></div>
+      <div class="section-head"><h2>Download Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.1</span></div>
       <div class="dl-grid">
         <article class="dl-card" data-os="mac">
           <span class="ribbon ribbon-you hidden">YOUR SYSTEM</span>

library/check_guidance.json

@@ -1,5 +1,5 @@
 {
-  "library_version": "0.3.0",
+  "library_version": "0.4.0",
   "note": "Per-check guidance used to write findings. Fix steps are written for administrators; prefer central management (Group Policy/Intune, MDM, configuration management) over per-device changes. Review by a security professional before use with customers.",
   "aliases": {
     "firewall.domain.enabled": "firewall.enabled",
@@ -257,7 +257,7 @@
       "verify": "Re-run the audit; On-access malware protection should be Compliant."
     },
     "malware.tamper": {
-      "why": "Tamper protection stops malware or users switching off Defender.",
+      "why": "Tamper protection stops malware, or a user, from switching off the device's security protection.",
       "risk": {
         "level": "Medium",
         "reason": "Attackers commonly disable antivirus before deploying ransomware."
@@ -265,6 +265,13 @@
       "fix": {
         "windows": [
           "Turn on Tamper Protection in Windows Security > Virus & threat protection settings, or centrally through Microsoft Intune / Defender for Endpoint (it cannot be set with PowerShell)."
+        ],
+        "macos": [
+          "System Integrity Protection can only be turned back on from Recovery: start the Mac in Recovery mode, open Terminal and run csrutil enable, then restart. Ask IT first if a tool needed it off."
+        ],
+        "linux": [
+          "Ubuntu / Debian: sudo apt install apparmor apparmor-utils && sudo systemctl enable --now apparmor (profiles load in enforce mode).",
+          "RHEL / Fedora: set SELINUX=enforcing in /etc/selinux/config, run sudo touch /.autorelabel and restart."
         ]
       },
       "verify": "Re-run the audit; Tamper protection should be on."
@@ -1219,6 +1226,50 @@
         ]
       },
       "verify": "Re-run the phone check; previews should be hidden when the phone is locked."
+    },
+    "account.unique_login": {
+      "why": "Every action on a device should be traceable to one person. Automatic login lets anyone who turns the computer on use it, and shared accounts hide who did what.",
+      "risk": {
+        "level": "Medium",
+        "reason": "With shared or automatic logins, a lost or borrowed device opens straight into someone's data, and incidents cannot be traced to a person."
+      },
+      "fix": {
+        "macos": [
+          "Turn off automatic login: System Settings > Users & Groups > Automatically log in as: Off.",
+          "Give each person their own account and remove or rename shared ones such as office or admin (keep one named, approved IT administrator)."
+        ],
+        "windows": [
+          "Turn off automatic sign-in: run netplwiz and tick 'Users must enter a user name and password', or set AutoAdminLogon = 0 under HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon.",
+          "Give each person their own account and disable or remove shared local accounts (Computer Management > Local Users and Groups)."
+        ],
+        "linux": [
+          "Turn off automatic login in Settings > Users, or set AutomaticLoginEnable=false in /etc/gdm3/custom.conf (autologin-user= in LightDM, [Autologin] User= in SDDM).",
+          "Give each person their own account; lock shared ones with sudo usermod -L <name>."
+        ]
+      },
+      "verify": "Re-run the audit; Unique user login should be Compliant."
+    },
+    "software.prohibited": {
+      "why": "Torrent clients and activation cracks are common sources of malware and of unlicensed software, which is a legal and licence-audit risk.",
+      "risk": {
+        "level": "High",
+        "reason": "Activation cracks and pirated downloads often carry malware, and unlicensed software breaches copyright and licence terms."
+      },
+      "fix": {
+        "macos": [
+          "Quit the app and drag it from Applications to the Bin, then empty the Bin.",
+          "If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf."
+        ],
+        "windows": [
+          "Uninstall it in Settings > Apps > Installed apps. For activation cracks, also run a full Microsoft Defender scan and activate Windows/Office with a genuine licence.",
+          "If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf."
+        ],
+        "linux": [
+          "Remove the package: sudo apt remove <package> (or sudo dnf remove <package>, flatpak uninstall, snap remove).",
+          "If the software is needed for work, ask IT to approve it and remove its name from PROHIBITED_SOFTWARE in baseline.conf."
+        ]
+      },
+      "verify": "Re-run the audit; Prohibited software should show none found."
     }
   }
 }

library/controls.json

@@ -2,199 +2,526 @@
   "library_version": "0.1.0",
   "note": "Written by Devseis in its own words for retrieval by the auditor model. ISO/IEC 27001:2022 control titles are cited; the standard's text is not reproduced. GDPR and AI Act entries summarise the law and are not legal advice.",
   "controls": [
-    { "id": "A.5.9", "framework": "ISO 27001:2022", "title": "Inventory of information and other associated assets",
+    {
+      "id": "A.5.9",
+      "framework": "ISO 27001:2022",
+      "title": "Inventory of information and other associated assets",
       "summary": "Know which information assets, devices and software exist and who owns them, and keep that list current.",
-      "auditor_looks_for": ["An up-to-date asset list that includes endpoints and installed software", "An owner for each asset"],
-      "endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory." },
-    { "id": "A.5.12", "framework": "ISO 27001:2022", "title": "Classification of information",
+      "auditor_looks_for": [
+        "An up-to-date asset list that includes endpoints and installed software",
+        "An owner for each asset"
+      ],
+      "endpoint_relevance": "Each endpoint and the software on it (including AI tools) should appear in the inventory."
+    },
+    {
+      "id": "A.5.12",
+      "framework": "ISO 27001:2022",
+      "title": "Classification of information",
       "summary": "Label information by how sensitive it is so that the right protection can be applied.",
-      "auditor_looks_for": ["A classification scheme", "Evidence that sensitive data is identified, e.g. personal data"],
-      "endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly." },
-    { "id": "A.5.15", "framework": "ISO 27001:2022", "title": "Access control",
+      "auditor_looks_for": [
+        "A classification scheme",
+        "Evidence that sensitive data is identified, e.g. personal data"
+      ],
+      "endpoint_relevance": "Personal or confidential files stored on laptops need to be found and protected accordingly."
+    },
+    {
+      "id": "A.5.15",
+      "framework": "ISO 27001:2022",
+      "title": "Access control",
       "summary": "Grant access to information and systems based on business need, and document the rules.",
-      "auditor_looks_for": ["An access control policy", "Administrative access limited to named, approved people"],
-      "endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints." },
-    { "id": "A.5.16", "framework": "ISO 27001:2022", "title": "Identity management",
+      "auditor_looks_for": [
+        "An access control policy",
+        "Administrative access limited to named, approved people"
+      ],
+      "endpoint_relevance": "Only approved IT staff should hold administrator rights on endpoints."
+    },
+    {
+      "id": "A.5.16",
+      "framework": "ISO 27001:2022",
+      "title": "Identity management",
       "summary": "Every account belongs to an identifiable person or a documented service, through its whole life cycle.",
-      "auditor_looks_for": ["No shared or anonymous accounts", "Disabled guest and default accounts"],
-      "endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people." },
-    { "id": "A.5.17", "framework": "ISO 27001:2022", "title": "Authentication information",
+      "auditor_looks_for": [
+        "No shared or anonymous accounts",
+        "Disabled guest and default accounts"
+      ],
+      "endpoint_relevance": "Guest accounts and anonymous logins break the link between actions and people."
+    },
+    {
+      "id": "A.5.17",
+      "framework": "ISO 27001:2022",
+      "title": "Authentication information",
       "summary": "Passwords and other secrets are allocated, managed and protected under clear rules.",
-      "auditor_looks_for": ["A password rule set (length, reuse, change) enforced by the system", "Users told how to protect their passwords"],
-      "endpoint_relevance": "The device's password policy is the technical enforcement of these rules." },
-    { "id": "A.5.18", "framework": "ISO 27001:2022", "title": "Access rights",
+      "auditor_looks_for": [
+        "A password rule set (length, reuse, change) enforced by the system",
+        "Users told how to protect their passwords"
+      ],
+      "endpoint_relevance": "The device's password policy is the technical enforcement of these rules."
+    },
+    {
+      "id": "A.5.18",
+      "framework": "ISO 27001:2022",
+      "title": "Access rights",
       "summary": "Access rights are granted, reviewed regularly and removed when no longer needed.",
-      "auditor_looks_for": ["Periodic review of who has administrator rights", "Removal of rights that are not justified"],
-      "endpoint_relevance": "Employee accounts that are local administrators without approval are a finding." },
-    { "id": "A.5.20", "framework": "ISO 27001:2022", "title": "Addressing information security within supplier agreements",
+      "auditor_looks_for": [
+        "Periodic review of who has administrator rights",
+        "Removal of rights that are not justified"
+      ],
+      "endpoint_relevance": "Employee accounts that are local administrators without approval are a finding."
+    },
+    {
+      "id": "A.5.20",
+      "framework": "ISO 27001:2022",
+      "title": "Addressing information security within supplier agreements",
       "summary": "Agreements with suppliers set out the security requirements they must meet.",
-      "auditor_looks_for": ["Signed agreements with security and data protection clauses"],
-      "endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements." },
-    { "id": "A.5.24", "framework": "ISO 27001:2022", "title": "Information security incident management planning and preparation",
+      "auditor_looks_for": [
+        "Signed agreements with security and data protection clauses"
+      ],
+      "endpoint_relevance": "Cloud and AI services used from endpoints are suppliers that need agreements."
+    },
+    {
+      "id": "A.5.24",
+      "framework": "ISO 27001:2022",
+      "title": "Information security incident management planning and preparation",
       "summary": "Plan in advance how security incidents are reported, handled and communicated.",
-      "auditor_looks_for": ["A documented incident procedure with roles", "Contact points and escalation paths"],
-      "endpoint_relevance": "Endpoint logs and alerts feed the incident process." },
-    { "id": "A.5.26", "framework": "ISO 27001:2022", "title": "Response to information security incidents",
+      "auditor_looks_for": [
+        "A documented incident procedure with roles",
+        "Contact points and escalation paths"
+      ],
+      "endpoint_relevance": "Endpoint logs and alerts feed the incident process."
+    },
+    {
+      "id": "A.5.26",
+      "framework": "ISO 27001:2022",
+      "title": "Response to information security incidents",
       "summary": "Respond to incidents according to the documented procedure.",
-      "auditor_looks_for": ["Records of past incidents and how they were handled"],
-      "endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy." },
-    { "id": "A.5.34", "framework": "ISO 27001:2022", "title": "Privacy and protection of PII",
+      "auditor_looks_for": [
+        "Records of past incidents and how they were handled"
+      ],
+      "endpoint_relevance": "Investigations depend on endpoint evidence being available and trustworthy."
+    },
+    {
+      "id": "A.5.34",
+      "framework": "ISO 27001:2022",
+      "title": "Privacy and protection of PII",
       "summary": "Meet the legal and contractual requirements for protecting personal data.",
-      "auditor_looks_for": ["Links between the ISMS and GDPR compliance", "Minimised collection and sharing of personal data"],
-      "endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device." },
-    { "id": "A.6.3", "framework": "ISO 27001:2022", "title": "Information security awareness, education and training",
+      "auditor_looks_for": [
+        "Links between the ISMS and GDPR compliance",
+        "Minimised collection and sharing of personal data"
+      ],
+      "endpoint_relevance": "Diagnostic data sharing and OS AI features can send personal data off the device."
+    },
+    {
+      "id": "A.6.3",
+      "framework": "ISO 27001:2022",
+      "title": "Information security awareness, education and training",
       "summary": "People receive awareness and training suited to their role, and it is kept current.",
-      "auditor_looks_for": ["Training records", "Topics that match the risks people face (including AI use)"],
-      "endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI." },
-    { "id": "A.6.7", "framework": "ISO 27001:2022", "title": "Remote working",
+      "auditor_looks_for": [
+        "Training records",
+        "Topics that match the risks people face (including AI use)"
+      ],
+      "endpoint_relevance": "Users decide what they install and share; training reduces shadow IT and shadow AI."
+    },
+    {
+      "id": "A.6.7",
+      "framework": "ISO 27001:2022",
+      "title": "Remote working",
       "summary": "Protect information accessed, processed or stored outside the organisation's premises.",
-      "auditor_looks_for": ["Rules for remote access tools", "Only approved remote access services enabled"],
-      "endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access." },
-    { "id": "A.7.7", "framework": "ISO 27001:2022", "title": "Clear desk and clear screen",
+      "auditor_looks_for": [
+        "Rules for remote access tools",
+        "Only approved remote access services enabled"
+      ],
+      "endpoint_relevance": "Remote desktop and screen sharing services open the device to outside access."
+    },
+    {
+      "id": "A.7.7",
+      "framework": "ISO 27001:2022",
+      "title": "Clear desk and clear screen",
       "summary": "Unattended screens and papers must not expose information.",
-      "auditor_looks_for": ["Automatic screen lock after a short idle time", "A password needed to unlock"],
-      "endpoint_relevance": "The screen lock settings are the technical control for clear screen." },
-    { "id": "A.7.10", "framework": "ISO 27001:2022", "title": "Storage media",
+      "auditor_looks_for": [
+        "Automatic screen lock after a short idle time",
+        "A password needed to unlock"
+      ],
+      "endpoint_relevance": "The screen lock settings are the technical control for clear screen."
+    },
+    {
+      "id": "A.7.10",
+      "framework": "ISO 27001:2022",
+      "title": "Storage media",
       "summary": "Manage removable media through its life cycle according to the classification of the data on it.",
-      "auditor_looks_for": ["Rules for USB and external drives", "Encryption or blocking of removable media"],
-      "endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted." },
-    { "id": "A.8.1", "framework": "ISO 27001:2022", "title": "User endpoint devices",
+      "auditor_looks_for": [
+        "Rules for USB and external drives",
+        "Encryption or blocking of removable media"
+      ],
+      "endpoint_relevance": "Unrestricted USB writing lets data leave the device unencrypted."
+    },
+    {
+      "id": "A.8.1",
+      "framework": "ISO 27001:2022",
+      "title": "User endpoint devices",
       "summary": "Protect information stored on, processed by or reachable from user devices.",
-      "auditor_looks_for": ["A baseline configuration for laptops and desktops", "Encryption, firewall, screen lock and malware protection enforced"],
-      "endpoint_relevance": "This is the main control the whole endpoint baseline supports." },
-    { "id": "A.8.2", "framework": "ISO 27001:2022", "title": "Privileged access rights",
+      "auditor_looks_for": [
+        "A baseline configuration for laptops and desktops",
+        "Encryption, firewall, screen lock and malware protection enforced"
+      ],
+      "endpoint_relevance": "This is the main control the whole endpoint baseline supports."
+    },
+    {
+      "id": "A.8.2",
+      "framework": "ISO 27001:2022",
+      "title": "Privileged access rights",
       "summary": "Restrict and manage the allocation and use of administrator rights.",
-      "auditor_looks_for": ["Named, approved administrators", "No everyday user accounts with administrator rights"],
-      "endpoint_relevance": "Local administrator membership on each device shows whether this control works." },
-    { "id": "A.8.5", "framework": "ISO 27001:2022", "title": "Secure authentication",
+      "auditor_looks_for": [
+        "Named, approved administrators",
+        "No everyday user accounts with administrator rights"
+      ],
+      "endpoint_relevance": "Local administrator membership on each device shows whether this control works."
+    },
+    {
+      "id": "A.8.5",
+      "framework": "ISO 27001:2022",
+      "title": "Secure authentication",
       "summary": "Authentication methods and procedures resist guessing, brute force and misuse.",
-      "auditor_looks_for": ["Account lockout after repeated failures", "Strong password or multi-factor requirements"],
-      "endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device." },
-    { "id": "A.8.7", "framework": "ISO 27001:2022", "title": "Protection against malware",
+      "auditor_looks_for": [
+        "Account lockout after repeated failures",
+        "Strong password or multi-factor requirements"
+      ],
+      "endpoint_relevance": "Lockout, complexity and screen-unlock settings implement this on the device."
+    },
+    {
+      "id": "A.8.7",
+      "framework": "ISO 27001:2022",
+      "title": "Protection against malware",
       "summary": "Protect against malware with technical controls supported by user awareness.",
-      "auditor_looks_for": ["Anti-malware running with current signatures", "Protection that cannot easily be switched off"],
-      "endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device." },
-    { "id": "A.8.8", "framework": "ISO 27001:2022", "title": "Management of technical vulnerabilities",
+      "auditor_looks_for": [
+        "Anti-malware running with current signatures",
+        "Protection that cannot easily be switched off"
+      ],
+      "endpoint_relevance": "Antivirus status, real-time scanning, tamper protection and signature age are checked on each device."
+    },
+    {
+      "id": "A.8.8",
+      "framework": "ISO 27001:2022",
+      "title": "Management of technical vulnerabilities",
       "summary": "Find technical weaknesses in time, judge the exposure and fix them.",
-      "auditor_looks_for": ["Timely patching", "Supported operating system versions"],
-      "endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed." },
-    { "id": "A.8.12", "framework": "ISO 27001:2022", "title": "Data leakage prevention",
+      "auditor_looks_for": [
+        "Timely patching",
+        "Supported operating system versions"
+      ],
+      "endpoint_relevance": "Automatic updates, recent patch dates and a supported OS show vulnerabilities are being managed."
+    },
+    {
+      "id": "A.8.12",
+      "framework": "ISO 27001:2022",
+      "title": "Data leakage prevention",
       "summary": "Apply measures that stop sensitive information leaving through unauthorised channels.",
-      "auditor_looks_for": ["Controls on removable media and uploads", "Monitoring of data leaving the organisation"],
-      "endpoint_relevance": "USB storage write access is a common leakage channel." },
-    { "id": "A.8.13", "framework": "ISO 27001:2022", "title": "Information backup",
+      "auditor_looks_for": [
+        "Controls on removable media and uploads",
+        "Monitoring of data leaving the organisation"
+      ],
+      "endpoint_relevance": "USB storage write access is a common leakage channel."
+    },
+    {
+      "id": "A.8.13",
+      "framework": "ISO 27001:2022",
+      "title": "Information backup",
       "summary": "Keep backup copies of information and software and test that they can be restored.",
-      "auditor_looks_for": ["Backups configured and recent", "Recovery keys and restore procedures available"],
-      "endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware." },
-    { "id": "A.8.15", "framework": "ISO 27001:2022", "title": "Logging",
+      "auditor_looks_for": [
+        "Backups configured and recent",
+        "Recovery keys and restore procedures available"
+      ],
+      "endpoint_relevance": "Work stored only on a laptop is lost if the device fails, is stolen or is encrypted by ransomware."
+    },
+    {
+      "id": "A.8.15",
+      "framework": "ISO 27001:2022",
+      "title": "Logging",
       "summary": "Produce, protect and review logs of activities, exceptions and security events.",
-      "auditor_looks_for": ["Logon and account changes recorded", "Logs kept long enough for investigation"],
-      "endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed." },
-    { "id": "A.8.17", "framework": "ISO 27001:2022", "title": "Clock synchronization",
+      "auditor_looks_for": [
+        "Logon and account changes recorded",
+        "Logs kept long enough for investigation"
+      ],
+      "endpoint_relevance": "Without security event logs, a breach on the device cannot be reconstructed."
+    },
+    {
+      "id": "A.8.17",
+      "framework": "ISO 27001:2022",
+      "title": "Clock synchronization",
       "summary": "Synchronise system clocks to an approved time source.",
-      "auditor_looks_for": ["All devices using network time"],
-      "endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident." },
-    { "id": "A.8.19", "framework": "ISO 27001:2022", "title": "Installation of software on operational systems",
+      "auditor_looks_for": [
+        "All devices using network time"
+      ],
+      "endpoint_relevance": "Correct timestamps are needed to correlate events across devices during an incident."
+    },
+    {
+      "id": "A.8.19",
+      "framework": "ISO 27001:2022",
+      "title": "Installation of software on operational systems",
       "summary": "Control which software users may install.",
-      "auditor_looks_for": ["An approved software list", "Restrictions on self-installed software"],
-      "endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing." },
-    { "id": "A.8.20", "framework": "ISO 27001:2022", "title": "Networks security",
+      "auditor_looks_for": [
+        "An approved software list",
+        "Restrictions on self-installed software"
+      ],
+      "endpoint_relevance": "Unapproved AI tools and remote access tools are signs this control is missing."
+    },
+    {
+      "id": "A.8.20",
+      "framework": "ISO 27001:2022",
+      "title": "Networks security",
       "summary": "Secure, manage and control networks and network devices to protect information.",
-      "auditor_looks_for": ["Host firewalls enabled", "Unsolicited inbound connections blocked"],
-      "endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés." },
-    { "id": "A.8.24", "framework": "ISO 27001:2022", "title": "Use of cryptography",
+      "auditor_looks_for": [
+        "Host firewalls enabled",
+        "Unsolicited inbound connections blocked"
+      ],
+      "endpoint_relevance": "The host firewall protects the laptop on untrusted networks such as hotels and cafés."
+    },
+    {
+      "id": "A.8.24",
+      "framework": "ISO 27001:2022",
+      "title": "Use of cryptography",
       "summary": "Define and apply rules for using cryptography, including key management.",
-      "auditor_looks_for": ["Full-disk encryption with strong algorithms", "Recovery keys stored safely"],
-      "endpoint_relevance": "Disk encryption protects data on lost or stolen devices." },
-
-    { "id": "Art. 5(1)(c)", "framework": "GDPR", "title": "Data minimisation",
+      "auditor_looks_for": [
+        "Full-disk encryption with strong algorithms",
+        "Recovery keys stored safely"
+      ],
+      "endpoint_relevance": "Disk encryption protects data on lost or stolen devices."
+    },
+    {
+      "id": "Art. 5(1)(c)",
+      "framework": "GDPR",
+      "title": "Data minimisation",
       "summary": "Personal data must be adequate, relevant and limited to what is necessary for the purpose.",
-      "auditor_looks_for": ["Only necessary data collected or shared", "OS and app data sharing reduced to the minimum"],
-      "endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed." },
-    { "id": "Art. 5(1)(e)", "framework": "GDPR", "title": "Storage limitation",
+      "auditor_looks_for": [
+        "Only necessary data collected or shared",
+        "OS and app data sharing reduced to the minimum"
+      ],
+      "endpoint_relevance": "Optional diagnostic data and AI features that capture screen content collect more than needed."
+    },
+    {
+      "id": "Art. 5(1)(e)",
+      "framework": "GDPR",
+      "title": "Storage limitation",
       "summary": "Personal data must not be kept in identifiable form longer than necessary.",
-      "auditor_looks_for": ["Retention rules", "Old personal data deleted"],
-      "endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed." },
-    { "id": "Art. 5(1)(f)", "framework": "GDPR", "title": "Integrity and confidentiality",
+      "auditor_looks_for": [
+        "Retention rules",
+        "Old personal data deleted"
+      ],
+      "endpoint_relevance": "Copies of personal data left on laptops are often kept far longer than allowed."
+    },
+    {
+      "id": "Art. 5(1)(f)",
+      "framework": "GDPR",
+      "title": "Integrity and confidentiality",
       "summary": "Personal data must be protected against unauthorised access, loss and damage with appropriate measures.",
-      "auditor_looks_for": ["Technical security measures in place"],
-      "endpoint_relevance": "The endpoint security baseline is part of these measures." },
-    { "id": "Art. 25", "framework": "GDPR", "title": "Data protection by design and by default",
+      "auditor_looks_for": [
+        "Technical security measures in place"
+      ],
+      "endpoint_relevance": "The endpoint security baseline is part of these measures."
+    },
+    {
+      "id": "Art. 25",
+      "framework": "GDPR",
+      "title": "Data protection by design and by default",
       "summary": "Build data protection into systems and use privacy-friendly settings by default.",
-      "auditor_looks_for": ["Privacy-protective default settings on devices and software"],
-      "endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed." },
-    { "id": "Art. 28", "framework": "GDPR", "title": "Processor",
+      "auditor_looks_for": [
+        "Privacy-protective default settings on devices and software"
+      ],
+      "endpoint_relevance": "Telemetry and AI data-collection features should be off unless needed."
+    },
+    {
+      "id": "Art. 28",
+      "framework": "GDPR",
+      "title": "Processor",
       "summary": "Use only processors that give sufficient guarantees, under a written contract with required terms.",
-      "auditor_looks_for": ["A data processing agreement with each processor"],
-      "endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement." },
-    { "id": "Art. 30", "framework": "GDPR", "title": "Records of processing activities",
+      "auditor_looks_for": [
+        "A data processing agreement with each processor"
+      ],
+      "endpoint_relevance": "Cloud AI tools used with work data are processors and need an agreement."
+    },
+    {
+      "id": "Art. 30",
+      "framework": "GDPR",
+      "title": "Records of processing activities",
       "summary": "Keep a written record of the processing activities you carry out.",
-      "auditor_looks_for": ["A current record of processing (RoPA)"],
-      "endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record." },
-    { "id": "Art. 32(1)(a)", "framework": "GDPR", "title": "Security of processing: pseudonymisation and encryption",
+      "auditor_looks_for": [
+        "A current record of processing (RoPA)"
+      ],
+      "endpoint_relevance": "Processing done with endpoint tools, including AI tools, belongs in the record."
+    },
+    {
+      "id": "Art. 32(1)(a)",
+      "framework": "GDPR",
+      "title": "Security of processing: pseudonymisation and encryption",
       "summary": "Where appropriate, protect personal data with pseudonymisation and encryption.",
-      "auditor_looks_for": ["Encrypted devices and removable media"],
-      "endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data." },
-    { "id": "Art. 32(1)(b)", "framework": "GDPR", "title": "Security of processing: confidentiality, integrity, availability and resilience",
+      "auditor_looks_for": [
+        "Encrypted devices and removable media"
+      ],
+      "endpoint_relevance": "Disk encryption is the standard measure for laptops holding personal data."
+    },
+    {
+      "id": "Art. 32(1)(b)",
+      "framework": "GDPR",
+      "title": "Security of processing: confidentiality, integrity, availability and resilience",
       "summary": "Ensure the ongoing confidentiality, integrity, availability and resilience of systems that process personal data.",
-      "auditor_looks_for": ["Access control, malware protection, patching and network protection on devices"],
-      "endpoint_relevance": "Most endpoint baseline checks support this requirement." },
-    { "id": "Art. 32(1)(c)", "framework": "GDPR", "title": "Security of processing: restore availability and access after an incident",
+      "auditor_looks_for": [
+        "Access control, malware protection, patching and network protection on devices"
+      ],
+      "endpoint_relevance": "Most endpoint baseline checks support this requirement."
+    },
+    {
+      "id": "Art. 32(1)(c)",
+      "framework": "GDPR",
+      "title": "Security of processing: restore availability and access after an incident",
       "summary": "Be able to restore access to personal data in time after a physical or technical incident.",
-      "auditor_looks_for": ["Working backups", "Recovery keys available"],
-      "endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible." },
-    { "id": "Art. 32(1)(d)", "framework": "GDPR", "title": "Security of processing: regular testing and evaluation",
+      "auditor_looks_for": [
+        "Working backups",
+        "Recovery keys available"
+      ],
+      "endpoint_relevance": "Backups and disk-encryption recovery keys make restoration possible."
+    },
+    {
+      "id": "Art. 32(1)(d)",
+      "framework": "GDPR",
+      "title": "Security of processing: regular testing and evaluation",
       "summary": "Regularly test, assess and evaluate whether security measures work.",
-      "auditor_looks_for": ["Periodic audits such as this one", "Evidence that findings are followed up"],
-      "endpoint_relevance": "Weekly audits and logging provide this evidence." },
-    { "id": "Art. 33", "framework": "GDPR", "title": "Notification of a personal data breach to the supervisory authority",
+      "auditor_looks_for": [
+        "Periodic audits such as this one",
+        "Evidence that findings are followed up"
+      ],
+      "endpoint_relevance": "Weekly audits and logging provide this evidence."
+    },
+    {
+      "id": "Art. 33",
+      "framework": "GDPR",
+      "title": "Notification of a personal data breach to the supervisory authority",
       "summary": "Report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk.",
-      "auditor_looks_for": ["A breach procedure", "Logs and accurate time to establish what happened"],
-      "endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible." },
-    { "id": "Art. 34", "framework": "GDPR", "title": "Communication of a personal data breach to the data subject",
+      "auditor_looks_for": [
+        "A breach procedure",
+        "Logs and accurate time to establish what happened"
+      ],
+      "endpoint_relevance": "Security logs and time synchronisation make the 72-hour assessment possible."
+    },
+    {
+      "id": "Art. 34",
+      "framework": "GDPR",
+      "title": "Communication of a personal data breach to the data subject",
       "summary": "Tell affected people about a high-risk breach without undue delay; encryption can remove this duty.",
-      "auditor_looks_for": ["Encryption that makes lost data unintelligible"],
-      "endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals." },
-    { "id": "Art. 35", "framework": "GDPR", "title": "Data protection impact assessment",
+      "auditor_looks_for": [
+        "Encryption that makes lost data unintelligible"
+      ],
+      "endpoint_relevance": "Encrypted devices and media can avoid the need to notify individuals."
+    },
+    {
+      "id": "Art. 35",
+      "framework": "GDPR",
+      "title": "Data protection impact assessment",
       "summary": "Assess the impact before processing that is likely to result in a high risk to people.",
-      "auditor_looks_for": ["DPIAs for high-risk processing"],
-      "endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA." },
-    { "id": "Art. 44", "framework": "GDPR", "title": "General principle for transfers",
+      "auditor_looks_for": [
+        "DPIAs for high-risk processing"
+      ],
+      "endpoint_relevance": "New tools with high-risk processing, such as AI used on employees, may need a DPIA."
+    },
+    {
+      "id": "Art. 44",
+      "framework": "GDPR",
+      "title": "General principle for transfers",
       "summary": "Transfer personal data outside the EEA only under the conditions of Chapter V.",
-      "auditor_looks_for": ["A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services"],
-      "endpoint_relevance": "Cloud AI tools often process data outside the EEA." },
-
-    { "id": "Art. 4", "framework": "EU AI Act", "title": "AI literacy",
+      "auditor_looks_for": [
+        "A transfer basis (e.g. adequacy decision, standard contractual clauses) for non-EEA services"
+      ],
+      "endpoint_relevance": "Cloud AI tools often process data outside the EEA."
+    },
+    {
+      "id": "Art. 4",
+      "framework": "EU AI Act",
+      "title": "AI literacy",
       "summary": "Providers and deployers take measures so their staff using AI have a sufficient level of AI literacy.",
-      "auditor_looks_for": ["AI training for staff who use AI tools"],
-      "endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training." },
-    { "id": "Art. 5", "framework": "EU AI Act", "title": "Prohibited AI practices",
+      "auditor_looks_for": [
+        "AI training for staff who use AI tools"
+      ],
+      "endpoint_relevance": "AI tools found on endpoints show who needs AI literacy training."
+    },
+    {
+      "id": "Art. 5",
+      "framework": "EU AI Act",
+      "title": "Prohibited AI practices",
       "summary": "Certain AI uses are banned, such as emotion recognition at work and in education (with narrow exceptions) and social scoring.",
-      "auditor_looks_for": ["No AI tools used for banned purposes"],
-      "endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list." },
-    { "id": "Art. 6", "framework": "EU AI Act", "title": "Classification rules for high-risk AI systems",
+      "auditor_looks_for": [
+        "No AI tools used for banned purposes"
+      ],
+      "endpoint_relevance": "The purpose of each detected AI tool must be checked against the banned list."
+    },
+    {
+      "id": "Art. 6",
+      "framework": "EU AI Act",
+      "title": "Classification rules for high-risk AI systems",
       "summary": "An AI system is high-risk if it is a safety component of regulated products or is used for a purpose listed in Annex III.",
-      "auditor_looks_for": ["A risk classification for each AI system in use"],
-      "endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is." },
-    { "id": "Art. 14", "framework": "EU AI Act", "title": "Human oversight",
+      "auditor_looks_for": [
+        "A risk classification for each AI system in use"
+      ],
+      "endpoint_relevance": "Classification depends on what the tool is used for, not only on which tool it is."
+    },
+    {
+      "id": "Art. 14",
+      "framework": "EU AI Act",
+      "title": "Human oversight",
       "summary": "High-risk AI systems must be designed so that people can oversee them effectively.",
-      "auditor_looks_for": ["Named, trained people overseeing each high-risk AI system"],
-      "endpoint_relevance": "Applies only when a high-risk AI system is in use." },
-    { "id": "Art. 26", "framework": "EU AI Act", "title": "Obligations of deployers of high-risk AI systems",
+      "auditor_looks_for": [
+        "Named, trained people overseeing each high-risk AI system"
+      ],
+      "endpoint_relevance": "Applies only when a high-risk AI system is in use."
+    },
+    {
+      "id": "Art. 26",
+      "framework": "EU AI Act",
+      "title": "Obligations of deployers of high-risk AI systems",
       "summary": "Deployers must use high-risk AI as instructed, assign human oversight, monitor it, keep logs and inform affected people.",
-      "auditor_looks_for": ["An AI register", "Use according to instructions", "Monitoring and log retention"],
-      "endpoint_relevance": "The AI software inventory is the starting point for these duties." },
-    { "id": "Art. 26(6)", "framework": "EU AI Act", "title": "Deployers: keep automatically generated logs for at least six months",
+      "auditor_looks_for": [
+        "An AI register",
+        "Use according to instructions",
+        "Monitoring and log retention"
+      ],
+      "endpoint_relevance": "The AI software inventory is the starting point for these duties."
+    },
+    {
+      "id": "Art. 26(6)",
+      "framework": "EU AI Act",
+      "title": "Deployers: keep automatically generated logs for at least six months",
       "summary": "Deployers keep the logs a high-risk AI system generates, under their control, for at least six months unless other law says otherwise.",
-      "auditor_looks_for": ["Log retention of at least six months for high-risk AI systems"],
-      "endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way." },
-    { "id": "Art. 50", "framework": "EU AI Act", "title": "Transparency obligations for providers and deployers of certain AI systems",
+      "auditor_looks_for": [
+        "Log retention of at least six months for high-risk AI systems"
+      ],
+      "endpoint_relevance": "Only applies if a detected AI tool is used in a high-risk way."
+    },
+    {
+      "id": "Art. 50",
+      "framework": "EU AI Act",
+      "title": "Transparency obligations for providers and deployers of certain AI systems",
       "summary": "People must be told when they interact with an AI system, and deepfakes and certain AI-generated text must be disclosed.",
-      "auditor_looks_for": ["Disclosure practices for chatbots and AI-generated content"],
-      "endpoint_relevance": "Staff publishing AI-generated content need clear rules." },
-    { "id": "Annex III", "framework": "EU AI Act", "title": "High-risk AI systems referred to in Article 6(2)",
+      "auditor_looks_for": [
+        "Disclosure practices for chatbots and AI-generated content"
+      ],
+      "endpoint_relevance": "Staff publishing AI-generated content need clear rules."
+    },
+    {
+      "id": "Annex III",
+      "framework": "EU AI Act",
+      "title": "High-risk AI systems referred to in Article 6(2)",
       "summary": "Lists high-risk uses such as biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration and justice.",
-      "auditor_looks_for": ["No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes"],
-      "endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants." }
+      "auditor_looks_for": [
+        "No unassessed use of AI for employment decisions, credit scoring or similar Annex III purposes"
+      ],
+      "endpoint_relevance": "A general AI assistant becomes high-risk if used, for example, to screen job applicants."
+    },
+    {
+      "id": "A.5.32",
+      "framework": "ISO 27001:2022",
+      "title": "Intellectual property rights",
+      "summary": "Protect intellectual property rights and use only properly licensed software.",
+      "auditor_looks_for": [
+        "A software licence register",
+        "No pirated software, activation cracks or unlicensed copies on devices"
+      ],
+      "endpoint_relevance": "Torrent clients and activation cracks on a device point to unlicensed software and a weak software-installation control."
+    }
   ]
 }

library/fixes.json

@@ -3,73 +3,244 @@
   "note": "Fixes Arx can apply or guide. kind 'auto': applied by collectors/<os>/fix.sh after the user clicks Fix and approves the administrator prompt; the old value is saved so it can be undone. kind 'settings': Arx opens the exact settings page and shows the steps (the change needs the user's password, a recovery key, a restart or a decision). The AI never writes or chooses commands; it may only explain these entries.",
   "fixes": {
     "firewall.enabled": {
-      "macos": { "kind": "auto", "title": "Turn on the firewall", "changes": "Turns on the macOS firewall, which blocks unwanted incoming connections.", "note": "Apps you already allowed keep working.", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Turn on the firewall",
+        "changes": "Turns on the macOS firewall, which blocks unwanted incoming connections.",
+        "note": "Apps you already allowed keep working.",
+        "undo": true
+      }
     },
     "firewall.inbound": {
-      "macos": { "kind": "auto", "title": "Turn on the firewall and stealth mode", "changes": "Turns on the firewall and stealth mode, so the Mac does not answer probes from other computers on the network.", "note": "Other computers can no longer ping this Mac.", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Turn on the firewall and stealth mode",
+        "changes": "Turns on the firewall and stealth mode, so the Mac does not answer probes from other computers on the network.",
+        "note": "Other computers can no longer ping this Mac.",
+        "undo": true
+      }
     },
     "malware.service": {
-      "macos": { "kind": "auto", "title": "Turn on Gatekeeper", "changes": "Turns on Gatekeeper, so only apps from the App Store and identified developers can open.", "note": "XProtect is always on and cannot be switched by a command.", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Turn on Gatekeeper",
+        "changes": "Turns on Gatekeeper, so only apps from the App Store and identified developers can open.",
+        "note": "XProtect is always on and cannot be switched by a command.",
+        "undo": true
+      }
     },
     "malware.signatures": {
-      "macos": { "kind": "auto", "title": "Update malware definitions", "changes": "Installs the latest XProtect malware definitions from Apple.", "note": "An update: there is nothing to undo.", "undo": false }
+      "macos": {
+        "kind": "auto",
+        "title": "Update malware definitions",
+        "changes": "Installs the latest XProtect malware definitions from Apple.",
+        "note": "An update: there is nothing to undo.",
+        "undo": false
+      }
     },
     "malware.signature_updates": {
-      "macos": { "kind": "auto", "title": "Install security responses automatically", "changes": "Turns on 'Install Security Responses and system files' in Software Update, so malware definitions stay current.", "note": "", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Install security responses automatically",
+        "changes": "Turns on 'Install Security Responses and system files' in Software Update, so malware definitions stay current.",
+        "note": "",
+        "undo": true
+      }
     },
     "gdpr.auto_updates": {
-      "macos": { "kind": "auto", "title": "Turn on automatic updates", "changes": "Turns on checking for, downloading and installing macOS updates and security responses automatically.", "note": "macOS may restart overnight to finish an update; it warns first.", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Turn on automatic updates",
+        "changes": "Turns on checking for, downloading and installing macOS updates and security responses automatically.",
+        "note": "macOS may restart overnight to finish an update; it warns first.",
+        "undo": true
+      }
     },
     "gdpr.guest_account": {
-      "macos": { "kind": "auto", "title": "Turn off the guest account", "changes": "Turns off guest login and guest access to shared folders.", "note": "", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Turn off the guest account",
+        "changes": "Turns off guest login and guest access to shared folders.",
+        "note": "",
+        "undo": true
+      }
     },
     "gdpr.telemetry": {
-      "macos": { "kind": "auto", "title": "Stop sharing analytics", "changes": "Turns off 'Share Mac Analytics' and 'Share with app developers'.", "note": "", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Stop sharing analytics",
+        "changes": "Turns off 'Share Mac Analytics' and 'Share with app developers'.",
+        "note": "",
+        "undo": true
+      }
     },
     "gdpr.time_sync": {
-      "macos": { "kind": "auto", "title": "Set the time automatically", "changes": "Turns on 'Set time and date automatically' from Apple's time server, so logs have correct times.", "note": "", "undo": true }
+      "macos": {
+        "kind": "auto",
+        "title": "Set the time automatically",
+        "changes": "Turns on 'Set time and date automatically' from Apple's time server, so logs have correct times.",
+        "note": "",
+        "undo": true
+      }
     },
     "screen_lock.enabled": {
-      "macos": { "kind": "settings", "title": "Turn on the screen lock", "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension", "steps": ["Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.", "Set 'Require password after screen saver begins or display is turned off' to Immediately."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Turn on the screen lock",
+        "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension",
+        "steps": [
+          "Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.",
+          "Set 'Require password after screen saver begins or display is turned off' to Immediately."
+        ]
+      }
     },
     "screen_lock.timeout": {
-      "macos": { "kind": "settings", "title": "Lock the screen sooner", "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension", "steps": ["Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.", "Set 'Require password after screen saver begins or display is turned off' to Immediately."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Lock the screen sooner",
+        "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension",
+        "steps": [
+          "Set 'Start Screen Saver when inactive' and 'Turn display off when inactive' to 5 minutes or less.",
+          "Set 'Require password after screen saver begins or display is turned off' to Immediately."
+        ]
+      }
     },
     "screen_lock.password": {
-      "macos": { "kind": "settings", "title": "Ask for the password straight away", "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension", "steps": ["Set 'Require password after screen saver begins or display is turned off' to Immediately (macOS asks for your password)."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Ask for the password straight away",
+        "url": "x-apple.systempreferences:com.apple.Lock-Screen-Settings.extension",
+        "steps": [
+          "Set 'Require password after screen saver begins or display is turned off' to Immediately (macOS asks for your password)."
+        ]
+      }
     },
     "encryption.enabled": {
-      "macos": { "kind": "settings", "title": "Turn on FileVault", "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault", "steps": ["Scroll to FileVault and click Turn On.", "Choose how to unlock the disk if you forget your password, and keep the recovery key somewhere safe (not on this Mac): without it, data can be lost.", "Encryption continues in the background; you can keep working."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Turn on FileVault",
+        "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault",
+        "steps": [
+          "Scroll to FileVault and click Turn On.",
+          "Choose how to unlock the disk if you forget your password, and keep the recovery key somewhere safe (not on this Mac): without it, data can be lost.",
+          "Encryption continues in the background; you can keep working."
+        ]
+      }
     },
     "encryption.protection": {
-      "macos": { "kind": "settings", "title": "Finish disk encryption", "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault", "steps": ["Check that FileVault is on. If encryption is in progress, keep the Mac on power until it finishes."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Finish disk encryption",
+        "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault",
+        "steps": [
+          "Check that FileVault is on. If encryption is in progress, keep the Mac on power until it finishes."
+        ]
+      }
     },
     "encryption.recovery": {
-      "macos": { "kind": "settings", "title": "Set up a recovery key", "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault", "steps": ["Turn FileVault on (or off and on again) and choose 'Create a recovery key'.", "Store the key somewhere safe outside this Mac, or let your IT team escrow it."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Set up a recovery key",
+        "url": "x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?FileVault",
+        "steps": [
+          "Turn FileVault on (or off and on again) and choose 'Create a recovery key'.",
+          "Store the key somewhere safe outside this Mac, or let your IT team escrow it."
+        ]
+      }
     },
     "vuln.pending_updates": {
-      "macos": { "kind": "settings", "title": "Install pending updates", "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension", "steps": ["Click Update Now (or Restart Now). Save your work first: the Mac may restart."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Install pending updates",
+        "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension",
+        "steps": [
+          "Click Update Now (or Restart Now). Save your work first: the Mac may restart."
+        ]
+      }
     },
     "gdpr.updates_recent": {
-      "macos": { "kind": "settings", "title": "Install the latest updates", "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension", "steps": ["Click Update Now. Save your work first: the Mac may restart."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Install the latest updates",
+        "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension",
+        "steps": [
+          "Click Update Now. Save your work first: the Mac may restart."
+        ]
+      }
     },
     "gdpr.os_supported": {
-      "macos": { "kind": "settings", "title": "Upgrade macOS", "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension", "steps": ["Install the offered macOS upgrade. Back up first, and check that your apps support it."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Upgrade macOS",
+        "url": "x-apple.systempreferences:com.apple.Software-Update-Settings.extension",
+        "steps": [
+          "Install the offered macOS upgrade. Back up first, and check that your apps support it."
+        ]
+      }
     },
     "gdpr.remote_access": {
-      "macos": { "kind": "settings", "title": "Turn off remote access you do not need", "url": "x-apple.systempreferences:com.apple.Sharing-Settings.extension", "steps": ["Turn off Screen Sharing, Remote Login, Remote Management and File Sharing unless your IT team needs them.", "Quit and uninstall remote tools such as TeamViewer or AnyDesk if they are not approved."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Turn off remote access you do not need",
+        "url": "x-apple.systempreferences:com.apple.Sharing-Settings.extension",
+        "steps": [
+          "Turn off Screen Sharing, Remote Login, Remote Management and File Sharing unless your IT team needs them.",
+          "Quit and uninstall remote tools such as TeamViewer or AnyDesk if they are not approved."
+        ]
+      }
     },
     "gdpr.backup_configured": {
-      "macos": { "kind": "settings", "title": "Set up Time Machine", "url": "x-apple.systempreferences:com.apple.Time-Machine-Settings.extension", "steps": ["Connect an external drive or choose a network backup disk, then click Add Backup Disk.", "Choose 'Encrypt backups'."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Set up Time Machine",
+        "url": "x-apple.systempreferences:com.apple.Time-Machine-Settings.extension",
+        "steps": [
+          "Connect an external drive or choose a network backup disk, then click Add Backup Disk.",
+          "Choose 'Encrypt backups'."
+        ]
+      }
     },
     "gdpr.backup_recent": {
-      "macos": { "kind": "settings", "title": "Back up now", "url": "x-apple.systempreferences:com.apple.Time-Machine-Settings.extension", "steps": ["Connect the backup disk and choose Back Up Now."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Back up now",
+        "url": "x-apple.systempreferences:com.apple.Time-Machine-Settings.extension",
+        "steps": [
+          "Connect the backup disk and choose Back Up Now."
+        ]
+      }
     },
     "user.account_type": {
-      "macos": { "kind": "settings", "title": "Use a standard account for everyday work", "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension", "steps": ["Create a separate administrator account for installing software.", "Then turn off 'Allow this user to administer this computer' for your everyday account. Do this only after the other administrator account works."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Use a standard account for everyday work",
+        "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension",
+        "steps": [
+          "Create a separate administrator account for installing software.",
+          "Then turn off 'Allow this user to administer this computer' for your everyday account. Do this only after the other administrator account works."
+        ]
+      }
     },
     "admin.unauthorized": {
-      "macos": { "kind": "settings", "title": "Review administrator accounts", "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension", "steps": ["Turn off 'Allow this user to administer this computer' for accounts that are not approved IT administrators. Keep at least one working administrator."] }
+      "macos": {
+        "kind": "settings",
+        "title": "Review administrator accounts",
+        "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension",
+        "steps": [
+          "Turn off 'Allow this user to administer this computer' for accounts that are not approved IT administrators. Keep at least one working administrator."
+        ]
+      }
+    },
+    "account.unique_login": {
+      "macos": {
+        "kind": "settings",
+        "title": "Turn off automatic login and shared accounts",
+        "url": "x-apple.systempreferences:com.apple.Users-Groups-Settings.extension",
+        "steps": [
+          "Set 'Automatically log in as' to Off (at the bottom of the page).",
+          "Give each person their own account; remove or rename shared accounts such as office or admin, keeping one named IT administrator."
+        ]
+      }
     }
   }
 }

site/site.js

@@ -271,6 +271,7 @@ function handedOverReport() {
 async function init() {
   initDevice(); initDownloads();
   try { await loadLibrary(); } catch (e) { $('checkCount').textContent = 'Could not load the check list.'; console.warn(e); return; }
+  document.querySelectorAll('[data-count]').forEach(el => { el.textContent = state.checks.length; });
   renderRail(); renderFilters(); renderTable();
   const showHandedOver = () => { const ev = handedOverReport(); if (ev) { history.replaceState(null, '', location.pathname); showResults(ev); } };
   showHandedOver();

synthetic/generate_evidence.py

@@ -39,20 +39,20 @@ ORDER = {
         "firewall.private.enabled", "firewall.private.inbound", "firewall.private.outbound",
         "firewall.public.enabled", "firewall.public.inbound", "firewall.public.outbound",
         "screen_lock.enabled", "screen_lock.timeout", "screen_lock.password", "usb.device_access", "usb.read", "usb.write",
-        "admin.approved", "admin.unauthorized", "user.account_type",
-        "encryption.feature", "encryption.enabled", "encryption.protection", "encryption.recovery", "vuln.pending_updates", "vuln.outdated_apps", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
+        "admin.approved", "admin.unauthorized", "user.account_type", "account.unique_login",
+        "encryption.feature", "encryption.enabled", "encryption.protection", "encryption.recovery", "vuln.pending_updates", "vuln.outdated_apps", "software.prohibited", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
     "linux": PASSWORD_LOCKOUT + [
-        "malware.antivirus", "malware.service", "malware.signature_updates", "malware.signatures", "malware.on_access",
+        "malware.antivirus", "malware.service", "malware.signature_updates", "malware.signatures", "malware.on_access", "malware.tamper",
         "firewall.enabled", "firewall.inbound", "firewall.outbound",
         "screen_lock.enabled", "screen_lock.timeout", "screen_lock.password", "usb.device_access", "usb.read", "usb.write",
-        "admin.approved", "admin.unauthorized", "user.account_type", "encryption.enabled", "encryption.protection", "encryption.recovery",
-        "vuln.pending_updates", "vuln.outdated_apps", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
+        "admin.approved", "admin.unauthorized", "user.account_type", "account.unique_login", "encryption.enabled", "encryption.protection", "encryption.recovery",
+        "vuln.pending_updates", "vuln.outdated_apps", "software.prohibited", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
     "macos": PASSWORD_LOCKOUT + [
-        "malware.antivirus", "malware.service", "malware.signatures", "malware.signature_updates", "malware.on_access",
+        "malware.antivirus", "malware.service", "malware.signatures", "malware.signature_updates", "malware.on_access", "malware.tamper",
         "firewall.enabled", "firewall.inbound", "firewall.outbound",
         "screen_lock.timeout", "screen_lock.enabled", "screen_lock.password", "usb.device_access", "usb.read", "usb.write",
-        "admin.approved", "admin.unauthorized", "user.account_type", "encryption.enabled", "encryption.protection", "encryption.recovery",
-        "vuln.pending_updates", "vuln.outdated_apps", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
+        "admin.approved", "admin.unauthorized", "user.account_type", "account.unique_login", "encryption.enabled", "encryption.protection", "encryption.recovery",
+        "vuln.pending_updates", "vuln.outdated_apps", "software.prohibited", "vuln.known_vulnerabilities"] + GDPR + AIACT + ORG,
 }
 # Checks that report Error when the collector is not run as administrator/root.
 NEEDS_ADMIN = {
@@ -338,6 +338,18 @@ class Device:
         return ("NotApplicable", "XProtect only", "on-access scanning", "XProtect scans at launch and download; macOS has no built-in on-access scanning.")
 
     def c_malware_tamper(self):
+        if self.os == "macos":   # System Integrity Protection (csrutil status)
+            if self.good(0.2):
+                return ("Compliant", "System Integrity Protection on", "on", "")
+            state = self.pick(["disabled", "unknown (Custom Configuration)"])
+            return ("Non-Compliant", f"System Integrity Protection {state.split(' ')[0]}", "on", f"System Integrity Protection status: {state}.")
+        if self.os == "linux":   # an enforcing security module; Secure Boot for information
+            expected = "SELinux or AppArmor enforcing"
+            sb = self.pick(["", "Secure Boot: SecureBoot enabled", "Secure Boot: SecureBoot disabled"])
+            if self.good(0.1):
+                lsm = "SELinux enforcing" if self.distro == "rhel" else f"AppArmor enforcing ({self.rng.randint(30, 140)} profiles)"
+                return ("Compliant", lsm, expected, sb)
+            return ("Non-Compliant", "no security module enforcing", expected, sb)
         if self.third_party_av:
             return self._defender_na("on")
         ok = self.good()
@@ -567,7 +579,7 @@ class Device:
         if self.os != "windows":
             self._enc = self.good(0.05)
         if self.os == "windows":
-            return self.result(self._enc, "FullyEncrypted (100%)" if self._enc else self.pick(["FullyDecrypted (0%)", "EncryptionInProgress (42%)"]), "fully encrypted")
+            return self.result(self._enc, "BitLocker: FullyEncrypted (100%)" if self._enc else self.pick(["BitLocker: FullyDecrypted (0%)", "BitLocker: EncryptionInProgress (42%)"]), "fully encrypted")
         if self.os == "linux":
             return self.result(self._enc, "root filesystem on LUKS (dm_crypt-0)" if self._enc else "root filesystem not encrypted", "system disk encrypted")
         return self.result(self._enc, "FileVault on" if self._enc else "FileVault off", "FileVault on")
@@ -608,6 +620,22 @@ class Device:
             return ("Compliant", f"Standard ({shown})", "Standard", "")
         return ("Non-Compliant", f"Administrator ({shown})", "Standard", "The signed-in user is a member of the administrators group.")
 
+    def c_account_unique_login(self):
+        expected = "personal accounts, no automatic login"
+        if self.good(0.05):
+            return ("Compliant", expected, expected, "")
+        shared = [n.strip() for n in self.b("SHARED_ACCOUNT_NAMES").split(",") if n.strip()] or ["office"]
+        names = sorted(self.rng.sample([n for n in shared if n not in ("administrator",)] or shared, self.rng.choice([1, 1, 2])))
+        if self.os == "windows":
+            names = [n.capitalize() for n in names]
+        issues = []
+        kind = self.pick(["auto", "generic", "both"])
+        if kind in ("auto", "both"):
+            issues.append(f"automatic login as {names[0] if kind == 'both' else self._desktop_users().split(', ')[0]}")
+        if kind in ("generic", "both"):
+            issues.append(f"shared or generic accounts: {', '.join(names)}")
+        return ("Non-Compliant", "; ".join(issues), expected, "")
+
     def c_vuln_pending_updates(self):
         limit = self.n("MAX_PENDING_SECURITY_UPDATES")
         expected = f"<= {limit} pending"
@@ -683,6 +711,19 @@ class Device:
             rows.append(f"{name} {WINGET_IDS[name]} {a}.{self.rng.randint(0, 9)}.{self.rng.randint(0, 999)} {a + self.pick([0, 1])}.{self.rng.randint(0, 9)}.{self.rng.randint(0, 999)} winget")
         return ("Non-Compliant", f"{len(rows)} outdated", expected, "; ".join(rows[:5]) + ".")
 
+    def c_software_prohibited(self):
+        listed = self.b("PROHIBITED_SOFTWARE")
+        if not listed:
+            return ("Compliant", "no list configured", "none of: (empty list)", "PROHIBITED_SOFTWARE in baseline.conf is empty.")
+        expected = f"none of: {listed}"
+        if self.good(0.12):
+            n = self.rng.randint(18, 140)
+            return ("Compliant", {"macos": f"none found in {n} applications", "windows": f"none found in {n} programs", "linux": "none found"}[self.os], expected, "")
+        found = {"macos": [["Transmission"], ["qBittorrent"], ["Deluge"], ["FrostWire"], ["Transmission", "qBittorrent"]],
+                 "windows": [["µTorrent"], ["BitTorrent"], ["qBittorrent v4.6.2"], ["KMSpico 10.2.0"], ["KMSAuto Net"], ["µTorrent", "KMSpico 10.2.0"]],
+                 "linux": [["transmission-gtk", "transmission-common"], ["qbittorrent"], ["deluge", "deluge-gtk"], ["ktorrent"]]}[self.os]
+        return ("Non-Compliant", ", ".join(self.pick(found)), expected, "")
+
     def c_vuln_known_vulnerabilities(self):
         """Builds a realistic software inventory; the real matcher fills in the result (see VULN_JOBS)."""
         expected = f"<= {self.n('MAX_CRITICAL_HIGH_VULNERABILITIES')} critical/high"