# Devseis endpoint audit baseline
# KEY=VALUE lines only. The collectors parse this file; they never execute it.
# Lists are comma-separated. Name matching ignores case; "*" works as a wildcard.

# --- Passwords -------------------------------------------------------------
PASSWORD_MIN_LENGTH=14
PASSWORD_HISTORY=24
# Passwords must expire within this many days. 0 = expiry not required (NIST SP 800-63B style).
PASSWORD_MAX_AGE_DAYS=365
PASSWORD_MIN_AGE_DAYS=1
PASSWORD_COMPLEXITY=1

# --- Account lockout -------------------------------------------------------
LOCKOUT_THRESHOLD_MAX=5
LOCKOUT_DURATION_MIN_MINUTES=15
LOCKOUT_OBSERVATION_MIN_MINUTES=15

# --- Malware protection ----------------------------------------------------
SIGNATURE_MAX_AGE_DAYS=3
# Apple ships XProtect data less often than daily signature feeds.
MACOS_XPROTECT_MAX_AGE_DAYS=30

# --- Firewall --------------------------------------------------------------
# Expected default outbound policy: allow | deny
FIREWALL_OUTBOUND=allow

# --- Screen lock -----------------------------------------------------------
# 300 seconds = 5 minutes
SCREEN_LOCK_MAX_SECONDS=300

# --- USB storage (allow | deny) --------------------------------------------
# Whether USB mass storage devices may connect at all (deny = blocked completely).
USB_DEVICE_ACCESS=allow
USB_READ=allow
USB_WRITE=deny

# --- Administrators --------------------------------------------------------
# Accounts allowed to be administrators: user names, DOMAIN\name, or Windows SIDs.
APPROVED_ADMINS=itadmin
# Windows: a disabled built-in Administrator (RID 500) is not counted as unauthorized.
ALLOW_DISABLED_BUILTIN_ADMIN=1

# --- Vulnerabilities -------------------------------------------------------
MAX_PENDING_SECURITY_UPDATES=0
MAX_OUTDATED_APPS=0
# Critical or high vulnerabilities allowed in installed software (offline OSV/NVD data)
MAX_CRITICAL_HIGH_VULNERABILITIES=0

# --- GDPR technical controls ----------------------------------------------
UPDATES_MAX_AGE_DAYS=30
BACKUP_MAX_AGE_DAYS=7
# Remote access services that may be enabled: rdp, ssh, smb, winrm, vnc, screensharing, filesharing, remotemanagement
APPROVED_REMOTE_SERVICES=
# Lowest OS versions that still receive security updates.
WINDOWS_MIN_BUILD=22631
MACOS_MIN_MAJOR=14
UBUNTU_MIN_VERSION=22.04
DEBIAN_MIN_VERSION=12
RHEL_MIN_VERSION=9
# Opt-in personal data discovery scan (0 = off). Not implemented in stage 1.
PERSONAL_DATA_SCAN=0

# --- EU AI Act -------------------------------------------------------------
# AI tools allowed on endpoints, as named in the AI software inventory (e.g. Microsoft Copilot,ChatGPT).
APPROVED_AI_TOOLS=

# Phones (mobile web check)
IOS_MIN_MAJOR=18
ANDROID_MIN_MAJOR=13
MOBILE_PATCH_MAX_AGE_DAYS=90
MOBILE_PASSCODE_MIN_DIGITS=6