This compliance checklist maps MITRE ATT&CK tactics and techniques to the mitigations Safous Privileged Remote Access applies to remote and privileged access. It is written for security, IT and OT teams that use ATT&CK to plan defenses, and it covers both ATT&CK for Enterprise and ATT&CK for ICS. The document is a behavior-based mitigation reference, not a certification checklist.
Download the PDF
What the Checklist Covers
| Requirement area | What it requires | How Safous supports it |
|---|
| Reconnaissance (T1593, T1046, T1133) | Limit what attackers can learn about exposed services and remote entry points. | Hides remote access entry points from the internet with no exposed VPN gateways or management endpoints. Safous does not detect reconnaissance; it reduces what it reveals. |
| Initial Access (T1078) | Prevent abuse of valid, shared or vendor accounts and permanently exposed remote access. | Checks identity, device and context on every access request; vendor access is not permanently exposed. |
| Execution | Restrict what can be run during remote sessions. | Limits sessions to approved systems and applications; in ICS environments only explicitly approved commands are permitted. |
| Persistence (T1098, T1136) | Stop attackers from keeping long-term access or creating accounts. | Just-in-time access removes standing vendor and engineer access; new accounts require approval and are audit logged. |
| Privilege Escalation (T1068, T1078) | Prevent misuse of high-privilege accounts. | Task- and role-specific privileged access policies, separation of high-privilege accounts, and explicit approval before reaching control-critical functions. |
| Lateral Movement (T1021) | Contain an intrusion to the system first reached. | Access to one system does not extend to others; IT-to-OT reachability is blocked and access is isolated by system, function and role. |
| Command and Control (T1071) | Make remote activity visible. | All privileged sessions are recorded and auditable, and only approved maintenance actions are permitted. |
| Exfiltration (T1041) | Control data leaving through remote sessions. | Controls, restricts and audits file transfers in privileged sessions. This is not full data loss prevention across all channels. |
| Impact (ICS) | Block unauthorized control actions. | Access restrictions block unauthorized control actions and shrink the exposed attack surface. |
The checklist groups these mitigations into three themes: removing internet-visible entry points, enforcing Zero Trust checks on identity, device posture and context, and replacing standing privileged access with time-limited, just-in-time grants.
Frequently Asked Questions
Is this a MITRE ATT&CK compliance certification?
No. The checklist is a behavior-based mitigation reference that shows how Safous Privileged Remote Access reduces exposure to specific ATT&CK tactics. MITRE ATT&CK is a knowledge base, not a certification scheme.
Does it cover OT and ICS environments?
Yes. It includes a separate ATT&CK for ICS section covering vendor access, approved commands, blocking IT-to-OT reachability and preventing unauthorized control actions.
Does Safous detect reconnaissance or prevent all data loss?
No. The checklist states that Safous limits what reconnaissance can reveal rather than detecting it, and that file-transfer controls in privileged sessions are not full data loss prevention.
Related resources: Regulatory compliance with Safous, Privileged remote access guide, Industrial secure remote access.
.png)
