Assessment platform and WAF alignment about review-checklists HOT 1 CLOSED

Hey @CalCof thanks for your feedback! We have evaluated the usage of the Microsoft Assessments platform to replace this framework, but unfortunately at this point in time it would be very difficult:

• Our checklists' primary goal is to serve as guidance for our engineers, our partners and our customers in FastTrack engagements. The current format of the assessment makes it very difficult to serve for this purpose. For example, in the Excel-formatted checklist you can assign owners to the resulting actions, add comments, merge input coming from Azure Resource Graph queries, filter items according to severity, and many other features that the Assessments platform is lacking today
• The secondary goal of the checklists in their current form is to be easily kept up-to-date. This is another problem of the Assessments, where the JSON file for each assessment has to be manually crafted and uploaded to the platform (there are no APIs). We have had similar approaches in the past (where our checklists were static), and the result was that the assessments/checklists got out-of-date very quickly.

Another area of alignment is CAF/ESLZ (much closer to the level of detail that these checklists bring than WAF), where we do try to follow ESLZ recommendations.

A Github issue is probably not the best forum to discuss this, happy to chat over a call.

from review-checklists.